Unprotected Food Delivery Website (2020-07-08)

Summary

This is a published case summary from the Cayman Islands Ombudsman describing an informally resolved data protection complaint about an online food delivery website. It illustrates how the Ombudsman handles security vulnerability complaints rather than setting out new rules or ongoing obligations.

• Complaint: A user found he could view his own and other customers personal data, including order details, email address, phone number, location and order wallet amount, without logging into the site.
• Response: The company was notified of the vulnerability and promptly made changes to secure the site.
• Outcome: The complainant confirmed the personal data was no longer accessible, and the Ombudsman closed the case with no further action required.

The notice is informational and reflects a resolved individual case rather than a binding determination, guidance note, or rule change; it does not itself impose continuing compliance obligations on other entities.

Applies to

online delivery service operators, data controllers