Guernsey Revenue Service reprimanded for mishandling sensitive data

The Office of the Data Protection Authority (ODPA) has formally reprimanded Guernsey’s Revenue Service following an incident in which personal data was inadvertently sent to an incorrect email address. The breach involved sensitive information related to individuals with outstanding debts to the Committee for Health and Social Care.

An investigation by the ODPA revealed that the Revenue Service staff needed to adhere to established policies requiring emails containing personal data to be transmitted via a secure, specialized platform. This oversight allowed the unintended recipient access to sensitive information, which could have been swiftly revoked had the secure platform been used.

In response to the breach, the Revenue Service has implemented what the ODPA described as "robust measures," including deploying an enhanced version of the secure platform across employee systems. However, the ODPA criticized the agency for not taking sufficient preventive actions after a similar data breach in 2022.

“Had the Revenue Service acted upon what was revealed from earlier breaches, that some staff were failing to comply with this policy, there would have been additional measures in place to mitigate the impact of this personal data breach,” the ODPA stated.

The watchdog emphasized that the incident underscores the critical importance of consistently monitoring and reinforcing the effectiveness of security measures. While acknowledging that the Revenue Service had previously made efforts to secure personal data, the ODPA warned that such safeguards must be dynamic and evolve in response to emerging risks.