Data protection breach by Environment

The Department of the Environment has received a formal enforcement notice from the Data Protection Commissioner for breaching data protection principles.

 

It follows a complaint received by the Commissioner concerning sensitive personal information held by the department about an individual. The information was received by the department from a third party source in relation to an investigation into breaches of Jersey’s planning and building law.

 

The Chief Executive Officer of the Department of the Environment, Andy Scate said “The complaint arose after information was shared with the complainant as part of a data subject access request and the department has worked transparently and freely with the Office of the Data Protection Commissioner on this matter. I welcome the enforcement notice because it provides further clarity as to what information should, and should not be held concerning compliance investigations.”

 

The enforcement notice requires the department to remove certain data it holds on the individual concerned (as long as the complainant agrees). It must also make sure all its policies and procedures concerning holding personal information are up to date and comply with the data protection law, and ensure staff are fully aware of the law’s requirements.

 

Mr Scate said “The enforcement notice proposes a number of actions the department should take in relation to data handling and we plan to act on these fully. The actions will also inform the work we are doing reviewing the Planning and Building compliance function, and the work we’re doing to prepare for the Freedom of Information Act which comes into force in 2015.”

 

The department has accepted the information was present on its file and was held on an internal compliance file. The only time the information was passed to an external party was when it was sent to the complainant as part of their data subject access request.