States of Alderney cautioned for data breach

Friday 25 June 2021

An Alderney resident was left unable to work after the island's States breached data protection laws while processing the renewal of their public service driving licence.

The States of Alderney was handed a 'formal reprimand' for violating its duty to comply with data protection principles and a person's right to information about personal data collected from them.

The Office for Data Protection Authority also issued a 'cautionary warning' for the unlawfulness of processing that was likely to occur had the licence renewal continued after the initial errors, which have not been set out in detail because of their confidential nature. 

The ODPA said the States of Alderney made changes to its renewal process and asked the applicant to provide "personal information of a sensitive nature."

However, no reason was given for why they needed the information when the complainant sought an explanation. 

When the complainant raised concerns about this, the States of Alderney ceased the renewal application altogether.

"The processing of personal data in all areas of public service carries with it additional responsibility"

Had the States of Alderney not ceased the application, there would have been "further definitive breaches of the Law", said the ODPA, because of the unlawful way in which the application had been processed up to that point. 

"It is acknowledged that the proposed changes to policy and procedures by the controller were all done with the best intentions, but the application of the processes and the implementation was flawed," said the ODPA in its decision notice, which did not disclose the exact nature of the breach. 

"The Government of Alderney and the processing of personal data in all areas of public service carries with it additional responsibility. It is imperative that where all personal data, but especially special category data are processed, there is absolute clarity on the legal basis for processing and all associated compliance requirements.

The Authority added: "There was a personal impact of this matter on the complainant. As they were unable to work whilst the renewal process was being resolved, there was a direct negative impact on their income."

The Bailiwick’s Data Protection Commissioner, Emma Martins, commented: “This matter highlights the importance of ensuring due process around the handling of all personal data, especially where that data are afforded greater legal protections, as in this case.

"We are grateful to the controller for their full cooperation throughout this case and for the positive steps they have already taken to prevent future breaches.”