Abuse of Utility Customer Profile (2020-09-02)

Summary

This is a published case summary from the Cayman Islands Ombudsman's data protection informal resolution decisions, describing a complaint about misuse of a customer profile by a utility company employee. It is an illustrative outcome notice rather than a binding rule, but it signals the Ombudsman's expectations around staff access controls and data protection compliance.

• Complaint: A customer alleged a senior staff member at a utility company misused her customer profile to harass, stalk, intimidate and manipulate her.
• Outcome: Because the alleged conduct occurred before the Data Protection Law (DPL) came into force, the Ombudsman could not take formal action.
• Company response: The utility company introduced an audit module in its account management system to monitor staff access to customer account details.
• Ombudsman advice: The Ombudsman advised the company to regularly remind staff with system access that misuse of personal data could be an offence under the DPL.
• Case status: Closed with no further action required.

The document is informational and does not itself create new binding obligations; it illustrates how the Ombudsman handles historic data misuse complaints and encourages proactive monitoring and staff awareness of DPL obligations.

Applies to

utility companies