Enforcement Order - Department of Children and Family Services (2022-02-14)

Summary

This is an enforcement order issued by the Cayman Islands Ombudsman against the Department of Children and Family Services (DCFS) after it failed to properly respond to a subject access request made under section 8 of the Data Protection Act (2021 Revision). The order sets out findings that DCFS breached its statutory duty and imposes specific corrective requirements with fixed deadlines.

• Finding: DCFS failed to meet its statutory duty under section 8 of the DPA by not responding within the 30 day statutory timescale, not properly claiming an extension, and later providing an incomplete response.
• Full response required: DCFS must provide a full response to the original subject access request, covering all personal data held on the two data subjects within scope, by end of business on 7 March 2022, identifying and explaining any claimed exemptions.
• Internal investigation required: DCFS must investigate why its handling of the request failed to comply with the DPA and report its findings in full to the Ombudsman by end of business on 7 March 2022.
• Policy recommendation: The Ombudsman recommends (not orders) that DCFS draft a comprehensive policy on handling section 8 requests in accordance with the DPA going forward.
• Right of review: Under section 47, a recipient of an enforcement order may seek judicial review of the Order in the Grand Court within 45 days of receipt, upon notice to the Ombudsman.

This is a case-specific enforcement order rather than a rule of general application, but it illustrates the Ombudsman's approach to section 8 subject access request timelines and enforcement powers under the Data Protection Act, relevant to any Cayman Islands public authority or data controller handling such requests.

Key obligations

• DCFS must provide a full response to the complainant's section 8 subject access request, covering all personal data on the two data subjects within scope, by end of business on 7 March 2022
• DCFS must identify and explain any information withheld under DPA or Data Protection Regulations exemptions in its full response
• DCFS must investigate the causes of its non-compliance with the DPA and report findings in full to the Ombudsman by end of business on 7 March 2022

Applies to

data controllers, public authorities (Department of Children and Family Services)

Deadlines

• 7 March 2022 (end of business): Deadline for DCFS to provide a full response to the complainant's subject access request
• 7 March 2022 (end of business): Deadline for DCFS to report to the Ombudsman its findings on why its response failed to comply with the DPA
• within 45 days of receipt: Time limit for a recipient of the enforcement order to seek judicial review of the Order in the Grand Court, upon notice to the Ombudsman