Right to one’s own personal data despite FOI exemptions (2023-02-10)

Summary

This is a published case summary from the Cayman Islands Ombudsman describing a Freedom of Information (FOI) decision. It illustrates how the Ombudsman applies the amended FOI Act alongside the Data Protection Act (DPA) when a requester seeks records containing their own personal data.

• Facts: An applicant sought records about a recruitment exercise at the Mosquito Research and Control Unit (MRCU) in which he was a candidate; the Ministry of Health and Wellness disclosed a heavily redacted email, citing exemptions for free and frank deliberations and effective conduct of public affairs.
• Finding: The Ombudsman held that, under the amended FOIA, a public authority must consider the impact of the DPA and found the Ministry had not disclosed all of the applicant's own personal data he was entitled to receive.
• Outcome: The Ombudsman ordered the Ministry to disclose all of the applicant's relevant personal data.

As a case summary, this document does not create new rules but signals to public authorities that an individual's right to access their own personal data under the DPA can override or limit reliance on certain FOIA exemptions.

Key obligations

• Public authorities must consider the impact of the Data Protection Act when applying FOI exemptions and must disclose an applicant's own personal data to which they are entitled, even where other exemptions are claimed.

Applies to

public authorities subject to the Freedom of Information Law, Ministry of Health & Wellness, Mosquito Research and Control Unit (MRCU)