P&R breached data protection laws

Saturday 13 April 2024

Guernsey's senior political committee has breached data protection laws after refusing to give a jobseeker a copy of a reference received which led to an employment offer being withdrawn.

Under the Data Protection (Bailiwick of Guernsey) Law, 2017 the jobseeker was entitled to see the reference.

P&R had refused to give the jobseeker the reference because it contained information about other people, but the Data Protection Authority said that was wrong.

P&R had performed a "balancing test" before deciding against giving the person a copy of their reference, with the committee saying it had decided that the interests of the person who wrote the reference outweighed those of the jobseeker.

The jobseeker lodged a complaint with the ODPA, saying they were concerned as to why P&R was refusing to tell them what was in the reference.

After an investigation, carried out by staff of the ODPA, the Data Protection Authority found that P&R had "not given appropriate consideration to the jobseeker’s significant interests".

The ODPA has now said: "It is reasonable for any jobseeker to understand and validate what is being said about them by a previous employer – especially when that information may impact their ability to get a job".

It was decided that P&R had prevented the jobseeker from understanding what their previous employer had said about them, which meant they were unable to validate its accuracy which in turn made it difficult to challenge the recruitment decision as well as to exercise other rights available under the Law.

For that reason, the ODPA found P&R had breached the data protection law "by failing to provide information that the jobseeker was entitled to receive under the right of access".

The Authority issued P&R with an Enforcement Order meaning they had to give the jobseeker a redacted copy of the reference.

P&R did not appeal this decision and has already given the jobseeker the redacted reference.

The ODPA said "everyone has a right to know what is being said about them, especially when what is being said about them may impact their chances of getting a job. Everyone is entitled to due process, and this includes the ability to validate information about them. The individual was unable to do so in this case."

The ODPA also said that on such occasions where personal data can relate to more than one person simultaneously, a balancing test must be undertaken to determine whether it is reasonable to refuse to give the information in response to a data subject access request.

On this occasion, P&R had carried out a balancing test and had decided the information could not be disclosed. 

The Office of the Data Protection Authority has guidance on its website which explains how to comply in such situations, and others.