Enforcement Order 202300267 (2023-07-25)

Summary

This is an individual enforcement order issued by the Cayman Islands Ombudsman under the Data Protection Act (2021 Revision) against the Department of Education Services (DES), a government data controller. It resolves a specific complaint and does not create general rules, but it illustrates how the Ombudsman applies subject access request obligations.

• Background: A job applicant repeatedly asked DES for feedback on why she was not interviewed for a teaching role; DES never substantively responded despite multiple follow ups over nearly a year.
• Finding: The Ombudsman found DES contravened the sixth data protection principle and section 8 of the DPA by failing to respond to what was, in substance, a subject access request for personal data (including opinions and indications of intent about the applicant).
• Order: DES was ordered to provide the complainant with the requested personal data regarding her job application within 5 business days of the order.
• Review rights: Under section 47 of the DPA, a data controller receiving an enforcement order may seek judicial review in the Grand Court within 45 days of receipt, upon notice to the Ombudsman.

The order is specific to DES and this complainant, but it confirms the Ombudsman's approach that informal requests for feedback can constitute personal data access requests under section 8, triggering the 30 day statutory response deadline, and that failure to respond without invoking a Part 4 exemption breaches the DPA.

Key obligations

• The Department of Education Services must provide the complainant with the requested personal data regarding her job application within 5 business days from the date of the Order.
• A data controller subject to an enforcement order under the DPA may seek judicial review of the order in the Grand Court within 45 days of receipt, upon notice to the Ombudsman.
• Data controllers generally must respond to a valid section 8 subject access request within thirty days, as required by section 8(6) of the DPA.

Applies to

data controllers, government departments (as data controllers)

Deadlines

• 5 business days from the date of this Order: DES must provide the complainant with the requested personal data regarding her job application.
• 45 days of receipt: Deadline for a data controller to seek judicial review of the enforcement order in the Grand Court, upon notice to the Ombudsman.
• thirty days: General statutory deadline under section 8(6) DPA for a data controller to respond to a subject access request (cited as the legal standard applied in this case).