Enforcement Order 202300268 (2023-11-09)

Summary

This is an Enforcement Order issued by the Cayman Islands Ombudsman against the Public Lands Commission (PLC) following a complaint that the PLC was collecting excessive personal data from marriage officers, their staff, and wedding clients using public beaches. The Ombudsman found the PLC had a valid legal basis for processing personal data under its public function, but breached the Data Protection Act's first principle (fair processing, including provision of a privacy notice) and third principle (data minimization).

• Privacy notice failure: The PLC did not inform data subjects of the data controller's identity or the purpose of processing when collecting their personal data, contravening the first data protection principle.
• Excessive data collection: The PLC required copies of driver's licences and passports from wedding organizers, staff, and couples repeatedly (sometimes more than once a week), which was found unnecessary and excessive, contravening the third data protection principle.
• Permissible processing: The PLC may continue to collect only the minimum personal data strictly necessary for legitimate purposes such as avoiding scheduling conflicts and accountability for damage to public land, e.g. names and contact details.
• Non-cooperation: The Ombudsman noted the PLC's lack of cooperation during the investigation required issuance of a formal Information Order under section 44.

The Ombudsman ordered the PLC to remedy both contraventions within 30 days of the order and reminded that the PLC (or any recipient of a DPA enforcement order) may seek judicial review of the order within 45 days of receipt.

Key obligations

• The PLC must provide a privacy notice to individuals whose personal data it collects, identifying the data controller and the purpose of processing, in compliance with paragraph 2, part 2 of schedule 1 of the DPA, no later than 30 days after the date of the order (unless exempted under part 4 of the DPA).
• The PLC must cease obtaining excessive personal data, including copies of driver's licences and passports, from individuals organizing a wedding ceremony or engaging in any other activity listed in regulation 24(2) of the Public Lands Regulations, no later than 30 days after the date of the order.
• The PLC may continue to process only personal data strictly necessary for scheduling and accountability purposes, such as names and contact details.
• Data controllers generally must respond to Ombudsman investigation requests, as cooperation with DPA investigations is not voluntary.

Applies to

Public Lands Commission, data controllers, public authorities processing personal data

Deadlines

• 30 days after the date of this Order (9 November 2023): Deadline for the PLC to provide a privacy notice and cease collecting excessive personal data.
• 45 days of receipt: Period within which a person who receives a DPA enforcement order may seek judicial review to the Grand Court, upon notice to the Ombudsman.