Spreadsheet data tool causes utility emails to be sent to wrong customers (2021-07-15)

Summary

This is a published case summary from the Cayman Islands Ombudsman describing an informally resolved data protection complaint. It illustrates how a data breach occurred and what remedial action the data controller took, rather than setting out any new rule or ongoing obligation.

• What happened: A utility company used a mail merge tool in a spreadsheet that incorrectly matched contact details to customer accounts, causing delinquency emails and form letters to be sent to the wrong customers.
• Data exposed: Names, addresses, account numbers, account balances and delinquent balances of 123 individuals were disclosed to unintended recipients; customers without email as a primary contact method were unaffected.
• Investigation: The Ombudsman had to issue an information order to obtain a full response from the data controller, which was delayed.
• Remedial steps taken: The data controller limited the personal data included in disconnection notices to only what was strictly necessary, such as account numbers and delinquent balances, to prevent recurrence.

The matter was closed as an informal resolution and does not create new binding requirements; it serves as guidance on the type of data handling failure the Ombudsman has previously investigated and the mitigation it considered adequate.

Applies to

data controllers, utility companies