Four months after the introduction of General Data Protection Regulation (GDPR), Guernsey businesses are taking data protection seriously, but the local data protection office has yet to fine an organisation for a breach of the law.
The Guernsey Data Protection Office received more than 50 notifications before the end of August and Babbé Partner Nick Robison (pictured) believes it’s only a matter of time until action is taken against a local business.
A specialist in dispute resolution, particularly in the fiduciary sector, Advocate Robison is dealing with a number of matters arising from GDPR and says it’s not too late for businesses to get their house in order.
“The GDPR legislation has yet to be tested but you only have to look to the UK to see that breaches occur, some of them serious, and major fines are being imposed,” he says. “Eventually, the Guernsey commissioner will be looking to make a salutary example of a local business over a breach of the law.”
By 31 August, the Guernsey Data Protection Office had received 18 complaints from members of the public and 35 self-reported breaches from local organisations.
In the UK, the Information Commissioner’s Office has seen a rise in reported concerns, which it puts down to heightened public awareness after the introduction of GDPR legislation in May. In one of its most recent actions it fined BUPA £175,000 for failing to have effective security measures in place to protect customers’ personal information.
The Office of the Guernsey Data Protection Commissioner is expected to give a further update on breaches at the end of this month.