Determination - Jacksons fined £65,000 for unlawfully changing customer marketing preferences (2025-09-25)

Summary

This is a published breach determination and sanction by the Guernsey Office of the Data Protection Authority (ODPA) against Jacksons (CI) Limited (trading as Jacksons Guernsey and Motormall Guernsey), following an inquiry under section 69 of the Data Protection (Bailiwick of Guernsey) Law, 2017. The Authority found that staff deliberately altered customer marketing contact preference records over roughly one year, changing hundreds of customers' records to show consent to marketing when no such consent had been given.

• Breach findings: The Authority found breaches of section 6(2)(a) (Lawfulness, Fairness and Transparency), section 7 (Lawfulness of processing), section 8 (Fairness), section 10 (Consent) and section 6(2)(d) (Accuracy) of the Law.
• Scope of misconduct: An investigation found 286 to approximately 430 customer records were wilfully altered by staff (far exceeding the 69 records Jacksons initially reported), with affected customers estimated to have received around 25 unwanted marketing communications each over about a year.
• Administrative fine: A fine of £65,000 was imposed, payable within one calendar month of Jacksons receiving written notice of the decision.
• Enforcement Order: Jacksons must conduct a thorough review of customer records to identify inappropriate amendments to marketing preferences, correct any inaccurate preferences, and provide written assurance to the Authority (including the number of records found to have been inappropriately amended) by 23 December 2025.
• Appeal rights: Jacksons (or any sanctioned person) may appeal the breach determination or enforcement order to the Court within 28 days of receiving written notice, on specified grounds including error of law, unreasonableness, bad faith, lack of proportionality, or material factual/procedural error.

While this determination is specific to Jacksons (CI) Limited, it illustrates the ODPA's approach to sanctioning controllers for deliberate manipulation of marketing consent records and serves as a precedent for how similar breaches of lawfulness, fairness, transparency and accuracy principles will be treated.

Key obligations

• Jacksons (CI) Limited must pay the £65,000 administrative fine within one calendar month of receiving written notice of the determination.
• Jacksons (CI) Limited must conduct a thorough review to identify customer records with inappropriate amendments to marketing contact preferences and correct any preferences that do not accurately reflect customer wishes.
• Jacksons (CI) Limited must provide the Authority with written assurance, including the number of records found to have been inappropriately amended, confirming preferences now accurately reflect customer wishes, by 23 December 2025.
• Any appeal against the breach determination or enforcement order must be made within 28 days of receiving written notice of the decision.

Applies to

data controllers, businesses conducting direct marketing

Deadlines

• within one calendar month of receiving written notice: Deadline for Jacksons (CI) Limited to pay the £65,000 administrative fine.
• 23 December 2025: Deadline for Jacksons (CI) Limited to complete the customer record review and provide written assurance to the Authority under the Enforcement Order.
• 28 days from receipt of written notice: Period within which an appeal against the breach determination or enforcement order must be made to the Court.