Q: During the pandemic, we are worried that our data protection practices might not meet our usual standards or our response to information rights requests might be longer. Will the Jersey Office of the Information Commissioner take regulatory action against us?
A: We understand that resources, whether they are finances or people, might be diverted away from usual compliance or information governance work. We will not penalise organisations that we know need to prioritise other areas or adapt their usual approach during this extraordinary period, however we will examine each case on its merits. We cannot extend statutory timescales, but we will tell people through our own communications channels that they may experience understandable delays when making information rights requests during the pandemic. Data subjects will likely understand the difficulties that businesses are facing at this time and you should ensure that you continue to communicate with the data subject, explaining any delays and advising them when you hope to respond to their request. We will not take action against controllers that have tried to comply but are hampered in their efforts by the current situation. The key to success in these difficult times is transparency and communication with your customers.
