Data Protection Act (2021 Revision) – Section 40 Guidelines

Summary

These guidelines from the Cayman Islands Ombudsman explain how and when public authorities must consult the Ombudsman under section 40 of the Data Protection Act (2021 Revision) before adopting administrative measures or rules that affect the processing of personal data. They clarify the scope of the consultation duty, the submission process, and expected response times.

• In scope: Proposals for new or amended legislation (acts and regulations) affecting personal data processing, and codes of conduct or practice governing data processing where the processing is complex or risks individuals' rights and freedoms.
• Out of scope: Internal policies and procedures, privacy notices, terms and conditions, and contracts.
• When consultation is especially encouraged: Where processing involves novel or complex technology (e.g. facial recognition, automated number plate recognition) or has a significant impact on data subjects' rights.
• How to consult: Complete the section 40 consultation form and email it to the Office of the Ombudsman (info@ombudsman.ky) with a draft of the measures or rules and supporting documents such as a project proposal or business case.
• Response time: The DPA sets no fixed deadline, but the Ombudsman generally aims to deliver its opinion within two months of receiving the consultation form and supporting documentation; this period may be suspended if further information is requested.
• Pending consultation: Consultation should occur before the measures or rules come into force; any related public consultation can proceed in parallel, but measures still under Ombudsman review should be clearly marked as being in consultation.

Key obligations

• Public authorities drawing up administrative measures or rules affecting the processing of personal data must consult the Ombudsman on their content before the measures come into force.
• Public authorities must submit the section 40 consultation form together with a draft of the measures or rules and supporting documents (e.g. project proposal or business case) by email to info@ombudsman.ky.
• Administrative measures or rules that are still under Ombudsman consultation should be marked as such to avoid confusion.

Applies to

public authorities

Deadlines

• within two months following receipt of the consultation form and supporting documentation: General timeframe within which the Ombudsman aims to deliver its opinion on a section 40 consultation (may be suspended pending further information).