The Cayman Islands government has published the Data Protection Bill, 2016 (the "Bill") which proposes a framework of rights and duties designed to safeguard individuals' personal data, balanced against the need of public authorities, businesses and organisations to collect and use personal data for legitimate purposes. The Bill was developed in line with international best practices while ensuring that it reflects the specific needs of the Cayman Islands. It is based substantially on the Data Protection Act, 1998 of the United Kingdom.

The Bill is centred around eight data protection principles requiring that personal data must:

  1. be processed fairly and only when specific conditions are met, for instance where consent has been given, where there is a legal obligation, or where it is necessary for performance of a contract to which the data subject is a party. Additional conditions apply in respect of "sensitive" personal data (examples of which include, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, health, sex life and offences);
  2. be obtained only for one or more specified lawful purposes, and shall not be further processed in any manner incompatible with such purposes;
  3. be adequate, relevant and not excessive in relation to the purpose or purposes for which they are collected or processed;
  4. be accurate and, where necessary, kept up-to-date;
  5. not to be kept for longer than is necessary for the purpose;
  6. be processed in accordance with the rights of individuals as specified under the draft Bill;
  7. be protected by appropriate technical and organisational measures against unauthorised or unlawful processing, and against accidental loss, destruction or damage; and
  8. not to be transferred abroad unless the country or territory to which it is transferred ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

It is hoped that the Bill, when enacted, will allow the Cayman Islands to be recognised by the EU Commission as providing adequate data protection.1

Rights

The proposed legislation grants to living individuals referred to as ("data subjects") specific rights in relation to their personal data including, subject to specified limitations:

  • the right to be informed by a data controller whether their personal data is being processed;
  • the right to access their personal data and certain information about its use and source;
  • the right to require that processing of their personal data cease;
  • the right to require that processing of their personal data for the purpose of direct marketing cease;
  • the right to require that a decision which significantly affects him or her is not made solely by the processing by automatic means of personal data;
  • the right to seek compensation for damages caused by contravention of the data protection legislation;
  • the right to complain to the Information Commissioner where it appears that a violation has occurred; And
  • the right to seek from the Information Commissioner an order for rectification, blocking, erasure or destruction of inaccurate personal data and opinions based on such.

Duties

The Bill imposes specific obligations on the persons who control the processing of personal data (so-called "data controllers" – see below), including:

  • the duty to apply the data protection principles;
  • the duty to respond in a timely fashion to requests from data subjects in relation to their personal data; And
  • the duty to notify data subjects and the Information Commissioner of any personal data breaches.

If processing of personal data is to be carried out on behalf of a data controller by a data processor (not being an employee of the data controller), the data controller will not be regarded as complying with Principle 7 above unless the processing is carried out under a contract which conforms to specific requirements (to ensure compliance with the Bill).

Application

The Bill applies to a data controller established in the Cayman Islands if the data are processed in the context of that establishment. It also applies to a data controller who is not established in the Cayman Islands but processes data in the Islands otherwise than for the purposes of transit of data through the Islands. Where a data controller is not established in the Islands, the data controller is required to nominate someone who is established in the Islands as a representative (which representative will themselves be liable as a data controller).

In order to be a "data controller", a person must be the person who, alone or with others, determines the purposes, conditions and means of the processing of personal data.

The regulated activity of "processing" personal data is very widely defined to include obtaining, recording or holding data, or carrying out any operation or set of operations (which is again very widely defined). It is difficult to envisage anything that an organisation might do with data that will not be considered to be processing.

Exemptions

In order to ensure that personal data can be used in appropriate circumstances, the Bill recognises a number of exemptions to the obligations noted above, including national security, law enforcement, certain public functions, health care, education, social work, journalism, literature, art, research, history, statistics, information available under an enactment, legal proceedings, personal family or household affairs, honours, corporate finance, negotiations and legal privilege.

Compliance and Enforcement

The Information Commissioner, currently tasked with oversight of the Freedom of Information Law (2015 Revision), will assume a similar role for data protection, and will be given the powers, responsibilities and resources necessary to ensure the successful functioning of the legislation.

The Information Commissioner will be given the power:

  • to hear, investigate and rule on complaints;
  • to monitor, investigate and report on the compliance of data controllers under the law;
  • to intervene and deliver opinions and orders related to processing operations;
  • to order the rectification, blocking, erasure or destruction of data;
  • to impose a temporary or permanent ban on processing;
  • to make recommendations for reform both of a general nature and directed at specific data controllers;
  • to engage in proceedings where the provisions of the law have been violated, or refer violations to the appropriate authorities;
  • to cooperate with international data protection supervisory authorities;
  • to publicise and promote the requirements of the law and the rights of data subjects under it; and
  • to do anything which appears to be incidental or conducive to the carrying out of his or her functions under the law.

The Bill establishes a number of offences and penalties for failure to comply with the requirements of the Bill, but also for:

  • failing to notify the data subject and the Information Commissioner of a personal data breach;
  • withholding, altering, suppressing or destroying information requested by the Information Commissioner;
  • knowingly or recklessly disclosing information;
  • obstructing a warrant, or making a false statement;
  • unlawfully obtaining, disclosing, selling or procuring personal data;
  • failing to comply with an enforcement or monetary enforcement order; and
  • offences otherwise specified in Regulations.

The Bill includes many detailed provisions and defined terms. In order to keep this article concise we have summarised several key terms and our summary may be an oversimplification. Reference should be made to the terms of the Bill for more accurate particulars of its intended application.

Footnotes

1 The Council and the European Parliament have given the EU Commission the power to determine whether a third-country ensures an adequate level of protection by reason of its domestic law or of the international commitments it has entered into. The effect of such a decision is that personal data can flow from the EU and EEA member countries to that third country without further safeguards being necessary.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.