RCIPS loses bail book and finds it again (2022-08-12)

Summary

This is a published case summary from the Cayman Islands Ombudsman describing an informal resolution of a data protection complaint against the Royal Cayman Islands Police Service (RCIPS). It illustrates the Ombudsman's application of the Data Protection Act's data security principle rather than creating new rules, but sets out corrective measures the RCIPS agreed to take.

• Incident: RCIPS reported its 2020 bail book, containing prisoner names, arresting officer names and JMS numbers, went missing from the detention centre; it was later found with no adequate explanation.
• Finding: The Ombudsman found RCIPS had breached the seventh data protection principle by failing to have appropriate technical and organisational measures against accidental loss, destruction or damage of personal data, including an unlocked storage cabinet and no access policies.
• Gap identified: No retention or secure disposal arrangements existed for bail books.
• Remedial action: RCIPS installed a lock on the cabinet, introduced a shift handover procedure making an officer accountable for the bail book, and was advised to develop, approve and implement a disposal schedule without delay.
• Outcome: The case was closed given the low risk to individuals' rights and freedoms and the likelihood the book had remained within RCIPS custody throughout.

As a case outcome notice, this document does not itself impose new legal requirements beyond restating existing Data Protection Act obligations, but it signals the Ombudsman's expectations that public authorities holding personal data implement secure storage, access controls and retention/disposal schedules.

Key obligations

• RCIPS was required to secure the cabinet used to store the bail book (a lock was installed)
• RCIPS was required to implement a shift handover procedure holding an officer accountable for the bail book
• RCIPS was advised to develop, approve and implement a disposal schedule for bail books without delay
• Public authorities generally must adhere to the seventh data protection principle requiring appropriate technical and organisational measures against accidental loss, destruction or damage of personal data

Applies to

Royal Cayman Islands Police Service (RCIPS), public authorities subject to the Data Protection Act

Deadlines

• without delay: RCIPS advised to develop, approve and implement a bail book disposal schedule without delay