Enforcement Order - Ministry of Planning, Agriculture, Housing, Infrastructure, Transport and Development (2024-11-01)

Summary

This is an enforcement order issued by the Cayman Islands Ombudsman under the Data Protection Act (2021 Revision) against the Ministry of Planning, Agriculture, Housing, Infrastructure, Transport and Development and its Department of Planning, acting as data controllers. It follows a complaint that an individual's employment-related personal information was disclosed publicly on a radio broadcast on two occasions (August 2022 and May 2023).

• Findings: The data controllers breached the seventh data protection principle by lacking adequate organisational measures (no data protection policies, privacy notices, designated Data Protection Leaders, or consistent staff training) and contravened section 16 of the DPA by failing to notify the data subject and the Ombudsman of the breaches within the statutory timeframe, which is an offence.
• No monetary penalty: A breach severity assessment concluded the contraventions did not meet the threshold for a monetary fine.
• Corrective steps required: Under section 45(1) of the DPA, the Ministry and Department are ordered to finalise, approve and publish their data protection policies, procedures and privacy notices, and to implement a formal, annual staff data protection training programme with maintained training logs.
• Judicial review: The order notes the recipient's right under section 47 of the DPA to seek judicial review of the order in the Grand Court.

The order is specific to this case but illustrates the Ombudsman's expectations that public authorities acting as data controllers maintain documented data protection policies, appoint responsible officers, provide regular staff training, and meet the five-day breach notification requirement under section 16 of the DPA.

Key obligations

• The Ministry must finalise, approve and publish appropriate data protection policies, procedures and privacy notices within 10 days of the order, and provide final versions to the Ombudsman's Office.
• The Ministry and Department of Planning must implement a formal staff data protection training programme to be completed annually and maintain a training log.
• Data controllers must notify the data subject and the Ombudsman of a personal data breach without undue delay and no later than five days after becoming aware of it, per section 16(1) of the DPA.
• A recipient of the enforcement order who wishes to challenge it must seek judicial review in the Grand Court within 45 days of receipt, with notice to the Ombudsman.

Applies to

data controllers (government ministries and departments), Ministry of Planning, Agriculture, Housing, Infrastructure, Transport and Development, Department of Planning

Deadlines

• 18 November 2024: Deadline stated in the order's summary for the Ministry and Department to have data protection policies and procedures finalised and approved.
• within 10 days of this order: Deadline in the formal order (section C) for the Ministry to finalise, approve and publish its data protection policies, procedures and privacy notices and provide final versions to the Ombudsman.
• within 45 days of receipt: Time limit under section 47 of the DPA for the data controller to seek judicial review of the enforcement order in the Grand Court.