The right to access one’s own personal data - Department of Education Services (2023-07-25)

Summary

This is a published case summary from the Cayman Islands Ombudsman describing a data protection complaint decision against the Department of Education Services (DES). It illustrates how the Ombudsman enforces subject access request obligations under the Data Protection Law, rather than creating new general rules.

• Complaint: A member of the public requested feedback data on her job application from DES (the data controller) but received no substantive response.
• Finding: The Ombudsman found DES contravened the sixth data protection principle (data subject rights) and section 8 of the Data Protection Law (right to access one's own personal data) by failing to respond to the subject access request.
• Enforcement order: The Ombudsman ordered DES to provide the complainant with the requested personal data regarding her job application within 5 business days.

The decision serves as a precedent reminder that data controllers, including government departments, must substantively respond to subject access requests or risk an enforcement order from the Ombudsman.

Key obligations

• Data controllers must substantively respond to subject access requests for personal data under section 8 of the Data Protection Law.
• DES was ordered to provide the complainant with the requested personal data regarding her job application within 5 business days of the order.

Applies to

data controllers, government departments

Deadlines

• 5 business days: DES ordered to provide the complainant with the requested personal data (job application feedback) within 5 business days of the Ombudsman's enforcement order.