Whoops! States forget to update small print post GDPR

Wednesday 19 September 2018

A number of forms used by the States of Guernsey to collate personal information from members of the public have been found to still refer to the old 2001 Data Protection Law.

The 2001 Data Protection (Bailiwick of Guernsey) Law was repealed and replaced in November 2017, with the new regulations coming into force on 25 May 2018 amid huge amounts of publicity. However, a number of States of Guernsey forms, including most used by Social Security still refer to the old law in print and online.

The various forms, which are used to gather highly personal information state: "Any personal information you give us will be processed in accordance with the Data Protection (Bailiwick of Guernsey) Law, 2001."

Concerned when he had to fill one of the forms in, a member of the public told Express he checked the data policy following the publicity surrounding GDPR earlier this year.

“I have recently received a form from States of Guernsey Social Security, requesting various in depth personal information.  However, given the nature of the information held within this form I thought I would check the confidentiality law it was held against, only to find that the form still cited the 'Data Protection (Bailiwick of Guernsey) Law, 2001’ on it.”

They said, “this would suggest that every single form collected by Social Security since 25 May 2018 will have been obtained citing that the data was being in accordance with the old law.”

Pictured: One example of a form on the States of Guernsey website on Tuesday 18 September.

Express found that along with the majority of Social Security forms citing the old law, a number of States privacy policies also referred to the 2001 Law. Privacy policies are in place both online and in print for people to refer to and read prior to filling in other States forms such as planning applications, housing information and the online Income Tax return form for 2018 (above).

While there is no concern over compliance as the States of Guernsey has not done anything wrong against the new Data Protection law, the oversight does need to be addressed, with The Office of the Data Protection Commissioner confirming all forms should carry information regarding the 2017 law which was adopted in May 2018.

"The Data Protection (Bailiwick of Guernsey) Law, 2001, has been repealed and therefore any newly collated data should be done in compliance with the Data Protection (Bailiwick of Guernsey) Law, 2017. Any literature in relation to collating new data should refer to the new law," a spokesperson said. 

Pictured: Guernsey's Data Protection Commissioner.

The States Data Protection team said work is continuing to update all forms the island's government uses, and the ones which have been missed will be amended now it's been brought to their attention.

"Social Security, like all States of Guernsey service areas, has been updating all of their paper and online forms and documents to ensure they reference the new data protection law. As can no doubt be appreciated, there are likely thousands of such documents. If any have been missed during this process, they are amended as soon as it is brought to the relevant service area’s attention."

The spokesperson said this does not mean the form's which until recently were available online and in paper form were non-compliant, just out of date and that is now being amended. Anyone with any concerns should make contact with the relevant department for clarity.

"To clarify, the fact the form states the wrong law does not make the form non-compliant, it simply means that the form is out of date. The data will of course be processed in accordance with the Data Protection (Bailiwick of Guernsey) Law, 2017. 

"For any of our customers who are concerned, we would encourage them to contact the relevant service to seek clarity on how their data is being processed. Our fair processing notices can also be found at gov.gg/dp."

Pictured: Edward T Wheadon House.