Corporate compliance issues in Jersey can need prompt legal attention. Businesses facing Jersey Office of the Information Commissioner (JOIC) enforcement notices should take advice early. solicitors.je is an independent directory. We can point you towards Jersey firms that work in this area.

JOIC Enforcement and Royal Court Appeals

The Jersey Data Protection Authority, working through the Jersey Office of the Information Commissioner (JOIC), enforces the Data Protection (Jersey) Law 2018. Appeals against its decisions go to the Royal Court under Article 32 of the Data Protection Authority (Jersey) Law 2018 (https://www.jerseylaw.je/laws/current/l_4_2018).

solicitors.je is an independent directory. We can point you towards Jersey firms that work in this area.

Got a question about a data protection appeal?

Where a JOIC decision is challenged

A decision of Jersey's data protection regulator is challenged in the Royal Court of Jersey. Under Article 32 of the Data Protection Authority (Jersey) Law 2018, a controller or processor can appeal to the Royal Court against a breach determination, an order, an administrative fine or an information notice. The JOIC's own complaints guidance confirms that, once its final determination is issued, the Royal Court is the only route: the regulator will not reopen the decision internally.

The regulator is the Jersey Data Protection Authority. Its day-to-day work is carried out by the Information Commissioner and staff, operating as the Jersey Office of the Information Commissioner (JOIC). The duties it enforces are in the Data Protection (Jersey) Law 2018, and its powers and the appeal routes are in the Authority Law.

From complaint to final determination

Most enforcement starts with a complaint, although the Authority can also open an inquiry on its own initiative. The Authority Law sets the stages:

Complaint. An individual may complain in writing if they think a controller or processor has breached the Data Protection Law in a way that affects their personal data (Article 19).
Decision to investigate. Within 8 weeks the Authority must decide whether to investigate. It must investigate unless the complaint is clearly unfounded, frivolous, vexatious, unnecessarily repetitive or otherwise excessive, or other action makes an investigation inappropriate (Article 20).
Proposed determination. Before making a breach determination, an order or a fine without the organisation's agreement, the Authority must send written notice of what it proposes and why. The organisation then has 28 days from the date of the notice, or any longer period the notice allows, to make written or oral representations (Article 28). A notice proposing a fine must state the amount.
Final determination. The Authority must consider those representations before it decides.

The 28-day representations window is often the best chance to correct the facts. The Authority can shorten it, or dispense with it altogether, in limited circumstances set out in Article 28.

What the Authority can impose

After a breach determination, Article 25 allows a reprimand, a warning, or an order requiring specific action. Orders can require processing to be brought into compliance, a breach to be notified to data subjects, a data subject request to be met, data to be rectified or erased, or processing or overseas transfers to be restricted or suspended. Failing to comply with an order is a criminal offence.

Administrative fines sit in Articles 26 and 27. The statutory maximums depend on the type of breach, and a lower ceiling of £10,000 applies where the processing was in the public interest and not for profit. Read the limits on the Authority Law itself before relying on any figure.

Two practical points are set out in the JOIC's guidance. It cannot order an organisation to pay compensation to a complainant. An unpaid fine can be recovered as a civil debt through the Petty Debts Court or the Royal Court.

The appeal: 28 days and a high test

Under Article 32, an appeal must be made within 28 days immediately following the date the organisation receives written notice of the determination, order or notice. It is brought by summons served on the Authority, stating the grounds and the material facts relied on.

The ground is that, in all the circumstances, the decision was not reasonable. The JOIC describes this as a high bar: a decision that is illogical or irrational, not one the appellant simply dislikes. The Royal Court can suspend or modify the decision while the appeal runs, and at the end it can confirm the decision, with or without changes, or annul it and send it back to the Authority.

Complainants have a parallel route under Article 31, for example where the Authority decides not to investigate. The same reasonableness test and a 28-day limit apply.

Claims that bypass the regulator

Individuals do not have to go through the JOIC to seek a remedy. Article 68 of the Data Protection Law allows a data subject to bring proceedings against a controller in the Royal Court, which can award compensation, grant an injunction or make a declaration. Article 69 gives anyone who suffers loss, damage or distress from a breach a right to compensation.

What to have ready

The proposed determination, any representations made, and the final determination.
The date each notice was received, since the 28 days run from receipt.
Records of the processing in question, and any breach notifications made.
All correspondence with the complainant and with the JOIC.

solicitors.je is an independent directory. We can point you towards Jersey firms that work in this area.

Data Protection Appeals (JOIC): Questions

Can my business appeal an enforcement or penalty notice issued by the JOIC?

Under Article 32 of the Data Protection Authority (Jersey) Law 2018, a controller or processor can appeal to the Royal Court within 28 days of receiving written notice of a breach determination, order, administrative fine or information notice (https://www.jerseylaw.je/laws/current/l_4_2018). This includes appeals against administrative fines.

What happens if we miss the statutory deadline to challenge a JOIC decision?

If no appeal is brought within 28 days, the right of appeal is lost; the JOIC says an unpaid fine can be recovered as a civil debt through the Petty Debts Court or the Royal Court (https://jerseyoic.org/guidance/data-protection/investigating-complaints).

Can our internal compliance team handle a JOIC Tribunal appeal without an Advocate?

An appeal is brought in the Royal Court by summons served on the Authority, stating the grounds and material facts relied on (Article 32(5), Data Protection Authority (Jersey) Law 2018, https://www.jerseylaw.je/laws/current/l_4_2018). A Jersey advocate can advise on the Royal Court procedure for these appeals.

Tell us what you need and we’ll point you towards Jersey firms that work in this area.