Tell us in confidence

Do you think that an organisation is not registered with us who should be? Are you concerned that an organisation is not taking their data protection or freedom of information obligations seriously? If you need to make a report in confidence, you can send us a message. The information we receive from whistleblowers helps us to act. As a regulator, we can only act on concerns if you tell us about them.

You should provide us with enough information so that we can understand what your concerns are and decide whether we need to make further investigations. You must help us by giving us as much information as is relevant to the concern you are raising.

As a minimum, we will need to know the following:

• The organisation's name and as much of the address as possible.
• A brief description of your concern including links to any websites or other information that might be relevant. Tell us:
• What has happened and when.
• Number of people affected.
• Whether you're aware of anyone raising this issue with the organisation and, if so, what the organisation's response to this was.

If you have documents or evidence that support your concern, you may provide them, provided you are legally entitled to share them and doing so does not put you at risk.

We won't ask for your name or contact details (please don't give those to us) and so whilst we won't be able to keep you updated as to any steps we may take to investigate, please rest assured that we will read and thoroughly consider all reports made to us and take any enforcement action, as appropriate.

Acting in Good Faith

When reporting concerns you must do so honestly and in good faith. This is because Art.73 of the Data Protection (Jersey) Law 2018 says that it is an offence to knowingly/recklessly provide the Authority with false or misleading information. If you provide us with false information we may report matters to the police.

What concerns are not suitable for 'Tell us in confidence'

Complaints about the handling of your own personal data by an organisation won't usually be suitable for a Tell us in confidence submission, unless it suggests that there are broader issues that we need to know about.

If you wish to raise a concern about how your personal data is being handled, you can raise a concern with us here. We offer an Amicable Resolution service that is less formal or you can raise a formal complaint. Whichever route you choose, your concern will be dealt with under our routine case handling process and you will receive an individual outcome.

There are some matters that we can't look into because they are not data protection or freedom of information related (e.g. employment, court matters or personal grievances) and we cannot give you legal advice.

How we handle TUIC submissions

We review all submissions made to us and decide whether we need to investigate further. All submissions will be handled with sensitivity and are handled in the strictest confidence. Information will be shared only with those who need it in order to review and if possible, investigate the concern you have raised and we take appropriate steps to protect the identities of those who have made submissions to us. We will always seek to protect your identity. However, in rare cases, we may be legally required to disclose information (e.g., by court order or statutory obligation). Where this occurs, we will disclose only the minimum information necessary.

Please note that if we do not have enough information or evidence, we may not be able to act upon the concerns you have raised.

Similarly, where we believe there is a risk of your identity being revealed (for example due to a very specific set of circumstances) we may choose not to act upon the submission in order to protect your identity. If we believe that the submission is legitimate and its within our remit (and whether it contains limited intelligence or detailed intelligence) we will record the submission in an anonymised report. This report will be kept on our systems, in line with our retention policy.

What happens if someone makes an anonymous submission about you?

If someone has made a submission about you (i.e. you are the focus of the tell us in confidence submission), we expect you to engage with our office and any questions we have. You must not take any form of retaliation against individuals who you believe made the submission to us.

Retaliation includes threats, harassment, or any form of adverse treatment. We take a dim view of anyone engaging in such behaviour and Art.74 of the Data Protection (Jersey) Law 2018 says that it is a criminal offence to obstruct, interfere with, impede, fail to give assistance/information or produce a record or generally cooperate with any steps we take to look into the submission made to us.

You can find out more about what we do and our enforcement powers here.

What can the outcome be?

There are a number of possible outcomes to your submission:

• We will work with an organisation to improve their data protection practices, such as ensuring their privacy notices are updated, polices/procedures improved.
• In some cases, we will consider whether we need to carry out a formal inquiry into the concerns raised. This may involve our making formal findings that the organisation has contravened the law and where necessary, take appropriate enforcement action such as issuing reprimands, making orders, issuing administrative fines or making a public statement..
• Review the submissions made to us for intelligence purposes.

TUIC submissions are for intelligence and regulatory consideration only. We will not provide personal remedies, compensation, or updates on the actions taken.