Public Statement - JRSY Laser Limited Fine (2025-03-18)

Summary

This is a public statement issued by the Jersey Data Protection Authority (part of JOIC) announcing an administrative fine of £500 against JRSY Laser Limited, a Jersey data controller. The fine follows an investigation into a complaint by a former employee whose personal information, including details of a workplace dispute, was shared internally by a company director without a lawful basis.

• Contraventions found: Breaches of Article 6(1)(a), Article 8(1)(a) and (b), and Article 9(1) of the Data Protection (Jersey) Law 2018, relating to unlawful and excessive sharing of an employee's personal data and a general lack of compliance understanding.
• Aggravating factors: This was the second investigation into near-identical conduct by the same director, who had previously been warned in a December 2023 public statement that similar behaviour would likely result in a fine; a further threat to disclose the employee's data to a third party was also made.
• Sanctions imposed: A £500 administrative fine and a formal reprimand were issued.
• Lessons for organisations: Data controllers must identify a lawful basis before sharing personal data, must not share more information than necessary or with those who do not need it, and must not use threats of data disclosure to pressure individuals in disputes.

This document is a retrospective enforcement notice rather than a rule imposing new ongoing requirements; it records completed regulatory action and reiterates existing obligations under the DPJL 2018 that all data controllers must already follow, warning that repeat non-compliance will lead to more severe sanctions.

Applies to

data controllers