Guernsey committee breached data protection laws, watchdog says

The Health and Social Care Committee said its compliance challenges were "a result of being under-resourced"

A government committee has been found to have breached data protection laws after failing to handle access requests.

The Data Protection Authority (DPA) said its investigation into Guernsey's Health and Social Care Committee (HSC) found ongoing delays, poor communication with requestors and systemic compliance failures dating from 2023 to 2025 relating to children and family community services.

It said the committee regularly missed legal deadlines for responding to data subject access requests (DSARs) and multiple provisions of data laws were broken - including the right to access personal data.

HSC said its compliance challenges were "a result of being under-resourced".

The DPA issued an enforcement order requiring HSC to contact all requestors with overdue DSARs with revised completion dates and to resolve them by the revised date and to develop a detailed plan of action for addressing the backlog.

It also enforced HSC to provide it with monthly updates, implement changes to ensure DSARs received following the date of implementation were dealt with "promptly and effectively" and to ensure better communication.

The DPA said failing to provide people with their DSARs was unacceptable.

"Individuals will often be requesting sensitive information relating to their medical history and/or childhood," it said.

"Failing to provide this information within the designated period restricts their ability to understand important life events or inform medical decisions and can lead to the individual feeling unseen by a large government body."

Follow BBC Guernsey on X, external and Facebook, external and Instagram, external. Send your story ideas to [email protected], external.