Confirmation of job applications by Cabinet Office (2021-06-23)

Summary

This is a published case summary from the Cayman Islands Ombudsman describing an informal resolution of a data breach complaint against the Cabinet Office. It documents how the breach occurred, the remedial steps taken, and why the Ombudsman closed the case without further action. It does not itself impose new rules but illustrates the Ombudsman's expectations for handling personal data breaches.

• What happened: The Cabinet Office emailed job applicants to confirm receipt of applications and intended to BCC all recipients, but addresses were mistakenly placed in the visible CC field, disclosing all applicants' names and email addresses to each other.
• Response: The breach was noticed within four minutes, a recall notice was issued (success unknown), and a follow up email asked recipients to disregard and delete the original message.
• Remediation: The Cabinet Office conducted staff training on preventing similar breaches and on proper breach response procedures.
• Outcome: The Ombudsman found the breach unlikely to cause serious prejudice to data subjects' rights and considered mitigation steps adequate, closing the case with no further action.

Applies to

public authorities, data controllers