Determination - Enforcement Order issued to Watches of Switzerland Company Limited (2025-08-20)

Summary

This is an enforcement order and determination issued by the Guernsey Office of the Data Protection Authority (ODPA) against The Watches of Switzerland Company Limited (WoS), following an investigation into a data subject access request (DSAR) complaint. The Authority found that WoS breached section 15 (right of access) of the Data Protection (Bailiwick of Guernsey) Law, 2017, by failing to identify and disclose relevant personal data, including internal email correspondence, in response to a DSAR made on 16 October 2024.

Findings

• Breach found: WoS failed to provide the Complainant with all personal data they were entitled to under section 15(1)(b)(ii) and 15(2) of the Law, including email correspondence from 2016 and 2024 that identified the Complainant even though not referred to by name.
• Systemic weakness: The Authority found WoS's DSAR search and collation process insufficiently extensive, not accounting for indirect identifiers (e.g. hyperlinks, Customer ID numbers) or sources such as local branch staff and archived material.

Enforcement order terms

• Further search and disclosure: WoS must conduct a further search and provide the Complainant with all information they were entitled to under the original 16 October 2024 DSAR, applying any exemptions that would have applied at the time.
• Documentation of search process: WoS must document in writing the search parameters, terms, departments, systems and staff used, and retain this record (and any exemption rationale) unredacted for a minimum of six years, available to the Authority on request.
• Systems review: WoS must review and update its internal DSAR search/collation processes, including guidance on what constitutes client personal data, and retain records of any updates for six years.
• Confirmation and timelines: Terms 1 and 2 (further search and disclosure) must be completed within 28 days of issuance of the section 73 notice, with written confirmation of compliance sent to the Authority within that period; term 3 (systems review) must be completed within four months.

Key obligations

• WoS must perform a further search and disclose to the Complainant all personal data they were entitled to under the 16 October 2024 DSAR, applying any exemptions that would have applied at that time.
• WoS must document in writing the search parameters, search terms, departments, systems and staff used during the further search, and retain this documentation unredacted for a minimum of six years, providing it to the Authority on request.
• WoS must document in writing the rationale for any exemptions or exceptions applied when complying with the further disclosure, retained for a minimum of six years and provided to the Authority on request.
• WoS must review and update its internal DSAR search and collation systems and processes, including guidance on what constitutes client personal data, and retain records of any updates for a minimum of six years.
• WoS must provide written confirmation to the Authority within 28 days of the section 73 notice that it has complied with the further search and disclosure requirements.
• Any documentation produced by WoS to evidence compliance, including where legal advice was sought, must be produced in a manner free from legal privilege and disclosable to the Authority.

Applies to

data controller, retail company (Watches of Switzerland Company Limited)

Deadlines

• 28 days of the issuance of a notice under section 73 of the Law: WoS must complete the further search and disclosure (terms 1 and 2) and provide written confirmation of compliance to the Authority.
• four months of the issuance of a notice under section 73 of the Law: WoS must complete the review and update of its internal DSAR search/collation systems (term 3).
• minimum of six years following disclosure or implementation: WoS must retain documentation of search parameters, exemption rationale, and system updates, available to the Authority on request.