Make a Complaint

If you believe that your personal data has been processed in a way contrary to data protection law, you can raise this formally with us and file a complaint.

Before filing a formal complaint, however, you may wish to consider whether this is the best solution for you at this stage.

The Jersey Office of the Information Commissioner offers a less formal Amicable Resolution process (or a to ask a question) and we also have a confidential “Tell us in confidence” service that allows people to raise concerns with us anonymously.

In deciding which course of action you want to take, you may wish to consider the following:

• If you want an answer to a specific data protection question, you can ask a question via our online form. We will aim to answer you within 14 days. In addition - and only in cases where there are serious indications of a violation of data protection rules – the Jersey Office of the Information Commissioner may also conduct its own inquiries that may eventually lead to sanctions. (This is an internal procedure with which the person requesting information is not generally involved and about which he or she does not receive information about the inquiry being undertaken.)
• If you have a data protection concern about a controller (or processor) but wish to reach an amicable solution, you can opt to take part in our Amicable Resolution process. This is an easy-to-access procedure and you will be given more information about how it works as part of the process.
• You also have the right to file a formal complaint with us, but the filing of a formal complaint should be reserved for cases in which you are a victim of a data protection contravention and which you believe cannot be resolved through Amicable Resolution or by asking us for information. This solution is the most formal of the three options available to you and is also the longest (because of the strict legal process the Jersey Office of the Information Commissioner must follow). You will find more detailed information about this procedure and your role in it in our guide to the enforcement process here.
• In summary, you must keep the following in mind when choosing to file a formal complaint:

• • If your complaint concerns the exercise of your rights as a data subject (e.g. subject access request, right to erasure, etc.), we will usually ask you first of all to exhaust any complaints process with the controller (or processor) before filing a complaint. If your complaint relates to another matter (for example, you believe that your data is processed without your consent), it may also be useful to try to contact the controller and raise the issue with them directly before filing a complaint with us.
  • Exceptionally, the Jersey Office of the Information Commissioner may deal with a complaint anonymously, but in most cases, this is not practical because all parties must know what it is they are alleged to have done/not done. It is often impossible to delete from the file all the elements identifying the complainant.
  • The Jersey Office of the Information Commissioner is not obliged to deal with every complaint it receives and can reject to carry out a formal investigation into a complaint if it is “clearly unfounded…frivolous, vexatious, unnecessarily repetitive or otherwise excessive”. This means that if you submit a formal complaint, we will review it and decide whether it is something we are formally obliged to investigate. If we decide that it is not serious enough to investigate, we will write to you and let you know why.

• If your complaint is deemed serious enough to warrant a formal investigation, we will advise the controller that you have made a formal complaint and we will ask the controller (or processor) to provide their response to those allegations. We will keep you updated about the progress of our investigation, and you will be told of our decision (including being advised of any sanctions we impose).
• We may impose various sanctions, including a fine (although we cannot fine any Government of Jersey controllers), but please be aware that we cannot grant compensation to you or order that the data controller should pay compensation to you. In other words, the proceeds of any fine do not benefit the complainant nor do we keep the proceeds; they are paid to the Government of Jersey.
• For an easy overview of what we can/cannot do, please see our infographic here. The formal investigation process can take many months from start to finish. This is because there are a number of steps we have to take in accordance with the timeframes set out in the Data Protection Authority (Jersey) Law 2018.