A personal data breach is defined in section 111(1) of the Law as any incident that meets the following criteria: “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed”. There will likely be a breach whenever any personal data is accidentally lost, corrupted or disclosed, or if someone accesses it or passes it on without proper authorisation to do so.
One of the key changes to the local data protection law that came into force in May 2018 is that organisations are legally required to notify the ODPA of any personal data breach within 72 hours of becoming aware of it (see section 42 (2) of the Law).
Organisations can report a breach to us online here. We have produced guidance on handling data breaches here.
You can access the statistics we publish about personal data breaches here.
The legal definition of ‘processing’ is very broad: ‘Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means.’
In plain English, ‘processing’ can be summed up as: anything you do with personal data.
Some examples of processing include: Collection; Recording; Organisation; Structuring; Storage; Alteration; Retrieval; Consultation; Use; Disclosure; Dissemination; Restriction; Erasure; Destruction.
A processor is any entity* that is given the task of processing personal data by a controller. Processors do not determine the nature or the means of the processing, they just do what the controller tells them to do. If you are part of such an arrangement you need to have in place a Controller/Processor agreement.
* this entity would normally be an organisation, but it could be a specific human being (e.g. sole traders, landlords, elected officials etc).
Any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, including aspects concerning that individual’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
The processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, where that additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable individual.
The following are public authorities for the purposes of the Law.
(a) the States,
(b) a public committee,
(c) a holder of a public office,
(d) a statutory body,
(e) a court or tribunal of the Bailiwick,
(f) any person hearing or determining an appeal, or conducting a public inquiry, under any enactment,
(g) the salaried police force of the Island of Guernsey or any police force which may be established by the States of Alderney or Chief Pleas of Sark,
(h) a parish Douzaine of the Island of Guernsey or the Douzaine of the Island of Sark,
(i) any person exercising or performing functions or holding any office similar or comparable to any of the persons described in paragraphs (a) to (h) in respect of any country other than the Bailiwick, or
(j) any other person that exercises or performs any function that is of a public nature in respect of the Bailiwick or any other country.
The Bailiwick of Guernsey's independent authority which regulates data protection legislation through an ethics-based approach, empowers individuals and protects their rights, promotes excellence in data protection, and supports the data economy to embrace innovation.
The Office of the Data Protection Authority
+44 (0)1481 742074enquiries@odpa.gg
St Martin's House, Le Bordage, St. Peter Port, Guernsey GY1 1BR
Newsletters sign-up Careers Cookies
Website by
&
Indulge
© 2022 The Office of the Data Protection Authority.