Guernsey ODPA orders Collas Crill to disclose withheld gift letter

Guernsey’s Office of the Data Protection Authority (ODPA) on 9 November 2026 issued an Enforcement Order requiring law firm Collas Crill to provide a complainant with a copy of a gift letter withheld after a July 2025 data subject access request (DSAR). The complainant had written and signed the letter to document funds donated to third parties for a property purchase, but did not retain a copy. The third parties later gave it to Collas Crill, which acted for them in the purchase.

Collas Crill’s DSAR response confirmed the complainant’s full name, residential address, bank account details and email address, but did not provide the gift letter or most of its contents. The firm later told the ODPA it was withholding the document under the “Privileged items” exemption and section 16 of the Data Protection (Bailiwick of Guernsey) Law, 2017, which can apply where requested personal data overlaps with a third party’s data.

Why the exemptions failed

The ODPA found that neither basis had been properly applied. The firm had not raised either exemption in its earlier correspondence with the complainant or the Authority. Its previous explanations indicated that the gift letter had been provided to Collas Crill to corroborate the source and status of funds, rather than to obtain legal advice.

The Authority also found that Collas Crill had not demonstrated that communications containing legal advice about the letter existed or had been provided to its clients. It concluded that the letter was not legally privileged, noting that the firm’s later position appeared inconsistent with its earlier statements.

The section 16 argument also failed. The letter was almost entirely the complainant’s personal data, written as a first-person statement. The complainant was its author and therefore already knew the circumstances of the property purchase and the third-party information it contained. The client data was limited and neither sensitive nor special-category data. Collas Crill’s assertion that the complainant’s legal action was sufficiently adverse to the clients’ significant interests was not evidenced, the ODPA said.

Section 15 gives individuals the right to receive one copy of their personal data. The ODPA found that withholding the letter unlawfully prevented the complainant from exercising that right and breached the Law.

DSAR transparency

The ODPA said controllers must identify and apply the correct exemption or exception when withholding personal data, and usually explain that decision to the requester by the statutory deadline. Failure to do so risks both non-compliance and a lack of transparency, and may indicate that insufficient consideration was given to data protection requirements.

Commissioner Homan said access to personal information was “a foundational data protection right” and warned that legal privilege must be considered carefully. Documents do not become privileged merely because they were provided to a lawyer.

The ODPA’s 28 October survey found strong general data protection awareness in Guernsey but gaps in knowledge of individual rights. The Enforcement Order now requires Collas Crill to provide the complainant with the gift letter.