Enforcement Order 202400056 (2024-10-25)

Summary

This is an enforcement order issued by the Cayman Islands Ombudsman under the Data Protection Act (2021 Revision) against The Proprietors, Strata Plan No. 273, following a complaint by a unit owner at the Pinnacle Condominiums. The Ombudsman found that the Strata's Executive Committee unlawfully disclosed the complainant's personal data by circulating an update to all unit owners that identified the complainant and detailed their complaint while an investigation into the Strata's CCTV practices was ongoing.

• Findings: The update contained the complainant's personal data, was disclosed without a legal basis and without fair processing (breaching the first data protection principle), and reflected inadequate security controls leading to unauthorized and unlawful processing (breaching the seventh data protection principle).
• Order to cease unlawful disclosures: The Strata must make no further disclosures of the complainant's personal data to all unit owners without doing so fairly and with an appropriate legal basis.
• Order to improve controls: The Strata must put in place appropriate technical and organizational measures to ensure personal data relating to complaints is handled securely and lawfully.
• Compliance deadline: Both steps must be completed as soon as practicable, and no later than 30 days after the date of the Order (25 October 2024).
• Right of review: The Strata may seek judicial review of the Order in the Grand Court within 45 days of receipt, upon notice to the Ombudsman.

This order is specific to the named Strata corporation and complainant, but it illustrates the Ombudsman's approach to enforcement under sections 43 and 45 of the DPA, particularly regarding disclosures of complaint-related personal data by bodies corporate such as strata corporations, and the need for need-to-know handling of personal data.

Key obligations

• The Strata must make no further disclosures of the Complainant's personal data to all unit owners without doing so fairly and with an appropriate legal basis.
• The Strata must put in place appropriate technical and organizational measures to ensure it handles personal data relating to complaints in a secure and lawful manner.
• These steps must be completed as soon as practicable, and no later than 30 days after the date of the Order (25 October 2024).
• A person who receives an enforcement order under the DPA may seek judicial review of the Order to the Grand Court within 45 days of receipt, upon notice to the Ombudsman.

Applies to

strata corporations / bodies corporate (data controllers), The Proprietors, Strata Plan No. 273

Deadlines

• 30 days after the date of this Order (i.e. 30 days after 25 October 2024): Deadline for the Strata to cease unlawful disclosures and implement appropriate technical and organizational measures for handling personal data.
• 45 days of receipt: Period within which the Strata may seek judicial review of the enforcement order in the Grand Court, upon notice to the Ombudsman.