A Bank Uses Social Media to Find Out How to Contact an Individual (2020-11-02)

Summary

This is a published case summary from the Cayman Islands Ombudsman describing an informal resolution of a data protection complaint. It is informational only and does not create new rules or ongoing obligations; it illustrates how the Ombudsman applied the Data Protection Law (DPL) to a specific complaint about a bank employee's use of social media to locate a person's contacts.

• Complaint: An individual complained that a bank employee contacted her indirectly via third parties who were identified as her social media contacts (friends list).
• Finding: The information used was publicly available on the complainant's social media profile, and there was no evidence the bank employee disclosed her personal data to any third party.
• Outcome: The Ombudsman found no violation of the Data Protection Law and closed the case, noting the complainant could pursue a separate complaint against the bank with the Cayman Islands Monetary Authority (CIMA) if she wished.

The case serves as guidance on how the Ombudsman assesses whether use of publicly available social media information by a data controller's staff breaches the DPL, rather than imposing any new compliance requirement.

Applies to

banks, data controllers