DoA ordered to stop taking personal info
(CNS): The Department of Agriculture (DoA) has found itself on the wrong side of the Data Protection Law and is now facing an order from the Office of the Ombudsman to stop taking the personal data it has been collecting from customers without a legal basis and to delete it. Following a complaint last year that the department was taking names, residential and email addresses, as well as phone numbers from customers making simple retail purchases, such as plants, the office took up the case.
Ombudsman Sandy Hermiston found that the DoA had no privacy notification process to inform its customers about who was processing the information or the specific purposes for which it was being taken. Her office also found that the department had no legal basis for processing this data and that collecting it in the first place was unnecessary and excessive.
During the ombudsman’s investigation, the DoA said it was collecting the personal data from retail clients “under a mandate from the Ministry of Finance” in order to “ensure that individuals receive a correctly issued Cayman Islands Government receipt for every transaction”.
However, in the summary of the investigation Hermiston said, “When we contacted the Ministry of Finance, it stated that it had no record of the mandate referred to by the DoA. The DoA then conceded that the mandate did not exist, and that it did not have a legal basis to collect and process the personal data requested from its retail clients.”
In light of the findings, the department was ordered to stop collecting the data and delete what it already had. On 30 March the DoA requested 31 days to take steps to address the non-compliance but so far this has not happened.
“To date the DoA has not changed the contravening data collection practices, and it continues to require personal data from retail customers who are making a purchase,” the ombudsman wrote. As a result, an enforcement order has now been issued.
Explaining the law, Hermiston said that for every transaction, in either the public or private sector, only the minimum personal data needed for a specified purpose should be collected. “Customers have a right to know who is processing their information, for what purpose, and all processing must be conducted fairly and legally,” she said.
See the executive summary of the case in the CNS Library.
See here for more information about Cayman’s Data Protection Act.
Data protection complaints can be made to the Ombudsman’s office at
946-6283 or email info@ombudsman.ky.
- Fascinated
- Happy
- Sad
- Angry
- Bored
- Afraid
Category: Government oversight, Politics
More than likely a classic case of employees following outdated procedures and never bothered to ask why they are doing something and definitely don’t think for themselves.
Butterfield now has a new company doing its cybersecurity. I had a transfer that required additional verification for some unknown reason, and so somebody called me from Halifax asking me for all sorts of personal info including my login (!!!!) .. I refused and called my local Butterfield, but of course nobody there even understands why I would find this alarming!!!!! They just say its a new procedure and leave it at that! WOW.
Butterfield has a ‘support services’ office in Halifax – just googled it, so no different than calling your ‘local’ Butterfield, it’s still Butterfield! Saying that it does annoy me about being asked for my online banking ID over the phone.
Understood. But anybody could call purporting to be from that Halifax office and ask you for personal data. How do you verify who the person is??
In my experience the Ombudsman is doing an amazing job. She was given the task of managing Cayman’s new DP regime in addition to the regular job of investigating maladministration in Government…which as you can imagine is more than a full-time job. The Ombudsman’s DP website is one of the best sources of information out there on Cayman’s DP regime, and I know several lawyers who use it to research and advise on DP issues. The Ombudsman can issue an enforcement order, ie a requirement to comply with the DP Act, and if that is not effective, refer the matter to the DPP for public prosecution. Unfortunately, in this case, the perpetrator is a Govt dept so if they don’t comply, you can complain to the Ombudsman, and they issue an enforcement order…etc! Bottom line – Ombudsman good, CIG bad.
Genuine questions here;
Why would they require these details in the first place?
And what prevents anyone from giving false information? Like, why does it matter?
I have been buying from DOA for years and they have only asked for my number when necessary like when I needed them to call me back. They put my name on the receipt but that is it. They have never asked for my PO Box except when filling out farmer’s forms so I’m a little perplexed on this.
However, the hospital is another story. I was pregnant as soon as I had an ultrasound. They even talked about a procedure I had done.
And where is the disciplinary action taken against the HOD? The dept was doing something illegal, and when asked about it, they lied. Only when the Min of Finance confirmed that there was no mandate did DOA tell the truth.
What example of World Class are you setting in the Civil Service?
We are waiting Mr. Franz…..
How about they look at the post office. They do the same, the amount of detail, including copying your driver’s license when you pick up a package is disgraceful.
Tried to push back and they said its required. It is really not.
They won’t even give me my wife’s mail! But they’ll put our labeled mail in someone else’s PO!
The Ombudsman is not proactive in nature. Sandy wasn’t hired to ruffle feathers…she’s a garden gnome placeholder. If you want something changed you’ll have to make a complaint…and wait.
Many of the DOA’s employees own and operate farming/ranching/gardening businesses on the side
The DOA regulates and supports the Agricultural Sector
What if, for example, employees of the CIG Company Registry owning/operating company registration and management businesses on the side?
I’m not sure what your question is.
For your benefit – insert the single word “were” BEFORE owning/operating in the question
…and wait ….and wait …and wait.
Why are civil servants and government departments allowed to continually break various laws with impunity? Is it so that we can truly be #thirdworldclass?
I think it is because we are corrupt, and do not even see it. #Legge was right.
‘As a result, an enforcement order has now been issued’
Oh my aching sides. And who exactly will carry out this ‘enforcement’?
There is NO standardization of practices across Government Departments. Rules are made-up by staff, depending on the shift or day of the week. One person doesn’t know what the other is doing and and worse between departments – when a matter is multi-departmental.
Processes are backwards and unnecessarily time-consuming (ever had a prescription filled at West Bay Clinic?). But one thing they ALL have in common is having no respect for their customers’ time!! Who cares if you have to spend most of your day in a line? Certainly not Civil Service staff!
This is the “world-class” CS which the Deputy Governor boasts about!!
Morons in charge!!
The Cayman registry used to release birth and death certificates to anyone who applied. Hope this has now changed
Confidentiality medical or otherwise has always been an issue here, where everyone believes they have a right to know everything so they can gossip.
No in Cayman gives a shit about the Data Protection Act.
This is the form a local company demands its potential customers use to order a t-shirt: https://form.jotform.com/advantageci/advantage-printing-estimate-request Note, you cannot order over the phone.
ALT’s store asked for my name, phone number and email address (??) for a quote for the price of some nails over the phone.
One of the grocery stores had a sign up sheet for its loyalty programme and I had to advise the cashier that I would not sign and that they should put away the clipboard with the pages of people’s phone numbers, emails, and physical addresses.
Went to pick up a prescription at one of the local pharmacies. The pharmacist could not be bothered to end her gossip session on the work phone and yelled from behind the counter for my name, age and prescription medicine. She was annoyed when I would not yell my personal and medical information back to her and instead walked up to the counter and whispered it, interrupting her phone call.
These are just a few examples. What exactly does the Ombudsman do in consideration of the money poured into that office? No proactive investigations, no assistance to the public, no public relations, just sitting in her ivory tower without a care in the world about the rampant FOI abuses, maladministration, police abuses and data protection failures in Cayman. That office is almost as bad as OfReg, however, I do not think all the male staff drive trucks there.
My only recourse is to shop elsewhere or do without in most cases because the government does not care and none of the regulatory or protection agencies do anything either, despite being paid small fortunes to do so.
I haven’t even gotten into the cost of the items in the above examples. It would seem the only way I may be able to obtain these items at decent prices is to move away and buy them where there are laws against piracy.
I too have had a clerk shout my personal details across the room.
Here’s even better; (if it is allowed)
Years ago a ‘friend’ used to work at the GT dental clinic (long gone now). She had access to all medical records at HSA and would periodically check into any of those people that she wanted to get info on. She once asked me if I wanted any info on the ex-wife of a man that merely asked me out on a date once.. I asked her why in the world I would want to know anything about her and left it at that. I hope I made her feel stupid.
I hate when AL T’s asks for my number. Does that mean I can make a return w/o the receipt?? It makes you think you might miss out on something if you don’t give it. I am a frequent customer but purchases are never big enough for me to be treated special so I ‘opt out’ and they don’t mind.
British Caymanian Insurance purports to have been asked by CIMA to do complete AML and source of funds for their paid-up Motor Insurance policy holders by the end of the month. It can’t wait until the annual in-person renewal date. Right now. In the onset of hurricane season. What kind of BS is this? Do these people understand that paying the annual insurance premium is a one-way street? How and why would someone want to launder what, a $1000 annual premium through all of that effort?!? Cayman’s institutions are not making sense – using dubious AML scare-tactics to sniff out household net worth for their robo-callers. It has nothing to do with AML, with seemingly no GDPR awareness….and the banks have out-sourced to “compliance firms” in North America that don’t even recognise GDPR.
Interesting. A local bank requested that I provide them with an updated job letter. Following which I began receiving unsolicited approvals for loans and credit cards from the bank. I honestly cannot remember authorizing the bank to use my AML data for its marketing purposes.
Hmmm, yes very interesting!