Serious data breach at real estate company - Betty Boo Real Estate Sales (2023-04-27)

Summary

This is a published case summary from the Cayman Islands Ombudsman describing an investigation and decision against a real estate company data controller (Betty Boo Real Estate Sales) following a serious data breach involving compromise of a business email account. It illustrates the Ombudsman's enforcement approach under the Data Protection Act (DPA) rather than establishing new general rules, but it sets out specific corrective obligations imposed on the data controller.

• Findings: The data controller was found to have violated the first principle (failure to provide an adequate privacy notice), the statutory requirement to report personal data breaches, and the seventh principle (lack of appropriate technical and organizational security measures).
• Impact: A hacker compromised the business email account, exposing personal data of multiple individuals, and two clients suffered substantial monetary loss as a result.
• Required remedial actions: The data controller was ordered to migrate its business email to a more secure platform, engage IT support for ongoing compliance, undertake cybersecurity awareness training and annual data protection training, and develop policies and procedures to safeguard personal data in line with the DPA going forward.

The case serves as a cautionary example for other data controllers, particularly smaller businesses such as real estate agencies, on the need for prompt breach reporting and robust technical and organizational safeguards for personal data.

Key obligations

• The data controller must migrate its business email to a more robust/secure platform
• The data controller must retain IT support services to ensure ongoing data protection compliance
• The data controller must undertake cybersecurity awareness training and annual data protection training
• The data controller must develop and implement appropriate policies and procedures to safeguard personal data in compliance with the DPA

Applies to

data controllers, real estate companies