Anonymised respondent (a company)
No breach of the dpa is thus found committed. DPO, 24 February 2020.
Summary
Three complainants alleged that the respondent organisation published an internal investigation report about workplace bullying, harassment, and non-disclosure agreement violations to a public mailing list without staff consent, in breach of sections 23 and 24 of the Data Protection Act 2017. The respondent argued that publication was covered by legal obligations under the Employment Rights Act 2008 and by legitimate interests under section 28 of the Data Protection Act 2017. The DPO found that the published report did not name individuals, that no adverse action had been taken against the complainants, and that anonymisation sufficiently protected data subjects. After the lead complainant withdrew the complaint, the DPO found no breach of the Data Protection Act.
Cite this decision
Same respondent
- December 2015 · formal notice (mise en demeure)
- 18 August 2022 · enquiry has not disclosed the commission of an offence under the DPA and is closed to the satisfaction of all parties under section 6 of the Data Protection Act 2017 (DPA)
- 26 December 2024 · enquiry was closed to the satisfaction of all parties under section 42 of the Data Protection Act
- 5 April 2023 · enquiry is closed to the satisfaction of all parties under section 6 of the Data Protection Act (DPA)
- 6 April 2023 · enquiry is closed to the satisfaction of all parties under section 6 of the Data Protection Act 2017 (DPA)
- 21 June 2022 · enquiry is closed to the satisfaction of all parties under section 6 of the Data Protection Act 2017 (DPA)
- 25 February 2020 · no breach of the DPA has been established and the enquiry is thus closed
Track Mauritius enforcement
Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.