DATA protection legislation may need to be changed to make government departments liable to fines for breaking the law, an assistant minister has said.
Officials in Children’s Services were reprimanded by the Information Commissioner this week after sensitive personal details were shared during a conference call.
Deputy Kirsten Morel, who has responsibility for data protection as part of his role as Assistant Economic Development Minister, acknowledged that the Island’s data protection law needed to be formally reviewed.
The existing law, which came into force in 2018, prevents the Information Commissioner levying fines against public authorities.
Commissioner Paul Vane said that if legislation had allowed, a fine would have been considered for the breaches by Children’s Services, which included sensitive information being shared during an online call, and subsequently via email.
Deputy Morel said: ‘Government departments hold some incredibly sensitive information, which should never find its way to the wrong people.
‘Strong data protection legislation is something that all Islanders deserve, and not having the ability to fine reduces the incentive for departments to change their ways.’
He said it was hard to justify why government bodies could not be fined when businesses and other organisations such as charities were liable to financial penalties.
Mr Vane said that the role of his office was to enforce existing legislation, but said that the issue of whether public authorities could be fined was a legitimate question with the government being the Island’s largest controller of data.
‘It’s a tricky one, because if you do fine a government department, real people may have to pay the fine through their taxes, but at the same time such people are the ones who the law is trying to protect,’ he said.
Mr Vane and Deputy Morel both conceded that any change to legislation was unlikely to be considered before the next States Assembly being elected in June.
‘It’s something that a future government should consider, and if they agree that fines may not be imposed, they’d need to be very clear as to why not,’ Deputy Morel said.
A spokesperson for Children’s Services acknowledged that the action taken by the Information Commissioner and said immediate steps had been taken to improve data protection and share important lessons.
The spokesperson added: ‘A full investigation into the incidents was undertaken and we engaged with the Information Commissioner throughout the inquiry.
‘Training and processes have been improved across the service and we continue to work to embed a culture of data protection by design.’
