A joint investigation has been launched by the data protection authorities of the Isle of Man, the United Kingdom, Jersey and Guernsey into a major cyber incident at the trade union Prospect.
The breach, which occurred in June 2025, compromised the sensitive personal data of the union’s 160,000 members, including approximately 2,200 Isle of Man residents.
Exposed information includes financial details, trade union membership, and special category data such as ethnic origin, sexual orientation, and religious beliefs.
This marks the first-ever collaboration of its kind between the four jurisdictions.
Regulators
The regulators will examine the scope of the breach, the adequacy of Prospect’s security measures and its response and notification procedures.
Isle of Man Information Commissioner, Dr Alexandra Delaney-Bhattacharya, stated: “People place enormous trust in organisations when they hand over their personal information, and that trust must be honoured.
“By undertaking this coordinated investigation into the incident at Prospect, we are strengthening our collective ability to safeguard individuals’ data.”
UK Information Commissioner John Edwards added: “When people share their most sensitive information with an organisation, they do so with the expectation that it will be handled responsibly and securely.
“We will be scrutinising the cyber incident at Prospect to check whether those expectations were met.”
The opening of the investigation does not imply Prospect has broken data protection law. Each regulator will investigate compliance within its own jurisdiction, pooling resources for a coordinated response.