Enforcement Order 202000820 (2021-03-18)

Summary

This is an executive summary of an enforcement order issued by the Cayman Islands Office of the Ombudsman against St. Ignatius Catholic School (owned and operated by St. Ignatius Catholic Church) following a data protection complaint from a staff member. The Ombudsman investigated several alleged failures under the Data Protection Law, 2017 (DPL) and made specific findings, a mandatory destruction order, and several recommendations.

• HR file removal: Temporary removal of the complainant's personnel file from the HR office was found not to breach data protection responsibilities, though staff should be given a privacy notice.
• Unlawful recording: Recording a meeting with the complainant breached the first data protection principle because the school lacked a valid legal basis; the consent relied upon was not unambiguous, freely given, or sufficiently informed, and the employer/employee power imbalance was not considered.
• Mandatory destruction: The school is ordered to destroy all copies of the recording, including transcripts, extracts, and copies held by third parties such as legal advisers, within 10 days of receipt of the order.
• Privacy notice: The school is required to provide staff with a privacy notice explaining what personal data is collected and how it is used, unless an exemption applies.
• Subject access request delay: The school missed the statutory deadline for responding to a section 8 DPL request for a copy of the recording, breaching its obligations, though it later provided the recording.
• Verbal request for minutes: No compliance failure was found regarding the unanswered request for meeting minutes because it was not made in writing as required by section 8(4) DPL, but the school is encouraged to accommodate or clarify written-request requirements.
• Recommended procedures: The Ombudsman recommends the school develop procedures for recognizing valid consent, documenting consent, managing withdrawal of consent, and managing data subject rights requests generally.

The order notes that any recipient may seek judicial review of the enforcement order in the Grand Court within 45 days of receipt, under section 47 of the DPL.

Key obligations

• Destroy all copies of the recording of the meeting, including transcripts, extracts, and copies held by third parties such as legal advisers, within 10 days of receipt of the enforcement order.
• Provide staff with a privacy notice explaining what personal data is collected about them and how it is used, unless an applicable exemption applies.
• Develop procedures for recognizing when consent is an appropriate legal basis for processing personal data, including documenting consent and managing withdrawal of consent (recommended).
• Develop procedures for managing data subjects' rights requests to ensure compliance with DPL obligations (recommended).
• Communicate to the complainant without delay if a formal written request is required for the performance evaluation meeting minutes, or otherwise recognize and fulfil the verbal request (recommended).

Applies to

data controllers, employers, schools

Deadlines

• within 10 days of receipt of this enforcement order: Deadline for the school to destroy all copies, transcripts, and extracts of the unlawfully obtained recording.
• within 45 days of receipt: Period within which a person who received the enforcement order may seek judicial review of the order to the Grand Court under section 47 of the DPL.