Jersey Office of the Information Commissioner – Data Protection Statement
What this Statement covers
This data protection statement explains the privacy practices of the Jersey Data Protection Authority (including the Jersey Office of the Information Commissioner, “JOIC”). It covers how information is collected, how it is used, your rights, and what controls you have. In particular:
- what information we may collect and when;
- how we might use your information;
- how we protect your information; and
- your rights regarding the information you provide.
It applies to information we collect when you use our website and social media channels, and when you contact or engage with us for our statutory functions. Staff/recruitment matters are covered by a separate policy.
Identity of the data controller
The Jersey Data Protection Authority was established by the Data Protection Authority (Jersey) Law 2018 and is the data controller for the personal information it holds in carrying out its functions under that Law, the Data Protection (Jersey) Law 2018 and the Freedom of Information (Jersey) Law 2011.
Jersey Office of the Information Commissioner2nd Floor, 5 Castle Street, St Helier, Jersey, JE2 3BT
T. (+44) 1534 716530
E. enquiries@jerseyoic.org
W. www.jerseyoic.org
The Data Protection Officer (DPO)
To contact the JOIC’s Data Protection Officer, email dpo@jerseyoic.org or call +44 1534 716530.
Activity and personal
information collection.
How we use your
personal information.
Directly from you
Make an enquiry/in person or online
If you reach out to us via our contact page and give us your name and contact email address, we will contact you separately (usually by email) using the details you have provided. If you visit our office to speak to us we keep a record of your enquiry and also our response.
We will email or telephone you in order to respond to the query you have raised and to engage with you and we need enough information to deal properly with the issue you have raised. We do not audio record or retain audio recordings of phone conversations. However, where an individual contacts the JOIC by phone, caller numbers are automatically stored on the recipient phone for a limited period of time in a list of inbound and outbound calls, but no further processing of this data (caller numbers) is carried out by us and the information is automatically deleted after 1 month.
We will keep a record of the contents of relevant phone calls in the form of notes made on the relevant case file.
Depending on the purpose of your visit, we may ask you for identification. For example, an ad hoc visit to test our fire alarms or water quality. If we ask you to show some form of identification, this will not be recorded anywhere and is purely for identification verification.
Complaints/enforcement action
If you raise a complaint with the JOIC, we will use the information you give us to investigate your complaint. If you have made a complaint against an organisation, we will usually need to disclose your identity to them. This is so we can advise them of the nature of the complaint you have made and so that they can respond to that complaint. (This may also mean that we receive information from the organisation about you.)
We need this information in order to investigate the complaint and/or carry out any conciliation.
Under the Authority Law, we may investigate and sanction individuals and organisations for alleged breaches of the legislations we regulate (including DPJL 2018 and the Freedom of Information (Jersey) Law 2011).
This includes the prevention, investigation, and/or detection of criminal offences where we may carry out investigations jointly with the States of Jersey Police. (Please note that the Information Commissioner does not have the power to bring any criminal prosecution; that power lies solely with HM Attorney General for Jersey. Whilst we can assist in any investigation any decision to prosecute lies with the Attorney General alone. Similarly, there is no power to bring private prosecutions in Jersey.)
Self-reported breach
Self-reported breach
If you make a report to us about a data breach, please complete our online breach reporting form.
We will use the information you give us to investigate your breach.
We also receive personal information indirectly
We also receive personal information indirectly if:
- We have contacted an organisation about a complaint you have made and it gives us your personal information as part of its response.
- Your personal information is contained in reports from organisations about breaches of data protection law.
- A complainant refers to you as part of their complaint.
- ‘Whistleblowers’ include your information in their report to us.
- We have seized information as part of an investigation and it includes your personal information.
- Other regulators or law enforcement bodies have given information to us.
If it is not disproportionate or prejudicial, we will contact you to let you know we are processing your personal information.
Social Media
If you interact with us on one of our social media profiles, we might follow you back or respond to any comments you make on our social media posts. We don’t keep any separate records or lists of our social media followers but it’s usually clear when you have connected with us in that way.
In that context, we consider that we have a legitimate reason to use your information here because of how you have interacted with us and if you contact us on social media, we consider that you are happy for us to either engage with you via that platform or take the conversation offline, using the information you have provided in order to contact you via email, for example.
Social media platforms allow users to block, report and/or unfollow other users so those methods are available to you if you decide that you no longer want to engage with us in that way.
Attend an event, seminar, workshop or hiring our facilities
If you sign up for one of our events you will give us your name, contact details, the name of the organisation you represent and depending on the nature of the event about any dietary requirements, you have.
Our purpose for collecting this information is so we can facilitate the event and provide you with an acceptable service. We don’t publish delegate lists for events.
We need this information to get in touch with you about the event and, on the day of the event, for safety reasons (e.g. in the event of a fire drill). If we operate a waiting list for oversubscribed events we will hold your details just in case a place becomes available.
Responding to our consultation requests and surveys
If you respond to a consultation/survey we launch then we will give you the option to submit it anonymously. If you provide us with us with your contact details, we may need to get in touch with you about your submission in order to clarify part of your submission or ask you for further information.
We will publish a summary of the consultation responses/survey outcomes and, in some cases, the responses themselves but these will not contain any personal data. The consultation documentation/survey information will make it clear what we plan to publish.
The lawful basis we are relying on to process your personal data is when this is necessary to perform our public tasks as a regulator.
Third Parties
Breach investigations
If an organisation has suffered a data breach, we may receive information regarding the individuals whose data has been compromised.
Investigations and Inquiries – data protection
The Authority may carry out an investigation and/or an inquiry regarding the practices and procedures of data controllers and processors and we may get personal data about you which is contained in records or submissions received by us from data controllers and processors. This personal data could be wide ranging and may include special category data.
We need this information in order to investigate the complaint.
Investigations and appeals – Freedom of Information (FOI)
The Commissioner may carry out investigation into the practices and procedures of FOI bodies. It may also carry out an appeal when an individual makes a complaint to us that a public authority has not complied with a request made for information. In conducting an investigation and/or an appeal, we could get personal data about you which is contained in records or submissions received by us from FOI bodies. This personal data could be wide ranging and may include special category personal data depending on the investigation.
Occasionally, in carrying out research during an investigation we get personal data from publicly available sources (such as, public registers or information available online).
Investigations – law enforcement
We may investigate alleged criminal offences under the legislation we regulate. This will usually be jointly with the States of Jersey Police and sometimes with the Jersey Financial Services Commission. In order to establish whether offences have been committed and decide upon an appropriate course of action we need to gather appropriate information to assist with that investigation. This might include witness statements from affected individuals (suspects and victims).
Registrations & Fees
Our purpose for collecting personal data during the registration and/or fee payment process is so that we can contact you about your registration or about any other queries relating to your compliance with the legislation we oversee. We may also contact the nominated DPO/DP lead to advise them of upcoming JOIC initiatives and to invite them to take part in relevant workshops, consultations etc. which we feel would be of interest to them and which forms part of the Authority’s obligations to promote compliance with and knowledge of the relevant legislation,
If you are required to pay a fee, we need to take certain personal information from you during the course of the process. This includes the name and contact details of the person who is responsible for paying the fee and your Data Protection Officer (DPO) if you have one. We will also take payment information including account details if you are paying via direct debit.
This applies to all organisations required to register with the Authority.
Children’s information
We do not provide services directly to children or proactively collect their personal information. Young people have rights under the DPJL 2018 and in the exercising of their rights, we need their information in order to investigate the complaint or enquiry. However, we are sometimes given information about children while handling a complaint or conducting an investigation.
As part of our education and awareness programmes, we regularly visit children in supervised lessons in schools. We do not obtain or use any of their personal information (we do not take names of attendees, for example).
Visitors Wi-Fi
We have Wi-Fi on site for the use of visitors. We’ll provide you with the address and password. We do not record the sites visited, duration etc. when someone is connected to our Wi-Fi.
We don’t ask you to agree to terms, just to acknowledge the fact that we have no responsibility or control over your use of the internet while you are on site, and we don’t ask you to provide any of your information to access this service.
How long do we keep your information for?
All data is retained securely and only used for the purposes set out in the Law. Data is retained to comply with our statutory obligations and in accordance with our retention schedule.
Sign up for one of our newsletters
We process your personal data (email address and optional organisation type) in relation to our newsletter sign-up process under Schedule 2, Part I, paragraph 1 of the DPJL 2018 i.e. we rely on your consent and when you sign-up, you can tell us which of our newsletters you want to sign up to.
We will only use your email address for the sole purpose of sending you the newsletter(s) you have signed up to. During the sign-up process you will receive an email to verify your details.
We use the legal basis of ‘consent’ to process your data in this way, and you are free to withdraw your consent at any time. A manage subscriptions link is included in each newsletter email to enable you to manage your subscriptions. Or you can email communications@jerseyoic.org from the email address you subscribed to our newsletter(s) with and ask us to unsubscribe you from the relevant newsletter(s).
There are a number of lawful (legal) bases upon which we rely to process personal data about you. These are:
For the performance of our public functions including fulfilling our statutory obligations under the DPJL 2018, the Authority Law and the Freedom of Information (Jersey) Law 2011; where the data subject has given consent to the processing of his or her personal data for one or more specific purposes e.g. for inclusion in contact lists and at conferences or events;
where the processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract e.g. where we engage with third party service providers; and where such is necessary for our legitimate interests (other than where we are performing our regulatory functions and where those interests are not overridden by the interests/rights and freedoms of the data subjects).
Third Party Processors are other organisations/services carefully chosen by the Authority to allow us to function and operate. In the case of organisations outside of Jersey, the United Kingdom and the European Economic Area (EEA);
(a) we have prior written instructions for the transfer or (b) we have entered into specific contractual terms with them to ensure that they treat your personal data in way equivalent to that in which they would be required if they were established in Jersey.
We will make sure that those organisations are able to keep your information safe.
Social Media
If you interact with us on one of our social media profiles, we might follow you back or respond to any comments you make on our social media posts. We don’t keep any separate records or lists of our social media followers but it’s usually clear when you have connected with us in that way.
If you send a message via social media that needs a response from us, we may process it in our case management system as an enquiry or a complaint. When contacting the JOIC through a social media platform, we suggest you also familiarise yourself with the privacy information of that platform.
We publish statistical information relating to work we have carried out (for example in our annual report) but this information is anonymised and does not identify any one person.
We do publish Decision Notices relating to appeals that have been made to our office under the Freedom of Information (Jersey) Law 2011 and we may publish the results of any enforcement action we have taken under the Authority Law, including where we have made a public statement and / or issued an administrative fine.
We use Transport Layer Security (TLS) to encrypt and protect email traffic in line with government guidance on email security. Most webmail such as Gmail and Hotmail use TLS by default. We’ll also monitor any emails sent to us, including file attachments, for viruses or malicious software.
You must ensure that any email you send is within the bounds of the law.
We use a small number of essential cookies that are necessary for the secure operation of our website and online services. These cookies do not track you or store any personal data. They are required for core functionality such as logging in, maintaining a secure session, and protecting our forms from misuse.
The essential cookies we use include:
-
Authentication cookies (joic.portal.auth, joic.portal.authC1, joic.portal.authC2)
These cookies are set when you log in and are used to maintain your authenticated session while you navigate the site. They ensure that we can verify your identity securely and keep your session active. Some authentication cookies may be split into multiple parts (“chunked cookies”) for technical reasons.
-
Antiforgery cookie (joic.portal.antiforgery)
This cookie helps protect the website from cross-site request forgery (CSRF) attacks. It ensures that form submissions originate from your device and prevents malicious third parties from acting on your behalf. These cookies are only used on the areas of our website where you can submit information to us, i.e. via a form, and do not collect any personal data. They rely on unique tokens generated within the user’s browser which are matched to confirm that the submission is legitimate and not a malicious third party.
These cookies are strictly necessary for the website to function and cannot be disabled. They do not store personally identifiable information.
Data protection legislation provides data subjects with a number of rights. These include:
- The right to know what type of personal data we hold about you, given details about how we use it and to be provided with a copy of the personal data held;
- The right to have an errors or omissions corrected;
- In certain circumstances, the right to request erasure of all your personal data that we hold;
- The right to request we restrict the processing of your personal data;
- The right to object to the further processing of your personal data, including the right to object to direct marketing;
- The right to withdraw consent if you had previously given us consent to process your data;
- The right to request that personal data that you have given to us be moved to a third party;
- The right to lodge a complaint.
Please note that Schedule 1 of the DPJL 2018 sets out that certain of rights referred to above may be restricted in certain circumstances, including where it is necessary to avoid obstructing official or legal inquiries, investigation or procedures or to avoid prejudicing the prevention, detection, investigation or prosecution of a criminal offence.
If you wish to exercise any of these rights, please email our DPO at dpo@jerseyoic.org. In your request, please make clear (a) what personal information is concerned, and (b) which of the above rights you would like to enforce. For your protection, we may only implement requests with respect to the personal information associated with the particular email address that you use to send us your request, and we may need to verify your identity before implementing your request. We will try to comply with your request as soon as reasonably practicable.
You can find template letters and additional guidance on our website.
When you make a request, we will consider any lawful exemptions that may apply and that may prevent us from responding to your request in the manner you may wish. It is possible that there is something that may prevent us from responding to your request in the way you would like. If that is the case, we will explain this to you in writing when we respond to your request.
We aim to meet the highest standards when processing personal data.
If at any stage you became dissatisfied with the manner in which we collect, hold or process your personal data or if you have any questions, please contact us. Any complaints should be addressed to the Information Commissioner at the address below.
If you wish to contact the Office of the Information Commissioner, the DPO or Chair of the Data Protection Authority you may contact us using one of the following methods:
The Jersey Data Protection Authority5 Castle Street
St Helier
Jersey
JE2 3BT
T. +44 (0)1534 716530
E. enquiries@jerseyoic.org