Enforcement Order 202400056-2 (2024-12-12)

Summary

This is an enforcement order issued by the Cayman Islands Ombudsman against The Proprietors, Strata Plan No. 273 (the body corporate managing the Pinnacle Condominiums), following a complaint about its on-site CCTV system. The Ombudsman found multiple breaches of the Data Protection Act (2021 Revision) relating to the CCTV Policy's purposes, camera placement, signage, retention, handling of a Section 10 cessation notice, and data processor contracts.

• First principle: The Strata lacked an appropriate legal basis for all purposes listed in its CCTV Policy.
• Third principle: CCTV processing was excessive relative to its purposes and some camera locations (owners lounge, gym, pool) were unnecessarily intrusive.
• Fifth principle: Personal data (footage) was likely retained longer than necessary for the stated purposes.
• Sixth principle: The Strata's response to the Complainant's Section 10 notice to cease processing was not valid.
• Seventh principle: The Strata failed to have appropriate contracts in place with its CCTV data processors.

The order requires the Strata to overhaul its CCTV Policy and practices, and to submit the revised Policy to the Ombudsman's office for review. It also sets out a formal route for the Strata to challenge the order via judicial review.

Key obligations

• Review and revise the CCTV Policy to ensure footage is used only for purposes with a valid legal basis, removing any purposes lacking one.
• Clarify the respective roles and responsibilities of the Strata (as data controller) and its data processors (CCTV System Manager and CCTV Manager) in the Policy.
• Ensure cameras are located only where necessary for lawful purposes (primarily crime prevention) and remove or relocate cameras in communal areas (gym, pool, lounge) that are not necessary for that purpose.
• Install suitably detailed signage at all points of entry to the property and review it regularly for accuracy.
• Define retention periods for CCTV data more clearly, including circumstances and approval process for extended retention, with the Strata retaining ultimate decision-making authority.
• Clarify in the Policy the circumstances under which covert monitoring or staff monitoring may occur, with appropriate controls and staff notification.
• Review and reissue the response to the Complainant's Section 10 notice requesting cessation of processing.
• Put in place written contracts with data processors meeting at least the requirements of Paragraph 3, Part 2 of Schedule 1 of the DPA, and ensure processors are appropriately trained/qualified.
• Provide further detail in the Policy on any sharing of footage with third parties for crime-related purposes, including controls and DPA compliance.
• Submit the revised CCTV Policy to the Ombudsman's office for review once amendments are made.

Applies to

strata corporations / bodies corporate, condominium and property management companies, data controllers operating CCTV systems, data processors providing CCTV or property management services

Deadlines

• 45 days of receipt: Under Section 47 of the DPA, a person who receives an enforcement order may, within 45 days of receipt and upon notice to the Ombudsman, seek judicial review of the Order to the Grand Court.