The Data Protection (Bailiwick of Guernsey) Law, 2017 (“the Law”)
The Data Protection Authority (“The Authority”)
Issued: 2:30pm 26 November 2025
Controller: States of Alderney
What happened?
In December 2024, the States of Alderney publicly terminated the employment contract of the Chief Executive/Chief Clerk of the States of Alderney.
The complainant submitted a Data Subject Access Request (“the Request”) on 23 December 2024, seeking the release of data held and used by the States of Alderney during his tenure.
The complainant was given a dossier of data but believed key information was missing. He submitted a complaint to the Authority that decided to investigate.
The Authority’s investigation found that the Controller had breached section 15 of the Law, relating to data subject’s rights of access to his personal data. Specifically, the Authority found that there were inconsistent and excessive redactions of a letter. While some redaction was appropriate because the information related solely to someone else, some information should have been provided in unredacted form.
Why was that a problem?
When considering all the factors, the Authority found that the volume and application of redaction had a detrimental impact on the complainant, preventing a fair and transparent process and his ability to fully understand the grounds for the Controller’s decisions.
What happened as a result?
The Authority issued an Enforcement Order to the States of Alderney, requiring them to provide the complainant with an appropriately redacted document in accordance with the finding of their investigation. It is understood that that process is underway.
What can be learned from this?
A fair and balanced test must be applied to the release and redaction of documents when dealing with data subject access requests, taking into account the impact on all parties, whilst recognising the rights of the individual and complying with the Law.
"Access to one’s personal information is a fundamental data protection right and empowers individuals to understand and challenge decisions that are made about them”, said Data Protection Commissioner Brent Homan. “We appreciate the cooperation of the States of Alderney in addressing the requirements of the Enforcement Order”.