A fine ordered by the Data Protection Authority
Personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual, which allows and confirms the unique identification of that individual, such as facial images or dactyloscopic (fingerprint) data.
An individual under 18 years of age. Visit our children area for more information.
Specific, informed and unambiguous indication of the data subject’s wishes by which the data subject, by a clear statement or by clear affirmative action, signified agreement to the processing of personal data relating to the data subject.
A person (individual or legal) that, alone or jointly with others, determines the purposes and means of the processing of any personal data.
Criminal data is any personal data about a person's: criminal activity; alleged criminal activity; investigations into that person; and legal proceedings involving that person.
The harm a person experiences that is caused by the misuse, loss, or improper sharing of their personal-data both deliberate and/or accidental. Harm can be felt physically or emotionally. For example, loss of money through fraud or identity theft, or damage to a person’s reputation and any emotional distress they suffer.
Data Protection Impact Assessments (DPIAs) are an important compliance tool when you are embarking on new processing or making changes to existing processes. In some cases it will a legal requirement that you conduct a DPIA.
You can read more about DPIAs here.
A 'data subject' is the person who is identified (or identifiable) by personal data. So you, me, your family and friends are referred to as 'data subjects' when our personal data is being used by a organisation/entity.
Means a legal right a person* has under our Law. Please see Your Rights for more detail.
*(people are known as 'data subjects' in the Law)
Any structured set of personal data which is accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis.
Personal data relating to the inherited or acquired genetic characteristics of an individual which gives unique information about the physiology or the health of that individual, including as a result of an analysis of a biological sample from the individual.
Personal data relating to the health of an individual, including the provision of health care services, which reveals information about the individual’s health (physical or mental) status.
Includes the purpose of preventative or occupational medicine, the assessment of the working capacity of an employee or worker, medical diagnosis, the provision of medical, health or social care or treatment, or the management of medical, health or social care systems and services.
Processing of personal data is deemed to be likely to pose a high risk to the significant interests of data subjects where it involves –
Any processing of personal data that is likely to pose a high risk to the significant interests of data subjects. This should be determined by considering the nature, scope, context and purpose of the processing as well as the technology, mechanism or procedure used to process the data in question.
Processing of personal data will be considered as posing a high risk where it involves –
An individual is identifiable from any information where the individual can be directly or indirectly identified from the information, including –
A number or code that is assigned to an individual by a controller or processor and that uniquely identifies that individual. It includes location data and number or code issued to an individual by a public authority but excludes an individual’s name.
The Law requires controllers to comply with a request to exercise data subject rights within the designated period which is specified as one month.
The Interpretation and Standards Provisions (Bailiwick of Guernsey) Law, 2016 provides that one month shall mean calendar month.
A personal data breach is defined in section 111(1) of the Law as any incident that meets the following criteria: “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed”. There will likely be a breach whenever any personal data is accidentally lost, corrupted or disclosed, or if someone accesses it or passes it on without proper authorisation to do so.
One of the key changes to the local data protection law that came into force in May 2018 is that organisations are legally required to notify the ODPA of any personal data breach within 72 hours of becoming aware of it (see section 42 (2) of the Law).
Organisations can report a breach to us online here. We have produced guidance on handling data breaches here.
You can access the statistics we publish about personal data breaches here.
The legal definition of ‘processing’ is very broad: ‘Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means.’
In plain English, ‘processing’ can be summed up as: anything you do with personal data.
Some examples of processing include: Collection; Recording; Organisation; Structuring; Storage; Alteration; Retrieval; Consultation; Use; Disclosure; Dissemination; Restriction; Erasure; Destruction.
An individual or other person that processes personal data on behalf of a controller and includes a secondary processor (another processor engaged by the primary processor).
Any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, including aspects concerning that individual’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
The processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, where that additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable individual.
The following are public authorities for the purposes of the Law.
(a) the States,
(b) a public committee,
(c) a holder of a public office,
(d) a statutory body,
(e) a court or tribunal of the Bailiwick,
(f) any person hearing or determining an appeal, or conducting a public inquiry, under any enactment,
(g) the salaried police force of the Island of Guernsey or any police force which may be established by the States of Alderney or Chief Pleas of Sark,
(h) a parish Douzaine of the Island of Guernsey or the Douzaine of the Island of Sark,
(i) any person exercising or performing functions or holding any office similar or comparable to any of the persons described in paragraphs (a) to (h) in respect of any country other than the Bailiwick, or
(j) any other person that exercises or performs any function that is of a public nature in respect of the Bailiwick or any other country.
Personal data revealing an individual’s racial or ethnic origin, political opinion, religious or philosophical belief, trade union membership, genetic data, biometric data, health data, data concerning an individual’s sex life or orientation, criminal data.