The States of Guernsey Dairy (the Controller) is a public authority run and maintained by the States of Guernsey to provide customers with fresh milk and dairy products.
1. The Data Protection Law
The controller acknowledges its obligations as per the Data Protection (Bailiwick of Guernsey) Law, 2017 (the Law), which provides a number of requirements in terms of processing activities involving personal data. The controller further acknowledges the general principles of processing as well as the rights of a data subject and more information in relation to these provisions are provided within this fair processing notice and a full list of data subject rights can be found here
2. The Principles of Processing
a. Lawfulness, fairness and transparency
Personal data must be processed lawfully, fairly and in a transparent manner.
In order to provide milk and dairy products the controller collects personal data from data subjects who subscribe to this service. This data is collected in paper format and then added electronically. No personal data is collected from any third party or publicly available source. None of the personal data collected for this purpose is classified as "Special Category Data" (the most sensitive data as defined by the Law). The personal data that is collected for this purpose includes:
- The data subject's title and name - used for the purposes of identification
- The data subject's address - used for the purpose of delivery of paper billing information
- The data subject's contact details - used for the purpose of making contact for business reasons (including dealing with complaints and queries)
- The data subject's email address - required in order to deliver billing information electronically
- The data subject's bank account details - for the purpose of collecting payment and for credit checking purposes
- 2 trade or personal references and an appropriate bank reference - used for the purposes of setting up a credit account. The credit checking process is not an automated process
- CCTV images - used to maintain security of the Dairy site, prevent crime and ensure Health & Safety requirements are being met
- The data subject's title, name, address, email address and contact details may also be provided to the Safe and Local Supplier Association (SALSA), RSPCA Farm Assured Scheme, Soil Association, Guernsey Office of Environmental Health And Pollution Regulation and Food Standards Agency for purposes related to the traceability of produce, monitoring of the supply chain or for law enforcement.
No automated decision making will take place which involves the personal data of any data subject.
Dairy Operational Objective | Personal Data Processed | Lawful basis for processing |
To provide customers with fresh milk and dairy products. | Basic Personal Data: Title, name, address, contact details, email address, financial data, references | Schedule 2, Part 1, 2(a): "The processing is necessary for the conclusion or performance of a contract to which the data subject is a party." |
To deal with any queries or complaints from customers and members or the public. | Basic Personal Data: Name, contact details | Schedule 2, Part 1, 1: "The data subject has requested or given consent to the processing of the personal data for the purpose for which it is processed." |
To ensure the Dairy site is secure. | Basic Personal Data: CCTV images and footage | Schedule 2, Part 2, 13(a): "The processing is necessary for a law enforcement purpose." |
| To ensure the Dairy's products can be traced throughout the supply chain, particularly in the case of product incidents. | Basic Personal Data: Title, name, address, contact details, email address | Schedule 2, Part 1, 2(a): "The processing is necessary for the conclusion or performance of a contract to which the data subject is a party." Schedule 2, Part 2, 13(a): "The processing is necessary for a law enforcement purpose." |
| Vehicle CCTV: | | |
Images are captured from sites across the Dairy as well as on the public highway to safeguard employees and for the purpose of public safety | Basic Personal Data: Images of members of the public and employees, including but not limited to their vehicles (No audio is captured). | |
a. Purpose Limitation
Personal data must not be collected except for a specific, explicit and legitimate purpose and, once collected, must not be further processed in a manner incompatible with the purpose for which it was collected.
The controller acknowledges its responsibility with regards to this data protection principle and therefore the controller maintains that it will not further process that personal data in a way which is incompatible to its original reason for processing as specified in section 2a, or unless the controller is required to do so by law. The personal data will not be transferred to a recipient in an authorised or an unauthorised jurisdiction (as per the definition within the Law).
b. Minimisation
Personal data processed must be adequate, relevant and limited to what is necessary in relation to the purpose for which it is processed.
The controller maintains that it will only process the personal data which is detailed in section 2a, and will not process any further personal data that is not necessary in relation to the original reason for processing personal data as specified in section 2a, unless the controller is required to do so by law.
c. Accuracy
Personal data processed must be accurate, kept up-to-date (where applicable) and reasonable steps must be taken to ensure that personal data that is inaccurate is erased or corrected without delay.
The controller will ensure that all personal data that it holds is accurate and kept up-to-date, and any personal data that is inaccurate will be erased or corrected without delay.
d. Storage limitation
Personal data must not be kept in a form that permits identification of a data subject for any longer than is necessary for the purpose for which it is processed.
Where a data subject provides personal data to the controller for the fulfillment of a contract that data will be retained for as long as that contract is being upheld. Once the contract has ended the data will be disposed of in line with the States of Guernsey Records Management & Disposal Schedule.
The data required for the setting up of accounts will be removed once the credit checking process is complete
e. Integrity and confidentiality
Personal data must be processed in a manner that ensures its appropriate security, including protecting it against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
The controller maintains to process all personal data with appropriate levels of security. In order to prevent unauthorised or unlawful processing of the personal data provided by data subjects, the controller has put in place suitable physical, electronic and managerial procedures to safeguard and secure the information that is collected.
f. Accountability
The controller is responsible for, and must be able to demonstrate, compliance with the data protection principles.
The contact details of the controller are as follows:
States of Guernsey Trading Supervisory Board
Tel: 01481 237777
Email: info@guernseydairy.com
The contact details for the Data Protection Officer of the States Trading & Supervisory Board are as follows:
Data Protection Officer, States Trading & Supervisory Board
Tel: 01481 717000
Email: data.protection@gov.gg
