Performance Assessment Sent to Wrong Person (2020-02-18)

Summary

This is a published case summary from the Cayman Islands Ombudsman describing an informally resolved data breach complaint under data protection oversight. It does not create new rules; it illustrates how a specific incident was handled and closed.

• Incident: A wealth management firm reported that a senior manager accidentally sent an employee's performance appraisal to the wrong recipient because a network scanner retained an outdated email address from a prior scan job.
• Response: The sender asked the wrong recipient to delete the email and attachment, IT confirmed the email was not forwarded further, and the compliance manager and senior manager notified the affected data subject of the breach and the remedial steps planned.
• Outcome: The company implemented technical and organizational measures to prevent recurrence, and the Ombudsman was satisfied with the response, closing the case as an informal resolution.

As a case outcome notice, it does not itself impose new compliance obligations on regulated entities, but it signals the Ombudsman's expectations for prompt breach containment, data subject notification, and remedial action following a personal data breach.

Applies to

data controllers