The Office of the Data Protection Commissioner (ODPC) has revealed, as part of its routine statistics reporting, that in the three months up to 18 August, there have been 32 self-reported personal data breaches, most of which were very low-level and required no further action.
The ODPC confirms that within the steady number of breaches reported, a small number were more significant or involved more than one jurisdiction necessitating coordination with other regulatory authorities. The ODPC continues to be engaged with the data controller on these cases.
The reporting of data breaches is in line with section 42 of the Data Protection (Bailiwick of Guernsey) Law, 2017, which requires organisations processing personal data to notify the ODPC of any personal data breach.
This new statutory obligation for data controllers, which has been in force for three months, aims to provide the ODPC with timely information, as well as ensuring transparency and accountability for those handling personal data.
In response to the new law, the ODPC aims to use and publish the reported information as much as possible.
Data Protection Commissioner, Emma Martins (pictured), confirmed that the breach reports were already proving helpful for the ODPC to gain insights in to real-world risks and to raise awareness within the community to help them mitigate and respond to those risks going forward.
‘It is vital we build a strong, respectful and constructive relationship with the regulated community. We recognise that reporting breaches requires them to trust us to do our job with absolute integrity.
"This is not about naming and shaming organisations when things go wrong. It's about building a positive and meaningful relationship, one that recognises that that our collective learning about the very real risks to individuals of poor data handling allows us to take important, preventative action and significantly improve our outcomes."