The States of Guernsey has reported itself to the island’s data protection authority, after accidentally sending an email about the Digital Greenhouse tender without hiding email addresses.
Economic Development (ED) announced in August that it intended to close the Digital Greenhouse to save taxpayers money, unless it could find a private sector or voluntary organisation to take over.
The committee published details of the tender process yesterday, but appears to have potentially broken data protection rules by ‘CCing’ multiple people and firms, rather than hiding the emails by ‘BCCing’ them.
Damon Hackley, Director of Operations for Economy, Infrastructure, Environment & Culture, told Express: “Yesterday, an email was mistakenly sent to a number of email addresses without them being blind copied, as part of an update from the Digital Greenhouse.”
He said the email was “recalled shortly after” and the incident had been referred to the Office of the Data Protection Authority (ODPA).
Express understands the email itself contained no confidential information, but would have allowed Digital Greenhouse members to see each other’s email addresses.
Under Guernsey’s data protection rules email addresses are personal information under certain circumstances, so sharing without good reason them could constitute a data breach.
By law, organisations have 72 hours to self-report data breaches and other incidents to the ODPA. The States did so within about 24 hours.
