Enforcement Order 202400591, 202400592 & 202400716 - WORC (2024-12-04)

Summary

This is an enforcement order issued by the Cayman Islands Ombudsman against Workforce Opportunities & Residency Cayman (WORC) following three personal data breach notifications submitted under the Data Protection Act (2021 Revision). The breaches, arising from disclosure of work permit statistics via FOI responses and misdirected emails, ultimately affected 37,686 and 9 individuals across the three cases. The Ombudsman found WORC contravened the seventh data protection principle due to inadequate technical and organisational measures, and ordered specific remedial steps.

• Website alert: WORC must immediately sign-post the enforcement order as an alert on the main page of its website.
• Policies and procedures: WORC must finalize, approve and publish appropriate data protection policies and procedures within 30 days of the order, and provide final versions to the Ombudsman's office within the same 30 days.
• Staff training: WORC must implement a formal staff data protection training programme completed annually, maintain a training log, and emphasize the seventh data protection principle and breach identification in training.
• Judicial review right: WORC (or any recipient of an enforcement order) may seek judicial review of the order in the Grand Court within 45 days of receipt, upon notice to the Ombudsman.

The order illustrates the Ombudsman's expectations for data controllers regarding breach containment, timely notification of affected data subjects under section 16 of the DPA, and maintenance of documented data protection governance and training.

Key obligations

• WORC must sign-post the enforcement order as an alert on the main page of its website immediately.
• WORC must finalize, approve and publish its data protection policies and procedures within 30 days of the order and provide final versions to the Ombudsman's office within that period.
• WORC must implement a formal annual staff data protection training programme and develop and maintain a training log.
• Data controllers must notify affected data subjects of personal data breaches in accordance with section 16 of the DPA.
• A recipient of an enforcement order may seek judicial review of the order to the Grand Court within 45 days of receipt, upon notice to the Ombudsman.

Applies to

data controllers, government departments/statutory bodies acting as data controllers (Workforce Opportunities & Residency Cayman)

Deadlines

• within 30 days of this order: WORC must finalize, approve, and publish its data protection policies and procedures, and provide final versions to the Ombudsman's office.
• annually: WORC must implement a formal staff data protection training programme completed annually, with a maintained training log.
• within 45 days of receipt: Deadline for a recipient of an enforcement order to seek judicial review of the order to the Grand Court, upon notice to the Ombudsman.