- You Are In:
- Fair Processing Notice
Fair Processing Notice
Guernsey Water ('the controller') is a public authority run and maintained by the States of Guernsey to provide customers with domestic and commercial water and wastewater services. Guernsey Water processes your personal data for the following operational functions:
Management of the public water supply and waste water disposal including:
Monitoring water catchment area for pollution & nutrient levels
Management of controlled streams
Collection and treatment of rainfall
Cesspit emptying service
Guernsey Water is overseen by the States Supervisory Trading Board (STSB) and is the registered data controller for all activities which are summarised within this notice.
1. The Data Protection Law
The data controller (Guernsey Water) acknowledges its obligations as per the Data Protection (Bailiwick of Guernsey) Law, 2017 ('the Law') which provides a number of requirements in terms of processing activities involving personal data. The controller further acknowledges the general principles of processing as well as the rights of a data subject. Further information in relation to the principles of fair processing can be found within this fair processing notice and a full list of data subject rights can be found here.
2. The Principles of Processing
a. Lawfulness, fairness and transparency
Personal data must be processed lawfully, fairly and in a transparent manner.
In order to provide domestic and commercial water and wastewater services the controller collects personal data from data subjects who subscribe to this service. Data is occasionally requested from the States of Guernsey Cadastre; in order to carry out our public service.
Guernsey Water collects the following personal data:
- Basic personal data relating to individuals: name, address, date of birth, contact information
- Basic personal data relating to individuals: name, address, contact information in relation to Cesspit collection
- Financial data: (e.g. bank details) used for billing purposes
- Images: CCTV is in operation at all Guernsey Water sites. Some images may be collected in public areas
- Images: Cesspit and/or remote emptying point image to include Geographical site access for information purpose
In terms of "Special Category" data, the most sensitive of personal data under the Law, Guernsey Water may collect information revealing:
- Health data: occasionally, customers may choose to provide us with personal medical information to help us provide a service
The table shown below lists the operational function of Guernsey Water and the personal data that is required to fulfil each function, together with the lawful basis for processing the data. Schedule 2 (Conditions for Processing to Be Lawful) of the Law provides a number of conditions to ensure that the processing of personal data by a controller is lawful. The relevant condition varies according to the specific processing activity in each case, for a full list of conditions that the controller may rely upon please click here.
Guernsey Water Function
Personal data processed
Lawful Basis for Processing
Deliver mandated service of providing domestic and commercial water and wastewater services, to include Cesspit Emptying Service.
Basic Personal Data
Name, address, date of birth, contact information, financial data (bank details used for billing purposes)
Special Category Data
Basic Personal Data
Schedule 2, Part I, Condition 2 (a):
The processing is necessary for the conclusion or performance of a contract
Special Category Data
Schedule 2, Part 3, Condition 19:
The Processing is necessary to protect the vital interests of the data subject or any other individual and the controller cannot be reasonably expected to obtain the explicit consent of the data subject.
No automated decision making will take place which involves the personal data of any data subject.
Some of the systems we use to deliver our services involve the transfer of your data. Contracts and strict guidelines are in place to ensure that your information is kept safe and secure and that those companies are only using your data for the specific purpose of delivering the service we have requested. For more information on the companies and systems we use to deliver our services, and how they use your data, please contact Guernsey Water using the contact details provided in section (g).
The controller is offering a public utility service to data subjects, however as the controller is a public authority (as defined by data protection law), the lawfulness of processing does not relate to the legitimate interests of the controller or third party.
a. Purpose Limitation
Personal data must not be collected except for a specific, explicit and legitimate purpose and, once collected, must not be further processed in a manner incompatible with the purpose for which it was collected.
The controller acknowledges its responsibility with regards to this data protection principle and therefore the controller maintains that it will not further process that personal data in a way which is incompatible to its original reason for processing as specified in section 2a, unless the controller is required to do so by law.
Personal data processed must be adequate, relevant and limited to what is necessary in relation to the purpose for which it is processed.
The controller maintains that it will only process the personal data which is detailed in section 2a, and will not process any further personal data that is not necessary in relation to the original reason for processing personal data as specified in section 2a, unless the controller is required to do so by law.
Personal data processed must be accurate, kept up-to-date (where applicable) and reasonable steps must be taken to ensure that personal data that is inaccurate is erased or corrected without delay.
Guernsey Water will ensure that all personal data that it holds is accurate and kept up-to-date and any personal data that is inaccurate will be erased or corrected without delay in accordance with the Law as applicable.
d. Storage limitation
Personal data must not be kept in a form that permits identification of a data subject for any longer than is necessary for the purpose for which it is processed.
Where a data subject provides personal data to the controller for the fulfilment of a contract that data will be retained for as long as that contract is being upheld. Once the contract has ended the data will be destroyed in line with the States of Guernsey Records Management and Retention Schedule. If you have a particular query about how long your data is being held, please contact our Data Guardian (contact details in section g) who will be happy to provide you with further information.
e. Integrity and confidentiality
Personal data must be processed in a manner that ensures its appropriate security, including protecting it against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
Information Access - Guernsey Water processes all personal data with appropriate levels of security. Access to electronic or paper records is tightly controlled. Employees are vetted in a manner commensurate with the role that they are expected to undertake. Protocols are followed to ensure that employees only have access to areas and documents as required to undertake their role. Access is monitored and effectively managed.
Information Security - Guernsey Water adopts the information security standards of the States of Guernsey.
The controller and/or joint controller is responsible for, and must be able to demonstrate, compliance with the data protection principles.
The contact details of the controller are as follows:
The Data Guardian, Guernsey Water
Tel: 01481 229500
In relation to the Cesspit Emptying Service data the role of Controller will be jointly shared between Guernsey Water and States Works.
The contact details for the Data Protection Officer of the States Trade & Advisory Board are as follows:
Kyle Merrien, Data Protection Officer
Tel: 01481 220012