Enforcement Order 202100204 (2021-09-22)

Summary

This is an Enforcement Order issued by the Cayman Islands Ombudsman under the Data Protection Act (2021 Revision) following a subject access request complaint against Foster's Supermarket by an unsuccessful job applicant. The Ombudsman found that most redactions made by Foster's to the disclosed personal data were not justified and ordered disclosure of specific pages, while also making recommendations about recruitment privacy practices.

• Redactions overturned: The Ombudsman found none of the redactions supportable except some names of Foster's junior HR employees on page 2; identities of third-party reference providers and a company name on other pages had to be disclosed.
• Disclosure order: Foster's was required to disclose the full, unredacted information on pages 17, 19, 20, 22 and 34 to the complainant within 15 days.
• Fairness principle recommendation: The Ombudsman recommended Foster's draft a more comprehensive privacy notice for its recruitment process, explaining how applicant data is used, including reference checks.
• Data security recommendation: The Ombudsman recommended (but did not require) that Foster's change its practice of sending reference requests to generic role email accounts, instead seeking named individual contacts.
• Judicial review right: Under section 47 of the Data Protection Act, a recipient of an enforcement order may seek judicial review of the Order in the Grand Court within 45 days of receipt, upon notice to the Ombudsman.

This case-specific decision applies directly to Foster's Supermarket but illustrates the Ombudsman's approach to balancing third-party privacy against a data subject's right of access, and to fairness and security obligations under the DPA that are relevant to any data controller handling employment references.

Key obligations

• Foster's must disclose the full, unredacted information on pages 17, 19, 20, 22 and 34 to the complainant within 15 days of the Order.
• Foster's should draft a more comprehensive privacy notice covering its recruitment process (recommended, to ensure future compliance with the first data protection principle).
• Foster's should consider changing its reference-request practice to use named individual contacts rather than generic role accounts (recommendation, not a binding requirement).

Applies to

data controllers, employers processing job applicant personal data

Deadlines

• within 15 days: Foster's must disclose the full, unredacted information on pages 17, 19, 20, 22 and 34 to the complainant.
• within 45 days of receipt: A person who receives the enforcement order may seek judicial review of the Order to the Grand Court, upon notice to the Ombudsman.