Gibraltar’s Information Commissioner has statutory functions in law, for which he must carry out certain tasks under the Data Protection Act 2004 (the “DPA”), the Gibraltar General Data Protection Regulation 2016/679 (“GDPR”) and/or other relevant data protection legislation.
Amongst said tasks, the Information Commissioner is required, to the extent considered appropriate, to investigate complaints lodged or otherwise conduct investigations on the application of the GDPR and DPA, and to provide an outcome to the complainant. In practice, this means that there can be several outcomes following a complaint. The Information Commissioner may for example:
- Decide that the organisation has done nothing wrong and there hasn't been an infringement of the law.
- Log the complaint and use it for future intelligence but do nothing further with it.
- Ask the organisation to take further steps to help resolve the complaint or explain their position more clearly to the complainant.
- Make recommendations to the organisation about how they can improve their information rights practices.
- Take regulatory action, but this is only in the most serious cases. Even if regulatory action is not taken, the Information Commissioner will keep a record of the complaint (in line with relevant retention periods) to help build up a picture of how well an organisation is complying with relevant data protection law.
Importantly, the Information Commissioner is unable to award compensation to individuals for data protection infringements. Data subjects have a right to claim compensation from an organisation if they have suffered damage as a result of a data protection law infringement. This includes both material damage, for example where there has been financial loss, or non-material damage, for example in cases of distress. The organisation may simply agree to pay the compensation in certain circumstances. However, if they do not agree to pay, the data subject needs to turn to the courts if they wish to pursue a claim for compensation. The Information Commissioner strongly recommends individuals to take independent legal advice on the strength of a case before taking any claim to court.
Please use the form below if you wish to submit a complaint to the Gibraltar Regulatory Authority, as the Information Commissioner.