Organisations urged to get data protection right

The head of a Jersey data protection body has urged organisations to "get the basics right" if they want to avoid breaches of personal data.

It follows a virtual audit of a health department by the Jersey Office of the Information Commissioner (JOIC) which it said holds sensitive information and had suffered breaches in the past.

While there were areas of good practice the audit set timeframes for improvements in staff training and ensuring it had relevant and effective data protection policies and procedures.

Information commissioner Paul Vane said he hoped the results of the audit sent a "very strong message" to organisations trusted with people's data.

The JOIC is a part of the Jersey Data Protection Authority and is responsible for overseeing the data protection and freedom of information laws.

During its audit process the JOIC assesses policies, processes and levels of compliance with data protection law, highlight potential risks and set timeframes for improvements.

The most recent audit follows a separate review of part of the island's health sector in March.

"Organisations should be getting the basics right to avoid breaches which can cause distress and harm to individuals and reputational damage," Mr Vane said.

"Elements of this most recent audit mirror the findings from a separate audit on a health service sector that we published earlier this year.

"We publish key findings to allow those processing personal information in Jersey, no matter how small or large their organisation, to benefit from the lessons learned.

"We hope lessons from our audits as well as other enforcement actions send a very strong message to those operating in Jersey that are entrusted with islanders' personal information."

Follow BBC Jersey on X and Facebook. Send your story ideas to [email protected].