Public Statement - Brenwal Limited (2023-11-13)

Summary

This is a public statement issued by the Jersey Office of the Information Commissioner (JOIC) under Article 14 of the Data Protection Authority (Jersey) Law 2018, following an Inquiry into Brenwal Limited, a registered data controller. It records that Brenwal contravened Articles 8(1)(a) and 12(1) of the Data Protection (Jersey) Law 2018 by covertly tracking an employee's work vehicle without a lawful basis or adequate transparency, and sets out the sanctions imposed and lessons for other organisations.

• Contravention found: Covert GPS tracking of an employee's work vehicle for a month with no lawful basis (breach of Art.8(1)(a)) and without providing required transparency information to staff (breach of Art.12(1)).
• Sanctions imposed: A formal reprimand issued 11 May 2023, together with orders under Art.25(3) of the Authority Law requiring staff education, review and updating of processes, and deletion of all personal data collected from the tracking; the Authority decided against an administrative fine given Brenwal's cooperation and mitigation.
• Orders completed: Brenwal completed the ordered remedial actions within the timeframe stipulated by the Authority.
• Lessons for other organisations: Monitoring of staff must be reasonable, proportionate, necessary and have a lawful basis; staff should generally be told about monitoring in advance (including covert monitoring possibilities) except in extreme, justified circumstances; less intrusive alternatives should be considered first; covert monitoring should be strictly limited and preceded by a risk or data protection impact assessment; any data protection lead must have sufficient expertise to advise the organisation.

As a public statement about a concluded enforcement matter, this document does not itself create new ongoing legal obligations beyond those already discharged by Brenwal, but it signals JOIC's expectations for lawful, transparent employee monitoring that other data controllers should follow to avoid similar enforcement action.

Applies to

data controllers, employers