Apology after data breach causes family distress

The Jersey Office of the Information Commissioner said "very real distress" was caused to the complainant and her family

A data breach which had a "hugely negative impact" on a family has led to an apology from the government.

The Jersey Office of the Information Commissioner (JOIC) said the incident involved details being shared about the mother of a child during a meeting with the Department for Children, Young People, Education and Skills (CYPES).

The JOIC said the child's mother made a complaint as her own mother, who was at the meeting, was not aware of the information and it caused "very real distress".

Constable Richard Vibert, minister for children and families, said CYPES fully accepted the JOIC's findings and was sincerely sorry.

JOIC, an independent regulatory authority overseeing Jersey's Data Protection Law, said CYPES "demonstrated poor governance and a lack of controls" with its records management and note-taking.

"Records of previous disclosures had not been recorded appropriately leading to the unauthorised disclosure," it said.

JOIC added CYPES should review its referral process and ensure all staff and third-party organisations received appropriate training.

'Strengthened our governance'

Vibert said CYPES had conducted its own comprehensive investigation and reviewed its referral process after the matter came to the government's attention.

He said all relevant staff and third-party organisations had received enhanced training.

"We have strengthened our governance and controls relating to records management and note-taking, ensuring that all disclosures are accurately recorded and that sensitive information is protected at every stage," Vibert added.

"We are committed to upholding the highest standards of data protection and privacy for all children, young people, and families we work with and will continue to review and improve our practices, guided by the lessons learned from this investigation."