Data Protection Regulations, 2018 (SL 17 of 2019)

Summary

These Regulations supplement the Data Protection Law, 2017 and came into force at the same time as that Law. They set out operational rules for handling subject access requests, exemptions from certain disclosure obligations, and a limit on international cooperation transfers under the Law's Eighth principle.

• Fees for requests: Data must generally be provided free of charge in response to a section 8 request; a reasonable fee may only be charged, or the request refused with reasons, where it is manifestly unfounded or excessive (repetitive, fraudulent, or unreasonably resource-intensive). The data controller bears the burden of proving this.
• Extension of response time: A data controller may extend the response time for a subject access request by up to 30 days in specified circumstances, and beyond 30 days only with the Ombudsman's permission; the data subject must be told the reason for any extension and when a final response will be given.
• Duty to inform of complaint rights: When a section 8 request is received, the data controller must tell the data subject of their right to complain to the Ombudsman under section 43 of the Law.
• Cessation of processing requests: A controller must comply with a section 10(1) request to cease processing unless it applies to the Ombudsman within 21 days of the request and receives approval not to comply; the data subject must be informed of any such application.
• Health exemption: Personal data whose release could cause mental or physical harm are exempt from subject information provisions, subject to conditions requiring consultation with an appropriate health professional where the controller is not one.
• Education exemption: Educational records are exempt from section 8 disclosure in certain circumstances involving risk of serious harm, parental requests, abuse-risk information, or upcoming exam questions (within twelve months).
• Social work exemption: Personal data processed by public authorities or courts in specified social work, welfare, housing, or family/child proceedings contexts are exempt from subject information provisions where disclosure could cause serious harm or was given in confidence.
• International cooperation transfers: Transfers between intelligence or regulatory agencies for international cooperation purposes are limited to disclosures permitted or required under a Cayman Islands enactment or a Grand Court order.

The Regulations apply to data controllers subject to the Data Protection Law, 2017, and give the Ombudsman a supervisory role in approving time extensions and non-compliance with cessation requests.

Key obligations

• Provide personal data and information in response to a section 8 request free of charge unless the request is manifestly unfounded or excessive, in which case a reasonable fee may be charged or the request refused with reasons given
• Bear the burden of proving that a request is manifestly unfounded or excessive
• Where extending time to respond to a subject access request, inform the data subject of the reason for the extension and when a final response will be given
• Obtain the Ombudsman's permission to extend the response time beyond thirty days
• Inform data subjects making a section 8 request of their right to complain to the Ombudsman under section 43 of the Law
• Comply with a section 10(1) request to cease processing unless the controller applies to and receives approval from the Ombudsman within twenty-one days of the request
• Inform the data subject of any application made to the Ombudsman to avoid complying with a cessation request
• Before refusing a request under the health exemption, a non-health-professional data controller must obtain a written opinion from an appropriate health professional that the exemption applies

Applies to

data controllers

Deadlines

• up to thirty days: Maximum extension of time a data controller may take to respond to a subject access request without Ombudsman permission
• twenty-one days of the date of the request: Period within which a data controller must apply to the Ombudsman for approval not to comply with a data subject's request to cease processing
• twelve months from the date of the request: Period during which personal data revealing likely examination or test questions is exempt from subject access disclosure
• six months before the request: Period within which a health professional's opinion on the health exemption must have been obtained for the exemption conditions to be satisfied