Employee image in directory does not violate the DPA (2023-05-22)

Summary

This is a published case summary from the Cayman Islands Ombudsman describing an informal resolution of a data protection complaint. It does not create new rules but illustrates how the Ombudsman applies the Data Protection Act (DPA) to a specific workplace scenario involving employee photos in an internal directory.

• Facts: A civil servant objected to being required to upload her photo to her government employer's HR platform for use in an internal employee directory, arguing this violated her data protection rights and might involve sensitive personal data.
• Finding: The Ombudsman found the image could potentially reveal sensitive personal data, but its limited, work related use posed no significant risk and was reasonably required, given the employee's limited expectation of privacy in a work context.
• Right to be informed: An FAQ sheet provided to employees in advance was found sufficient to satisfy the DPA's right to be informed requirement.
• Recommendation: The Ombudsman recommended the employer introduce criteria allowing employees to opt out of having their image included in the directory, but concluded no further enforcement action was required.

As a case outcome notice, this document is informational and precedent-illustrative rather than a source of binding, ongoing compliance obligations, though it signals the Ombudsman's expectations around opt-out options and advance notice (right to be informed) for similar HR data uses.

Applies to

data controllers, government employers, employees (data subjects)