Personal data transferred from company laptop (2020-10-12)

Summary

This is a published case summary from the Cayman Islands Ombudsman describing an informal resolution of a personal data breach complaint under data protection law. It illustrates how a data breach involving an ex employee's company laptop was investigated and resolved, rather than setting out new rules or requirements.

• Incident: A utility company discovered that a former employee had exported company data to an external flash drive from his work laptop before returning it after resignation.
• Remediation steps taken: The company visited the ex employee, erased the flash drive, confirmed no data remained on his devices, and obtained a signed acknowledgement that all data was returned or destroyed and not shared with third parties.
• Policy changes: The company changed its laptop return process to occur earlier in termination, banned use of flash drives for data transfer, increased employee training, and reviewed its data loss monitoring service.

The matter was closed as an informal resolution with no indication of further enforcement action, so it functions as guidance on good practice for handling insider data breaches rather than as a binding directive.

Applies to

data controllers, employers