Reprimand issued to Deputy Kevin Gentle of the States of Alderney relating to data release issues

The Data Protection (Bailiwick of Guernsey) Law, 2017 (the Law) 
Public Statement 
Issued: 15:00 11 February 2021 
Controller: Deputy Kevin Gentle 

1. This is a public statement made by the Data Protection Authority (the Authority) under section 64 of The Data Protection (Bailiwick of Guernsey) Law, 2017 (the Law). 

2. The Law seeks to ‘...promote the rights of individuals in relation to their personal data and provide for the free movement of personal data...’ and the Authority is the independent regulatory body responsible for overseeing it. 

3. Following a complaint made to the Authority under section 67 of the Law, an investigation was conducted under section 68 of the Law. The complaint related to the alleged unauthorised collection of personal data by the covert audio recording of a conversation during a private meeting and the subsequent alleged disclosure of that recording to a third party. 

4. It was shown that Deputy Gentle, in his capacity as an elected States of Alderney public representative, covertly recorded a conversation with the complainant with whom he had met. The complainant had arranged the meeting to raise concerns regarding a particular ongoing building project and the management of that project. The recording of that conversation was later shared by Deputy Gentle with a third party who then further disclosed it to an industry governing body, who then used the data to instigate an investigation into the actions of the complainant. (That investigation resulted in a finding of no breach of industry guidelines.) The complainant however, considered Deputy Gentle’s actions to have breached his rights and brought his name into disrepute within the business industry. 

5. The Authority does not dispute the assertion by Deputy Gentle that his actions stemmed from a desire to act in the best interests of the public position he holds. However, the Authority considers that the same result could have been obtained by recording contemporaneous notes at the meeting or by being open with the complainant and seeking prior agreement to carry out an audio recording. 

6. As a result of the investigation, the Authority determined that Deputy Gentle breached the Law in relation to the unauthorised collection and disclosure of personal data. 

7. The Authority has issued Deputy Gentle with a reprimand. This reflects the nature and circumstances of the breach. The finding also reflects the positive and constructive engagement by Deputy Gentle throughout the investigation and his willingness to learn lessons from this experience. 

8. The Authority acknowledges that appropriate States of Alderney policies were in place which prohibited such data collection practices but were not complied with in this instance. 

9. The Authority is however, concerned that this matter highlights a general lack of understanding of the Law by elected public representatives and the importance of looking after data, which can often be highly sensitive and confidential.  Individuals have a right to expect the highest standards of conduct from those elected to represent them. 

10. The Authority hopes that by highlighting this case, lessons can be learnt, and future compliance breaches reduced, emphasising the importance that appropriate policies and procedures are not only in place but are also complied with. 

11. Deputy Gentle had the right to appeal this judgement but chose not to do so. 
     

The Bailiwick’s Data Protection Commissioner, Emma Martins, commented:  

'Individuals who act in important positions in an official public capacity will inevitably be subject to greater scrutiny of their actions. It is therefore the case that their conduct must at all times reflect the significant responsibilities of the role and the importance of engendering a trust and confidence in them across the community they serve.  

The Deputy recognises that he fell short on this occasion and we are grateful for the open and honest manner in which he engaged with us. This case highlights how important it is not only to ensure policies and procedures around data handling are fit for purpose, but that they are also communicated effectively and complied with.'

Legal Framework 

• This is a public statement made by the Data Protection Authority (the Authority) under section 64 of The Data Protection (Bailiwick of Guernsey) Law, 2017 (the Law).  
• The Authority may conduct an investigation (under section 68 of the Law) following a complaint, into whether a controller or processor has breached or is likely to breach an operative provision of the Law.  
• In this case, the controller is Deputy Kevin Gentle.  
• Section 72 of the Law requires the Authority to determine whether or not there has been a breach of an operative provision of the Law.  
• The Authority determined that sections 6,7,8 and 12 of the Law were breached in the collection and disclosure of personal data in this case. 
• Section 73 of the Law sets out the sanctions that are available to the Authority where a breach determination has been made.  
• Having considered the details of this case, the Authority has imposed a reprimand under section 73(1)(a) of the Law.  
• Section 84 of the Law provides for an appeal by the controller to the Court against a determination made by the Authority.  Any such appeal must be made within 28 days.  The controller has not made an appeal in this case.