Public sector entity incurs unreasonable delays in responding to a subject access request (2022-07-20)

Summary

This is a published case summary from the Cayman Islands Ombudsman describing an informal resolution outcome under the Data Protection Law. It illustrates how the Ombudsman handles complaints where a public sector data controller fails to respond to a subject access request within a reasonable time.

• Facts: A public sector data controller ignored a subject access request for over 200 days without responding.
• Ombudsman action: After informal resolution attempts failed, the Ombudsman issued an enforcement order requiring the data controller to give a complete and final response and to conduct an internal investigation into the cause of the delay.
• Result: The data controller fully complied with the request and submitted an investigation report explaining the reasons for the delay.

As a case summary rather than a binding rule or guidance document, it does not itself create new legal obligations, but it signals the Ombudsman's expectation that public sector data controllers respond to subject access requests promptly and without unreasonable delay, and that they may be subject to enforcement orders and required investigations if they fail to do so.

Applies to

public sector data controllers