Ministry breached data law with vaccine prize draw

| 27/01/2023 | 58 Comments
Dawn Bodden, winner of the DMS prize draw, with Tourism Minister Kenneth Bryan, Adrienne Politowicz from DMS and Premier Wayne Panton in November 2021

(CNS): As the Office of the Ombudsman (OMB) marks International Data Protection Day this Saturday, it has revealed some of the details of its work this year in that area of its remit, including an own motion investigation (OMI) into a data protection complaint about the government’s “vaccine challenge” event, in which the ministry failed to comply with the law. During 2022 the Ombudsman was notified of 101 data breaches, received 28 complaints and dealt with 136 inquiries. It also investigated its first criminal prosecution under the law last year, which is still before the courts.

In a press release, the OMB outlined the findings of the OMI into the Ministry of Tourism’s vaccine draw, which was rolled out as a way to incentivize the public to get vaccinated against COVID-19. As part of the event, it published lists of winners’ names, but that data was sensitive as it revealed the vaccination status of those individuals.

During its investigation, the OMB concluded that the ministry did not provide an adequate privacy notice explaining the purposes for processing the data. Nor did the government officials have valid consent or any other legal basis for the publication of the data, which was also found to be excessive in relation to the stated purposes.

However, the office said that as the ministry fully cooperated with the ombudsman and ceased the publication of the sensitive personal data of the winners of the challenge, including its removal from all media and social media under its control, the case was closed and no formal report was published.

“The ombudsman made recommendations for any similar initiative in the future, including that individuals should be provided with a compliant privacy notice, that a legal basis for processing should exist, and that more privacy-friendly options be found,” the office said in the release.

The Data Protection Act contains important privacy rights for individuals, including the right to be informed about how personal data is used. Individuals also have the right to request corrections to inaccurate personal data, to object to direct marketing and to request access to their personal data. 

The law also sets out how personal data can be handled by public and private sector organisations based on eight core principles, including fairness, data minimisation, adequacy, retention and security of personal data processing. The OMB concluded that the ministry breached three of these principles with the vaccine prize draw.

The Office of the Ombudsman is tasked with oversight and enforcement of the law and people have the right to complain to the office if they believe their data is not being processed legally or fairly. Businesses, organisations and public authorities must report personal data breaches to the OMB as well as to the individuals affected.

“In the coming year the Office of the Ombudsman will continue periodic outreach and public education efforts to ensure compliance with the important privacy protection requirements contained in the Act,” officials said.

Visit the OMB website for more information, including FAQs, guidance and other resources about data protection rights and obligations.

Questions can be emailed to info@ombudsman.ky


Share your vote!


How do you feel after reading this?
  • Fascinated
  • Happy
  • Sad
  • Angry
  • Bored
  • Afraid
Print Friendly, PDF & Email

Tags: , , , , ,

Category: Politics, Private Sector Oversight

Comments (58)

Trackback URL | Comments RSS Feed

  1. Anonymous says:

    Hilarious – not allowed to ask peoples vaccine status when they are suffering any illness (as it could not possibly be a side effect) but no problem asking when only vaccinated were permitted to attend carnivals, travel and other social settings. The division of society as far as their freedom to move around and access certain ‘privileges’ was already visually clear when we put either an entry band on their wrists or red A on their chests.

    9
    4
  2. Anonymous says:

    This is not the first time that the CI Government has acted unlawfully and breached a fundamental human right. In fact, this might be one of the most harmless breaches of the law by CIG, because other breaches have had (and, in some cases, are still having) detrimental affects on the rights of Caymanians.

    10
    3
  3. Anonymous says:

    clown show.
    except nobody is laughing.

    30
  4. Anonymous says:

    What a waste of time and resources.

    37
    4
  5. Anonymous says:

    Medical data??
    Every time I travel I’m asked for vaccine status.

    If I give consent for my name to be published in a draw to win a free trip, and the only criteria is that I’m vaccinated, whats the problem??

    It’s my data.
    I gave permission.
    I entered the draw.

    29
    17
  6. Anonymous says:

    What am I missing?
    1. I enter a Vaccination Drive contest.
    2. I must be vaccinated to enter.
    3. I sign an entry form which says by entering I agree for my name to be published.
    4. My name is published.

    Recap: I enter a vaccination contest that the single criteria is I have be vaccinated and I give permission on the entry form for my name to be published.
    WHATS THE PROBLEM?

    If I didnt want anyone to know my vaccination status I wouldnt have entered a vaccine contest, posed for publicity pictures and given permission in writing for my name to be published.

    20
    13
  7. Anonymous says:

    Kenny Bryant’s low IQ strikes again!

    Change the voting laws so we can get rid of these idiots!

    48
  8. Anonymous says:

    And if they hadn’t published the names there would have been an outcry as to the recipients beings concealed because they were friends family and associates.

    22
    20
    • Anonymous says:

      Yet no laws would have been broken 🤷‍♂️

      17
      4
      • Anonymous says:

        No law was broken. The entrants signed consent.

        11
        11
        • Anonymous says:

          No they didn’t.

          13
          3
        • Anonymous says:

          Firstly, no consent given by those vaccinated much earlier, and secondly DMS, a for-profit business entity, is not the intended data controller for private HSA medical data. Using IQ Health off-island servers to host even more confidential MyHSA data was a bit racy with the GDPR too, but that for now seems to avoid scrutiny.

    • Anonymous says:

      In fact, that’s exactly why a vaccine lottery was a very stupid idea

      46
      3
      • Anonymous says:

        1. Vaccine lottery’s were happening all over the world. Not invented here.
        2. It helped to get our borders open. If we hadn’t achieved 80% vaccinated population borders would still be closed.

        A stupider idea would have been to sit back and do nothing.

        11
        26
        • Anonymous says:

          Problem is that it didn’t even open our borders when we reached 80%. They kept us locked up for another 6 months.

          20
          2
        • Anonymous says:

          And yet that is exactly what Sweden did and the bodies didn’t pile up.

  9. Anonymous says:

    Cayman is decades behind the civilized world when it comes to pretty much everything. They just don’t “get it”. They don’t get that lipstick on the Dump is not a “Waste Management System “ or “just purchase larger buses” is not a “Public Transportation System”. Data and privacy protection? It’s like explaining to an ant what it is and why it is important.

    41
    6
    • Anonymous says:

      Not sure who you are but you obviously don’t inform yourself properly. Ants are extremely well organised and efficient, and their colonies operate under very strict rules which ALL members comply with.

  10. Gray Matter says:

    Stupid is as Stupid does.

    24
    2
  11. Anonymous says:

    Law? Gambling? Only applies to those that know they can get away with it, money and power in their pocket.

    14
    2
  12. Anonymous says:

    Is he crying in his car again?

    31
    2
  13. Anonymous says:

    Hogwash. It was made clear that winners names would be announced. If they didn’t want their names published then they should not have taken part in the draw.

    49
    20
    • Anonymous says:

      Exactly!
      ‘Vaccine Prize Draw’.
      The clue is in the name.
      No vaccine no entry.
      And there was a statement on the entry form making it clear that by entering you were giving permission for your name to be published.
      Why make drama now? Foolishness.

      9
      10
    • Anonymous says:

      Thank you!!!
      It really is that simple.

      9
      1
    • Anonymous says:

      Fired for what?
      announcing that names would be published, getting consent from each participant to publish and then publishing?
      There was complete transparency. If there wasn’t you’d still be asking for someone to be fired.

      5
      4
    • Anonymous says:

      Where was the mechanism to opt out? We’ll wait.

      10
      1
  14. Anonymous says:

    Who will be fired? Who will be prosecuted? Who will be relieved of their Ministerial post?

    43
    13
  15. Anonymous says:

    Brought to you by the Minister of illegal billboards.

    80
    2
    • Anonymous says:

      Yeah, why is Sharon and crew not dealing with the billboard issue. God knows there have been enough complaints about that.

      35
  16. Anonymous says:

    Just another example of more talking than thinking from the Minister of tourism, no foresight or care for actions that carry legalities

    53
    3
    • Anonymous says:

      Not his fault. He came up with an idea. Do you know how many employees and legal team the government has? Sales people sell, the back team figures out what can and cannot be done. They dropped the ball, not the minister

      5
      24
  17. Anonymous says:

    He of illegal billboards. Hardly surprising.

    55
    1
  18. Anonymous says:

    It’s very strange that voters names addresses and occupations are openly published on the worldwide web. Even before GDPR it seemed a bit loosey-goosey. Anyone can export that data into a spreadsheet, buy cell numbers from telecoms and create a lobbyist database. The PPM have been using it that way for years.

    41
    5
    • Anonymous says:

      Not medical data.

      11
      1
      • Anonymous says:

        Vaccine Draw!!!
        Must be vaccinated to WILLINGLY enter.
        No one’s medical information was published.
        The issue is I can know you’re vaccinated because you WILLINGLY entered a contest called Vaccine Draw and gave written permission for your name to be published.

        2
        3
        • Anonymous says:

          Many of us were vaccinated months before the draw idea came around to nudge reluctant conspiracists over the line, some of us close to a year earlier. We were on 3rd and 4th booster doses by then. But we didn’t consent to being entered into a private-public DMS contest using our private HSA medical data. Show me where we consented to that. Such consent doesn’t exist.

      • Anonymous says:

        “the data was sensitive as it revealed the vaccination status…”

        It was a vaccine drive with ONE condition, MUST be vaccinated to enter!
        By entering the individual knowingly revealed their status and signed a consent to publish their name.
        It’s really not that hard to understand.

        2
        4
    • Anonymous says:

      nah thats normal. It has to be a public register.

      1
      4
      • Anonymous says:

        That draw was just another thing to support the bad guys. The good guys that was willing and already got the covid shots for the good of the country got nothing.

    • Anonymous says:

      That’s why I’m registered somewhere to at I don’t live. Not giving out my address.

      9
      2

Leave a Reply to Anonymous Cancel reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.