The Jersey Data Protection Authority has issued a Public Statement in respect of an Investigation against JRSY Laser Limited.
JOIC received a complaint that an individual’s special category data (sensitive health information) had been shared unlawfully with a third party.
JRSY Laser threatened to tell (and did tell) the individual’s employer about certain treatments undergone by the individual.
The Authority issued JRSY Laser Limited with a formal Reprimand and a number of Orders. It has included within the Public Statement, a section regarding Lessons Learned, which it hopes will be of benefit to the business community as a whole.
The key focus of this case is that the Jersey Data Protection Authority wishes to make its position clear that any vindictive behaviour on the part of a controller towards a data subject (including the issuing of threats to release personal information should certain actions not be complied with) will be viewed with utmost seriousness and is viewed by the Authority as a significant aggravating factor.
You can read the Public Statement here on our website.
