How We Deal with Complaints

Summary

This is Jersey OIC (JOIC) guidance explaining, in plain English, how the Authority handles complaints made by individuals under the Data Protection (Jersey) Law 2018 (DPJL 2018) about Controllers or Processors. It walks through the process from initial complaint, through the 8 week decision period, formal investigation, Proposed and Final Determinations, sanctions, and appeal rights to the Royal Court of Jersey. It is aimed primarily at individuals but is also useful for organisations that may become subject to a complaint.

• Initial handling: Complaints are usually made in writing via JOIC's online form; JOIC generally expects the complainant to have first tried to resolve the issue directly with the Controller/Processor and to provide evidence of this.
• Early timeline: JOIC acknowledges the complainant within 7 days and writes to the Controller/Processor within 14 days; under Art.20 it must decide within 8 weeks whether to open a formal investigation.
• Grounds to reject: JOIC can decline to investigate if a complaint is clearly unfounded, frivolous, vexatious, unnecessarily repetitive, or otherwise excessive, or if other action has already been taken; a Rejection of Complaint letter must explain the reasons and appeal rights.
• Investigation process: If investigated, JOIC issues a Notice of Investigation, may request information and documents from the Controller/Processor, and must give both parties a formal update at least every 12 weeks if the case is ongoing.
• Determination process: JOIC issues a Proposed Determination to the Controller/Processor, who has 28 days to submit Representations before a Final Determination (copied to both parties) is issued under Art.28.
• Sanctions available: Possible outcomes include words of advice, a formal Reprimand, Orders requiring remedial action, or an Administrative Fine; JOIC cannot order compensation or an apology.
• Appeals: Both complainants and Controllers/Processors can appeal a Rejection of Complaint or Final Determination to the Royal Court of Jersey within 28 days, on the ground that JOIC's decision was unreasonable.
• Non-compliance consequences: Failure to pay an Administrative Fine can lead to civil debt recovery through the Petty Debts or Royal Court, including wage arrest or distraint of goods.

The guidance also notes alternative routes such as the Amicable Resolution (AmRes) process and the confidential 'Tell us in Confidence' reporting option, and clarifies that JOIC does not publish Final Determinations except by way of a public statement in cases of particular gravity.

Key obligations

• Controllers/Processors must respond to JOIC's information requests and deadlines during a complaint or investigation, or risk a formal Information Notice.
• Controllers/Processors have 28 days from receipt of a Proposed Determination to submit written or oral Representations if they wish to contest findings or proposed Orders.
• Any appeal by a complainant or Controller/Processor against a Rejection of Complaint or Final Determination must be lodged with the Royal Court of Jersey within 28 days of receipt.
• Controllers/Processors subject to Orders must comply within the given timeframe and provide evidence of compliance to JOIC's satisfaction.
• Controllers/Processors issued an Administrative Fine must pay it by the date specified in the Final Determination or face civil debt recovery proceedings.
• Complainants are generally expected to attempt resolution directly with the Controller/Processor and provide evidence of this before JOIC will consider a formal complaint.
• Complainants withdrawing a complaint must notify JOIC in writing as soon as possible.

Applies to

Controllers, Processors, individuals (complainants)

Deadlines

• 8 weeks: Time within which JOIC must decide whether to carry out a formal investigation after a complaint is received (Art.20).
• 7 days: JOIC's timeframe for acknowledging receipt of a complaint to the complainant.
• 14 days: JOIC's timeframe for writing to the Controller/Processor to notify them of a complaint.
• every 12 weeks: Minimum frequency of formal updates JOIC must provide to both parties during an ongoing investigation.
• 28 days: Period for a Controller/Processor to submit Representations after receiving a Proposed Determination.
• 28 days: Period within which either party must bring an appeal to the Royal Court of Jersey after receiving a Rejection of Complaint letter or Final Determination.