The Parish of Grouville has been slapped by the data protection watchdog for a blunder that saw an Islander mistakenly chased for unpaid parish rates.
According to a formal reprimand from the Jersey Office of the Information Commissioner published this afternoon, the parish “incorrectly identified a member of the public owing rates to it” after failing to carry out the right identity checks.
The person in question shared the same name as the real debtor.
Individual’s details sent to debt agency
In its ruling, the JOIC said Grouville had contravened the law, and “should have had better processes in place in order to identify the correct individual”.
The watchdog said the parish had gone as far as passing the mistaken individual’s details to a debt collecting agency – but noted that, “thankfully, matters did not get to that stage”.
It also found that Grouville had dipped into information held in a government driving licence system known as LICAR in an attempt to cross-reference personal data.
Data processed “unlawfully and without transparency”
“The LICAR system collects personal data for a certain purpose (driving licence management). It is not collected in relation to Rates collection,” the JOIC explained.
“Therefore, at the time of the contravention, the data contained in the LICAR system was processed unlawfully and without transparency.”
It went on to state that the parish had “failed to make all the necessary checks to ensure the details provided to the debt collector were those of the individual owing Rates payment to the parish”.
“Lost trust and confidence”
When the JOIC spoke to the complainant about the impact of the incident, they said that they had “lost trust and confidence”.
Having considered whether Grouville “knew/ought to have known that a contravention of this kind would be likely to cause substantial distress”, the watchdog concluded that, overall, the parish had “demonstrated poor governance and a lack of controls over a significant and long-standing activity of rates management”.
The team said they had considered a “range of sanctions”, but decided that it would not go any further than calling out the parish’s misdemeanour publicly, “noting POG’s particular circumstances”.
It did, however, order Grouville to clean up its act with specific measures, including documenting and training staff on its ‘outstanding rates’ process, and updating its privacy policy.
Following the incident, the JOIC said that there were several lessons learned for businesses and public organisations:
- organisations must have “proportionate, relevant and practical systems and procedures which can be relied upon by staff and customers”;
- they should “recognise and mitigate the risks associated with identifying an individual incorrectly”;
- they should have “appropriate controls and governance protocols in place to process personal information appropriately, which are reviewed periodically, including, for example, data-sharing agreements; and
- they should have a “relevant and accurate, easily understood, fit-for-purpose privacy policy”.
