We use cookies to give you the best online experience. By using our website you agree to our use of cookies in accordance with our cookie policy. Learn more here.Close Me
Most Popular Article in Cayman Islands, September 2019
The Cayman Islands Data Protection Law, 2017 (DP
Law) is currently scheduled to come into effect on 30
September 2019. Once commenced, it will enact a framework of
rights and duties to regulate the processing of individuals'
personal data broadly based on the same internationally recognised
privacy principles that form the basis for other data protection
laws globally. The DP Law will regulate the processing of all
personal data in the Cayman Islands and will affect any entity
established in the Cayman Islands, including investment funds, that
processes personal data regardless of whether such processing takes
place within the Cayman Islands and regardless of whether the
personal data relates to Cayman individuals. For our full
briefing see Cayman Islands Data Protection Law: An Ogier Client
Guide.
What does this mean for Cayman funds?
Under the DP Law, any entity established in the Cayman Islands
that handles any individual's personal information will have
certain obligations with respect to that information and must
ensure that such individual is formally apprised of by whom, and
for what purpose, any of their personal data is being
used.
A Cayman fund will be regarded as a data
controller under the DP Law as a 'person who, alone or
jointly with others determines the purposes, conditions and manner
in which any personal data are, or are to be, processed'.
As such, the fund will be responsible for complying with the
requirements of the DP Law and the data protection principles in
respect of personal data processed by the fund or on behalf of the
fund by any third party processors such as its administrator and
other service providers (each a data
processor).
Under the DP Law, data controllers must act in accordance with
eight data protection principles:
personal data held by the fund must
be processed fairly and lawfully;
personal data must be used for a
legitimate purpose that has been notified to the data subject in
advance;
personal data holdings should be
adequate and relevant and not be excessive in relation to the
purposes for which they are collected;
personal data held by the fund should
be accurate and up to date;
personal data should not be kept for
longer than necessary and should be securely deleted once those
purposes have been fulfilled;
personal data should be processed in
accordance with the rights of individuals;
the fund should apply (and ensure
that its data processors apply) appropriate technical and
organisational measures in relation to the personal data; and
personal data shall not be
transferred outside of the Cayman Islands other than to a territory
with an adequate level of data protection or in accordance with the
DP Law.
Breaches under the DP Law could result in fines of CI $100,000
(US $122,000) and certain offences are punishable by imprisonment.
Other monetary penalties of up to Cl $250,000 (US $305,000)
are also possible in certain circumstances.
What action does a Cayman fund need to take to ensure
compliance?
Cayman funds should act now to ensure that they comply with the
DP Law by the expected commencement date of 30 September
2019. Recommended actions required include (without
limitation):
prepare and approve a new privacy
notice, or amend the form of the current privacy notice, and
circulate the same to existing investors;
revise the form of subscription
documents for any investors subscribing into the fund after the
commencement of the DP Law on 30 September 2019;
ensure that contracts with service
providers that process personal data on behalf of the fund comply
with the DP Law, and negotiate and agree on amendments if
necessary; and
ensure all amendments to fund
documents are appropriately approved and authorised.
Should you have any questions, we would be happy to discuss the
implications of the DP Law for your fund and to assist with your
fund's compliance.
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
On 30 October 2019, the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit) ("Berlin DPA")
The United Arab Emirates (‘UAE') is a federation of seven emirates, and all emirates are subject to the UAE constitution and a set of federal laws while retaining the right to administer
The Cayman Islands ("Cayman") Ombudsman has issued new Guidance on Monetary Penalty Orders v1.0 under the Cayman Data Protection Law 2017 ("DPL") ("Guidance")
Some comments from our readers… “The articles are extremely timely and highly applicable” “I often find critical information not available elsewhere” “As in-house counsel, Mondaq’s service is of great value”
Gain access to Mondaq global archive of over 375,000 articles covering 200 countries with a personalised News Alert and automatic login on this device.
