Limitations to the right to access one’s own data (2022-03-29)

Summary

This is a published case summary from the Cayman Islands Ombudsman describing an informal resolution of a data protection complaint. It illustrates how existing exemptions under the Data Protection Act (DPA) apply to subject access requests, rather than creating any new rule or obligation.

• Complaint: An individual was dissatisfied after a data controller refused to fully comply with their subject access request for their own personal data.
• Controller's position: The data controller, a therapeutic services provider, withheld information because it would have disclosed another person's personal data and relied on the medical exemption under the DPA.
• Outcome: The Ombudsman's informal resolution process confirmed the refusal was valid and the claimed exemption properly applied, so the complainant was correctly denied access to that information.

The document is purely a case outcome notice for public awareness; it does not itself impose new compliance duties but reflects existing DPA exemptions (third-party data and medical exemption) that data controllers may already rely on when handling subject access requests.

Applies to

data controllers