The Data Protection Authority (the “Authority”) and AFR Advocates (“AFR”) have come to a consensual resolution of a matter set to be heard by the Court of Appeal in July 2026. The settlement addresses the Authority’s cost considerations and includes a firm commitment by AFR to enhance their own internal safeguards.
The appeal which has now been withdrawn related to a judgment handed down on 23 December 2025 in which the Royal Court dismissed an appeal brought by AFR against a breach determination by the Authority. The upheld determination related to an incident which occurred in 2022, in which AFR hand-delivered a bundle of documents to the home address of an individual. The Authority found that AFR’s actions had put their private and sensitive personal health data at risk.
“We are pleased to reach a consensual resolution with AFR and are encouraged by their commitment to elevate safeguards for sensitive documents”, said Commissioner Homan.
“We appreciate the example set and invite other organisations responsible for the care of sensitive information to reflect on their document handling procedures to ensure their proper protection”.
Supplemented by mandatory training, AFR will be implementing a policy governing the handling and delivery of physical records containing personal data, including medical information. This policy will require reasonable steps to be taken to ensure a level of security appropriate to the personal data, including requiring secure delivery arrangements.