Car dealership Jacksons has been fined £65,000 after sales staff changed the preferences for receiving marketing communications of over 400 customers from ‘no’ to ‘yes’.
The Office of the Data Protection Authority in Guernsey opened an inquiry in January 2023 after receiving intelligence alleging the Channel Islands car dealership had been unlawfully changing customer marketing preferences.
The investigation revealed an anomaly with a number of customer records.
Upon examination, customer records showed certain Jacksons’ sales staff had changed preferences to indicate that the customer had consented to receive all marketing communications from the car dealership when they had not.
These communications related to communications about offers and products by email, phone, post, social media or text message.
Jacksons acknowledged that these amendments were against the wishes of the customers and conducted an internal review to establish the scope of this unlawful practice.
The internal review revealed that 430 customer records had been amended unlawfully over the course of one year.
These amendments primarily related to Jacksons’ Motormall operations, and only occurred in the jurisdiction of Guernsey.
Jacksons established that a senior employee had given the directive to make these amendments, which were then carried out by certain members of the sales team.
This senior employee is no longer with the company.
The data protection authority found no evidence to suggest that Jacksons’ data protection officer or its board of directors were aware of this breach.
Paul Kell, CEO Van Mossel Jacksons Group, confirmed this.
“Van Mossel MotorMall has taken note of the conclusion of the Office of the Data Protection Authority’s investigation into a historic incident at MotorMall Guernsey, prior to its acquisition by the Van Mossel Automotive Group in 2023,” he said. “We accept the Authority’s findings and the fine imposed.
“The investigation concerned the actions of a single employee, no longer with the business, who against established processes instructed the change of customer contact preferences. The ODPA found no evidence of this occurring beyond this single incident in Guernsey. Over the course of its detailed two-year review, no further data protection issues were found at MotorMall Guernsey or elsewhere across our Group.
“Since acquiring MotorMall Guernsey, Van Mossel has implemented the Group’s comprehensive and industry-leading data protection standards, which apply consistently across our European operations. We engaged fully and transparently with the ODPA throughout its investigation, proactively reviewing processes, providing training to staff and contacting affected customers.
“As a Group, we take our customers’ data privacy very seriously; we are committed to ensuring that all customer communications are relevant, appropriate and proportionate to our clients’ motoring, servicing and warranty needs. Every communication we send includes a clear and easy-to-use unsubscribe function, so customers remain in full control of the information they receive from us.
“We regret the historic failing that occurred prior to our ownership, but we are reassured that the ODPA’s exhaustive review has found no evidence of wider issues. Our commitment to the highest standards of data protection remains absolute, and we will continue to invest in processes, training and compliance to safeguard our clients’ trust.”