“On the sixth anniversary of The Data Protection (Bailiwick of Guernsey) Law, 2017 coming into force, we reflect on how the Law has empowered the ODPA to serve the residents of Guernsey”, said Commissioner Homan, “Specifically, we celebrate how the Law has empowered us to promote the Bailiwick’s data rights through: enforcement, outreach, education, partnership, community engagement and protecting our children.”
1. Effective enforcement
The ODPA is the Bailiwick of Guernsey's independent supervisory authority which regulates data protection legislation. Its role is to protect people by driving responsible use of personal information through helping organisations get it right, deterring harmful information handling, and taking enforcement action against significant non-compliance. Where a contravention of the laws is found, the ODPA can publish its findings to alert the public and promote compliance in other organisations or government agencies. In 2023 the ODPA handled
56 complaints from members of the public against local controllers, triaged
151 personal data breaches, and published
12 new guidance notes to help organisations comply with the law. A key
investigation opened in October 2023 in relation to data room service outages that affected the States of Guernsey’s IT systems between November 2022 – January 2023. Also, in 2023, the
ODPA issued an Enforcement Order to The Committee for Health and Social Care (HSC) requiring HSC to issue a safeguarding report that a local family had asked for, relating to HSC’s care of a vulnerable adult.
2. Project Bijou
In 2021 the ODPA launched Project Bijou – a social initiative that encourages everyone to share stories, knowledge and experiences related to ethical data use, in a way that benefits everyone. Its aim is to support and nurture positive cultural change around how people and organisations treat people’s data. It seeks to engage people on a cultural level in addition to promoting compliance. Three years on from its launch Project Bijou is the ODPA’s touchstone and thematic thread – a promise to focus on engaging with the regulated community in a meaningful, practical and human way. In 2023 the project expanded with
9 new speakers added to the project’s resources, bringing the project total to
50 speakers.
3. New Commissioner
In January 2024, the ODPA welcomed its new Commissioner, Brent Homan. Brent was previously Deputy Commissioner, Office of the Privacy Commissioner of Canada and responsible for enforcing Canada's federal public and private sector privacy laws. A global leader in regulatory collaboration, Brent created the Global Privacy Enforcement Network (GPEN) Privacy Sweep and co-chairs alliances including the International Enforcement Cooperation Working Group of the Global Privacy Assembly. Brent envisions the Bailiwick of Guernsey as a model for the global data protection community with a public and private sector that embraces compliance and elevates trust and consumer confidence. Since his arrival Commissioner Homan has been instrumental in the ODPA being appointed co-chair of the Global Privacy Assembly’s (GPA) International Enforcement Cooperation Working Group. The ODPA is also a member of the following GPA working groups: Artificial Intelligence (AI) Working Group, Digital Citizen and Consumer Working Group. In March 2024 the ODPA joined international efforts to prevent unlawful data scraping, with
Commissioner Homan chairing a panel on this issue at the IAPP Global Privacy Summit in Washington DC in April 2024.
4. Children inspiring cultural change
The ODPA has a statutory function “to promote public awareness of risks, rules, safeguards and rights in relation to processing, especially in relation to children.” It fulfils this function via Project Bijou Seeds, the arm of the ODPA’s wider social initiative Project Bijou aimed at engaging the Bailiwick's young generations. ‘Project Bijou Seeds’ exists to raise children’s awareness of their rights, and to understand their responsibilities to others. In 2023 alone the ODPA educated
1,128 children and published ‘Warro goes on an adventure’ a book that introduces primary school aged children to the world of data. In 2023, the ODPA expanded its efforts towards developing a comprehensive 'Children's Framework' to support the responsible use of children’s information. The aim is to address the legal requirements of
The Data Protection (Bailiwick of Guernsey) Law, 2017 as well as align with the relevant principles and provisions outlined in the
United Nations Convention on the Rights of the Child. The ODPA consulted the public on this work and
convened a roundtable with local education leaders in order to share challenges and strategies towards protecting children online. The framework is now being drafted with a view to publishing it in early 2025.
5. Collaborative working for the benefit of the community
In January 2024 the ODPA launched ‘Bailiwick Data Protection Advisories’ – these are public notices, issued to the media, that highlight a specific data protection / privacy threat to the Bailiwick. The ODPA issued these advisories alongside warnings from Bailiwick Law Enforcement.
The first advisory warned Guernsey’s residents about financial text scams (including one that impersonated HSBC) that could lead to financial harms and identity theft, while the second advisory warned of a Snapchat group where children were encouraged to share explicit images. In the latter advisory parents were called upon to have conversations with their children regarding online risks and ensure that they were not using apps or on platforms for which they were not of authorised age.
6. Community engagement to improve breach preparedness
Looking to the future, the ODPA is moving to new premises in June 2024. This move comes at a time when the ODPA are expanding its outreach activities with the launch of a series of breach workshops which are free for anyone to attend. Due to the ‘intimacy’ of the Bailiwick, data breaches disproportionately injure local residents, so these workshops will focus on instilling a breach-preparedness mindset in businesses and organisations such that they embrace a dynamic security safeguard towards protecting Bailiwick residents’ information.
&
Indulge