No personal data held by local law firm (2023-08-18)

Summary

This is a published case summary from the Cayman Islands Ombudsman describing an informal resolution of a data protection complaint against a local law firm. It illustrates how the Ombudsman applies subject access request rules under the Data Protection Act, rather than creating new rules itself.

• Complaint: An individual alleged a local law firm, acting as a data controller, collected photos of him and others on private property and a public beach and failed to explain how or why the data was being used.
• Non response: The law firm asked for correspondence to go through the complainant's attorney and then did not respond, appearing to breach the statutory 30 day timeframe for subject access requests.
• Investigation outcome: The Ombudsman's investigation found no personal data was actually being held, but noted the complainant should still have been informed of that fact within the required period.
• Resolution: After further delay, the law firm responded to the complainant and provided evidence of this to the Ombudsman, and the case was closed as informally resolved.

As a case summary, this document does not itself impose new obligations but reaffirms that data controllers must respond to subject access requests within 30 days, including confirming when no personal data is held.

Key obligations

• Data controllers must respond to a subject access request within the statutory 30 day timeframe, including where no personal data is held, by informing the requester of that fact.

Applies to

data controllers, law firms

Deadlines

• 30 days: Statutory timeframe for a data controller to respond to a subject access request