The Authority’s powers

The Authority has certain powers under The Data Protection (Bailiwick of Guernsey) Law, 2017, which are detailed in Part XII and Schedule 7, and summarised below.
It’s important to note the limitations of the Authority’s powers: it cannot, for example get compensation for individuals. 

Power to require information 
The Authority has broad powers to require or compel controllers and processors (via an 'Information Notice') to provide information so that it can perform its functions (e.g. investigating a complaint). 

Power to assess and investigate complaints 
The Authority is required, under Section 68 of the Law, to assess and, where appropriate, investigate complaints that individuals make under Section 67 of the Law. 

Power to launch its own inquiries 
The Authority can, under Section 69 of the Law, launch an inquiry at its own discretion where there are concerns about a controller or processor’s compliance with the Law. It is not necessary for there to have been a complaint from an individual about a controller or processor for an inquiry to be carried out.

Power to  issue sanctions
The Authority can take enforcement action at the conclusion of an investigation or inquiry, and has four sanctions available under the Law: Reprimand, Warning, Enforcement Order, and Administrative Fine. 
1.    Reprimand - A formal recognition that an organisation has breached the Law in some way.
2.    Warning - A formal signal to an organisation to not proceed with certain proposed action as it is likely to breach the Law if it goes ahead.
3.    Enforcement Order - An instruction that compels an organisation to take specific action to address shortcomings in specific areas of the Law.
4.    Administrative Fine - An order that compels an organisation to pay a financial penalty in recognition of harm caused by a specific breach of the Law.

You can see details of all the Authority’s enforcement action here. 

Power to apply for and execute warrants 
In exceptional circumstances, the Authority can apply to the Court for a warrant and execute it to locate and secure evidence relevant to an investigation or inquiry. 

Power to conduct or require a data protection audit
The Authority can conduct a data protection audit on a controller or processor. 

Power to issue public statements
Section 64 of the Law allows the Authority to make public statements. These are usually issued at the end of an investigation or an inquiry but, if appropriate, one can be issued to advise of the start of an investigation or inquiry, or to confirm that a matter has been reported to us.   

You can read all the Authority’s public statements here.