Guernsey
In a significant ruling, the Royal Court of Guernsey has dismissed an appeal by AFR Advocates against a reprimand issued by the Office of the Data Protection Authority (ODPA). The case centered on the improper handling of sensitive personal data, marking the first appeal under Guernsey's data protection regime.
The incident involved AFR Advocates delivering a court bundle containing over 200 pages, including the individual's health information, to a data subject's home. The bundle was left unattended on the doorstep in an unsealed lever-arch folder, raising concerns about data security. The ODPA determined that AFR had breached sections 6 (Integrity and Confidentiality) and 41 (Duty to take reasonable steps to ensure security) of the Data Protection (Bailiwick of Guernsey) Law, 2017.
AFR Advocates challenged the ODPA's decision on multiple grounds, including alleged errors of law and procedural unfairness. However, the Royal Court upheld the ODPA's findings, emphasizing the necessity for data controllers to implement appropriate technical and organizational measures commensurate with the sensitivity and risk profile of the data. The court also noted that prior public disclosure of the information did not diminish the controller's obligations under the law.
This judgment underscores the importance of stringent data protection practices, particularly when handling special category data such as health information. Organizations are reminded to assess and mitigate risks associated with data processing activities to ensure compliance with data protection laws.
