Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Cayman Islands: Ombudsman issues order against Registrar for data processing violations

The Office of the Ombudsman ('the Ombudsman') issued, on 7 August 2020, an enforcement order ('the Order') against the Registrar of Companies ('the Registrar') following its investigation into a complaint asserting that the Registrar did not have a legal basis to process certain personal data requested on the Registrar's online payment platform relating to non-registrable persons. In particular, the Order notes that the complainant had experienced issues while completing an application for the Beneficial Ownership Register ('BOR') for a limited company using the Cayman Business Portal ('CBP'). Specifically, the Order highlights that the complainant's application was rejected on the basis of not having provided the details of two required individuals, though the Companies Law (2020 Revision) ('the Companies Law') requires that only registrable persons be entered in the BOR, and as such the complainant believes that there is no legal requirement for the details of the two persons to be provided. Moreover, the Order notes the complainant's argument that, under the Data Protection Law, 2017 (Law 33 of 2017), personal data must only be obtained for one or more specified lawful purposes and must not be further processed in any incompatible manner.

In this respect, the Order concludes that the Registrar did not have a legal basis for processing personal data of non-registrable individuals in a blanket fashion and must cease gathering and further processing such data. Furthermore, the Order also requires that the Registrar make available a privacy notice to inform individuals who submit personal data using the online platform of the purpose for which this information will be processed, and to develop policies and procedures for requesting information the Companies Law and make them available to the public.

You can read the Order here.