The organisation did not process special category personal data relating to an individual in a 'lawful, fair and transparent' manner, the Office of the Data Protection Authority (ODPA) has announced.
'In particular, the individual's personal information was processed without the demonstrable consent that was needed in this case,' the ODPA said.
'This led to the individual lodging a formal complaint regarding the processing of personal data by the Police under section 67 of the law.'
The ODPA found that Guernsey Police was 'unclear as to how the processing was compliant with the requirements of the Law, section 6(2)(a) in particular', and the procedures around the sharing of data in these circumstances evidenced a lack of compliance.
The ODPA is clear that where organisations do not ensure that personal data is processed in a lawful, fair and transparent manner, consideration will be given to the appropriate sanction including the issuing of a fine.
In this case, the ODPA has identified the following mitigating factors:
• The complaint and investigation focused on the sharing of personal data (including special category data) in relation to a single data subject;
• The Authority is not aware of any other complaints having been made about Guernsey Police in relation to such processing;
• Data was shared with two professional teams who the Police believed would be able to assist the data subject.
• When made aware of the complaint, Guernsey Police sought the destruction of the shared information and confirmation of destruction was provided by the parties with whom the data had been shared.
• It is recognised that Guernsey Police has commenced a review into the existing procedures to support those people they deem vulnerable following an admission that the procedure was not compliant with the requirements of the Law; and
• Guernsey Police has cooperated with the Authority.
Considering the above factors, the ODPA has, by written notice to Guernsey Police, imposed a formal enforcement order to bring specified processing operations into compliance and a reprimand for the lack of compliance.