Enforcement Order 202000507 (2020-08-07)

Summary

This is an enforcement order issued by the Cayman Islands Ombudsman against the Registrar of Companies following a data protection complaint. The complainant argued that the Registrar's online Cayman Business Portal (CBP) unlawfully required beneficial ownership submissions to include personal data of shareholders holding only 1% of a company (non registrable persons), when the Companies Law only requires details of registrable persons (generally those holding more than 25% of shares or voting rights).

• Finding: The Registrar had no valid legal basis under the Data Protection Law to routinely collect personal data of non registrable individuals (e.g. sub 25% shareholders) as part of company registration via the CBP.
• Finding: The Registrar's reliance on the 'exercise of public functions' legal basis and on section 279A of the Companies Law did not justify blanket collection of this data, and its general agreement wording did not extend beyond legally required particulars.
• Finding: The Registrar failed to meet the fairness requirement of the first data protection principle by not informing CBP users of the identity of the data controller and the purpose of processing (i.e. no privacy notice).
• Recommendation: The Registrar should develop written policies and procedures defining fair and reasonable criteria for requesting additional information under section 279A of the Companies Law, and publish these.

The order directs the Registrar to change its practices immediately and confirms the Registrar's right to seek judicial review of the order. It is primarily binding on the Registrar of Companies but is relevant to companies and corporate service providers who interact with the CBP and beneficial ownership register process.

Key obligations

• The Registrar of Companies must immediately cease gathering and further processing personal data of persons who are not registrable persons under the beneficial ownership provisions as part of its company registration process.
• The Registrar of Companies must immediately develop and implement a privacy notice for the Cayman Business Portal that identifies the data controller and the purpose(s) for which personal data is processed.
• The Registrar of Companies is recommended to develop written policies and procedures defining fair and reasonable criteria for requesting additional information under section 279A of the Companies Law and make them publicly available.

Applies to

Registrar of Companies, companies (ordinary resident companies filing beneficial ownership information), corporate service providers

Deadlines

• within 45 days of receipt: Under section 47 of the DPL, the Registrar (or recipient of the enforcement order) may seek judicial review of the order to the Grand Court within 45 days of receipt, upon notice to the Ombudsman.