The Data Protection Authority became aware of the issue in January 2023 and its investigation quickly found anomalies in a number of customer records.
It emerged that Jacksons’ sales staff had been amending customer preferences about receiving direct marketing, changing them from ‘no’ to ‘yes’.
Jacksons acknowledged this was against the wishes of the customers.
An internal review initially went through more than 3,500 records from both Jacksons Guernsey and Motor Mall Guernsey from 2022.
The final investigation revealed that 430 customer records had been amended unlawfully between July 2022 and July 2023.
In these cases each record had been changed to indicate that the customer had consented to receive all marketing communications for future offers and products by email, phone, post, social media or SMS.
‘Respecting customer consent is a fundamental data protection obligation, which underscores the serious nature of this practice and sanction,’ said commissioner Brent Homan.
The amendments primarily related to Jacksons’ Motor Mall operations.
During the initial investigation, it was noted that an unusually high number of people had requested marketing by post, so that became the focus. Jacksons was asked to provide three records requesting postal marketing at random, and all three were found to have been altered.
Five more customer records were checked and were also found to have been amended.
Jacksons’ investigation initially found that 69 records had been altered in 2023 by two staff members.
The authority asked for 321 customer records to be produced, of which 286 records had been wilfully altered.
This indicated a bigger problem, and in July this year Jacksons admitted that about 430 records were altered over one year.
Individuals may have received about 25 marketing communications each.
Jacksons established that a senior employee had given the directive to make the amendments, which were then carried out by certain sales staff.
When Jacksons spoke to staff involved in this, they said in the UK there was no comeback for this type of activity.
The senior employee is no longer with the company and the authority found no evidence to suggest that there was awareness of the practice by the Jacksons’ data protection officer or its board of directors.
Jacksons accepted that the practice had taken place over a year and the authority determined that this contravention of the law was at the more serious end of the scale due to the intentional nature of the reversal of customers’ consent choices.
Jacksons was issued with a £65,000 administrative fine and an enforcement order.
‘Notwithstanding the serious nature of this matter, I am encouraged by the commitment of the new ownership and leadership of Jacksons to ensuring that such practices do not recur, and to providing an elevated and exemplary level of protection to its customers and their data rights,’ said Mr Homan.
‘To that end, Jacksons has already taken progressive steps and we look forward to meeting with them in the future to hear of their further progress.’
You need to be logged in to comment. If you had an account on our previous site, you can migrate your old account and comment profile to this site by visiting this page and entering the email address for your old account. We'll then send you an email with a link to follow to complete the process.