Data Protection breach investigation leads to charges
The Office of the Ombudsman completed an investigation into a personal data breach involving a former employee of a local telecommunications company. The ex-employee is alleged to have unlawfully shared customers’ personal information with a police officer, which the officer is then alleged to have used for personal purposes.
The personal data breach was reported on 20 November 2020 under section 16 of the Data Protection Act. A subsequent investigation by the Office of the Ombudsman and the Royal Cayman Islands Police Service (RCIPS) led to criminal charges before the court, including charges against the telecommunications company’s ex-employee and the police officer under section 54 of the Act.
As part of the investigation to determine if the data controller adhered to the seventh principle of the Act, the Ombudsman’s office reviewed various sources of information, including the telecommunication provider’s data protection policies and procedures, the ex-employee’s data protection training records, a confidentiality agreement between the ex-employee and the employer, details on the data controller’s system audit logs, and the ex-employees personal phone records. The office also obtained several witness statements from relevant parties. The investigation determined that the data controller had adequate organisational and technical measures in place to secure the data in spite of the personal data breach.
Given the nature of the breach, the Ombudsman’s office requested the assistance of the RCIPS to conduct a criminal investigation. Following the submission of a legal file to the Office of the Director of Public Prosecutions, a legal ruling recommended the telecommunications company’s former employee and the police officer be charged.
“It is important for all public and private sector employees to be aware that access to, and the processing of, an individual’s personal data must be done fairly and lawfully and only for the purposes for which that data was provided,” said Sharon Roulstone, Ombudsman. “As this case demonstrates, there are potentially serious consequences if personal data is not managed in accordance with the Data Protection Act.”
Own-Motion Investigation into police dog incident
On 9 July 2022, the Royal Cayman Islands Police Service (RCIPS) notified our office of the death of Police Dog Baron.
We immediately opened an own-motion investigation (OMI) under section 3(2)(c) of the Police
(Complaints by the Public) Act and requested the assistance of the Department of Agriculture
Animal Welfare and Control Unit (DOA) to carry out an independent investigation into the
circumstances with our oversight.
As part of our review, the OMB conducted an early inspection of the kennels along with the DOA and identified several areas needing immediate attention. These included:
• The need for a permanent roof outside the kennels, which are located outside in the back of
the police station property
• The creation of a welfare and observation log for each RCIPS dog handler
• The need to clean debris from unused kennels for use as a quarantine area in the event
another animal became unwell
• the removal of chemical and cleaning supplies from the kennel area
• The need to provide an enrichment area for the police dogs to exercise
• The need for air conditioning maintenance at the kennels to be conducted on a regular basis
• The need to clear debris outside the kennels to prevent rodents from entering the area and
potentially biting the dogs
Based on these findings, early recommendations were made to the RCIPS, and periodic inspections of the kennels were conducted. All the above recommendations were promptly actioned by RCIPS.
At the conclusion of the joint investigation into the death of K9 Baron, a file was submitted to the Director of Public Prosecutions (ODPP) on 13 September 2022.
We will not be substantively commenting on our own findings until the completion of any action taken by the ODPP and/or the Cayman Islands court system with respect to this matter as a result of the legal ruling recommendation on 6 January 2023
Ombudsman annual report for 2021 – Demand for services continues to rise
PRESS RELEASE
The Office of the Ombudsman continues to receive an increased number of inquiries and formal complaints/appeals in nearly all areas overseen by the office, as detailed in the 2021 Annual Report made public in Parliament today, 7 December 2022.
Established in September 2017, the Ombudsman’s office entered its fourth full year of operations last year as Cayman’s one-stop-shop for complaints against inefficient or poor government administration, complaints against the conduct of police officers, whistleblower complaints against both public and private sector entities, data protection complaints and reports of data breaches, as well as Freedom of Information (FOI) appeals.
The past year has been one of transition for our office, as the end of 2021 and early 2022 saw the departure of a number of experienced and professional staff members, including former Ombudsman Sandy Hermiston in early 2022. More recently, we saw the hiring of our first Caymanian Ombudsman, local attorney Sharon Roulstone, who took over the post in April 2022.
“Despite the current short staffing situation, our office has many victories to celebrate,” Ms. Roulstone said. “We’ve adopted a modern approach to customer complaints with the creation of an informal resolution process, a flexible way of resolving complaints without the need for time-consuming formal investigations. We have resolved a backlog of more than 140 historical complaints against police conduct. We have established an efficient process for the handling of data protection complaints and reports of data breaches and we continue to successfully resolve FOI appeals.”
Ms. Roulstone noted that there is much more work to do, particularly in reforming legislation around whistleblower protection and police complaints. Some sections of the maladministration complaints and the data protection legislation will need review in the coming year as well.
“Our office has been around long enough for us to have a good understanding of what’s working and what isn’t,” Ms. Roulstone said. “We have already taken plans for reform of certain areas to lawmakers, and we will hopefully be adding to those in the near future.”
An overview of each section of the Office of the Ombudsman for the calendar year 2021 is provided below.
FOI
After seeing an initial dip early in the year, 2021 ended as our office’s busiest-ever in terms of FOI appeals. A total of 17 appeals were carried forward from 2020 and a record-breaking 31 new appeals were received. Out of all those cases (48), a total of 33 were resolved, most via our standard informal resolution process.
Topics requested via FOI continue to cover a myriad of government entities, including statistics on prosecutions undertaken by the Department of Environment, statistics on trade and business licenses, CINICO health insurance claims and requests for the minutes of Health Practice Commission meetings.
During the year, the Ombudsman issued six binding hearing decisions for FOI appeals. Three of these appeals were dismissed, two were fully upheld and one partially upheld, meaning information was ordered to be released. The formal decisions also dealt with a wide variety of subjects ranging from the redevelopment of Smith Barcadere, the contract of a Law School employee, retail fuel test results, marriage checks by WORC, a report of the review committee on permanent residence, and fee, duty and tax waivers for large developments.
Data protection
Our work in personal privacy protection and data-related complaints continued to increase during 2021. Our office received 30 complaints and 101 data breach notifications, as well as 138 inquiries about data protection. The Ombudsman issued 5 formal enforcement orders in the course of the year, and we resolved 17 complaints and 96 data breaches. These numbers are all significantly higher than in the previous year.
In response to the ongoing Covid-19 pandemic, we published additional guidance on vaccination and the Covid-19 status of employees and patrons of fitness establishments, as well as further guidance on our methodology for monetary penalty orders.
Maladministration
The last year also saw a significant increase in maladministration complaints. Our office recorded 122 new inquiries in 2021, compared to 109 during 2020. The impact of Covid restrictions was the area which generated the most complaints, across a number of government agencies.
We received a total of 65 formal complaints, in addition to 11 that were carried forward from 2020, across all sectors of government. Of these, 53 complaints were resolved with 21 being informally resolved without the need for a formal investigation. The year ended with 23 open cases that will carry forward to 2022 and 28 complaints that were rejected for lack of jurisdiction. As in previous years, we were able to resolve most complaints informally, thanks to the cooperation of many across the public sector.
There continues to be a need for the development of, and public access to, policies and procedures for almost all government departments. This is one of our most common complaints and we continue to encourage the development and accessibility of these important tools to the public. Without these written, publicly available policies, there is a risk of inconsistency in decision-making leading to a perception of bias.
Police complaints
In relation to complaints against police conduct, our office received 60 new inquiries in 2021, a slight increase over the 52 from 2020. The number of formal complaints received decreased to 28 over the previous year’s 57 and we carried over 15 existing complaints from 2020. A total of 4 cases were closed by way of formal investigation while 11 were informally resolved. Of the remainder, 3 were rejected for lack of jurisdiction or were time-barred, and 8 were abandoned or withdrawn by the complainant. We have 16 open cases that will carry forward into 2022.
During 2021, our office received its first complaint relating to death or serious harm forwarded to the Office of the Director of Public Prosecutions (ODPP). It was a test of the Police (Complaints by the Public) Act, which has not provided procedural guidance, nor revealed its intention for reporting incidents of death or serious harm to the ODPP. We continue to build on the relationship established with the ODPP as a result of this complaint.
In addition, our office also provided four customer service training classes to approximately 40 RCIPS officers. Our training targets the areas of weakness identified by public complaints or general community concerns and will continue in 2022.
Whistleblowing
Whistleblower protection continues to be the most underused service we provide to the public, but it remains essential to good governance in both the public and private sectors. We are continuing to work on amendments to the Whistleblower Protection Act, which we hope to present to Parliament in 2022.
The number of inquiries (4) from potential whistleblowers was relatively low during 2021. We investigated two complaints with one being resolved. There is a need for greater public awareness of this important tool which will be a focus of our office once the necessary changes are made to the enabling legislation.
FOI hearing decision 93
PRESS RELEASE
An applicant under the Freedom of Information (FOI) Act sought records from the Cayman Islands Airports Authority (CIAA) relating to the licences, rights and services for which the CIAA had authorised permission at two Cayman Islands airports since 2008.
The original FOI request focused on certain records at Owen Roberts International Airport and Charles Kirkconnell International Airport related to “ground handling services”, meaning any services provided to airport operations and/or customers on the ground, including baggage handling, fueling, hangar services and aircraft maintenance.
The CIAA had previously disclosed records related to the applicant’s request but withheld specific information contained in authorisation letters sent to ground handling services providers which it said related to private commercial interests. CIAA also deferred the release of draft ground handling agreements with service providers, as these were still being completed at the time.
The Ombudsman, Sharon Roulstone, found that the commercial interest exemptions CIAA had claimed did not apply to the information in the authorisation letters and other records requested. She found much of this information was already in the public domain and that the public interest in disclosing the records was greater than the commercial interest in withholding them. However, the Ombudsman upheld the deferral of the release of draft ground handling agreements until their completion.
“The promotion of public understanding of processes and decisions of public authorities, the promotion of the accountability of public authorities and the deterrence of maladministration…will be enhanced by disclosure of the redacted information,” the decision stated.
The full text of the decision may be found here.
Onset of Covid, Omicron variant highlights importance of data protection
PRESS RELEASE
International Data Protection Day 2022
The Office of the Ombudsman noted on 28 January 2022, International Data Protection Day, that data protection legislation is more crucial to privacy and information rights than ever, given the onset of the Omicron variant of the Covid-19 virus.
“Our office has released public guidance within the past year on data protection issues related to employees’ Covid vaccination data,” said Deputy Ombudsman (Information Rights) Jan Liebaers. “We also continued to receive more reports of data breaches and complaints about data protection during 2021 – the second full year Cayman’s Data Protection Act (DPA) has been in effect.”
The Ombudsman’s office saw a 15 per cent increase in data protection queries from the public during 2021 and a more than 50 per cent increase in the number of data breaches being reported, where we were notified that personal data had been accessed, lost, altered or disclosed in an unlawful or unauthorized manner.
The DPA contains important rights for individuals, including the right to be informed about how personal data is being used. Individuals also have the right to request corrections to inaccurate personal data, to object to direct marketing and to request access to their personal data. The Act also sets rules for the use of personal data by public and private sector organizations based on eight core data protection principles. Those cover fairness, adequacy, retention and security of personal data processing, among other requirements.
The Office of the Ombudsman oversees and enforces the DPA. Individuals have the right to complain to the Ombudsman if they believe their data is not being processed in compliance with the Act. Those complaints also increased in 2021, compared to the prior year.
“Letting individuals know about their data rights and investigating complaints and data breaches is now the single busiest area within our office – particularly as more day-to-day commerce and public interactions have moved online in the wake of Covid shutdowns and work-from-home solutions,” Mr. Liebaers said.
Please visit the Ombudsman website for more information including FAQs, guidance and other resources to help you understand your data protection rights and obligations: www.ombudsman.ky/data-protection or send your questions to:
We're Hiring
The Ombudsman invites applications for the below positions
Click the below position for details:
Please submit completed application form together with your resume to