Ministry breached data law with vaccine prize draw
(CNS): As the Office of the Ombudsman (OMB) marks International Data Protection Day this Saturday, it has revealed some of the details of its work this year in that area of its remit, including an own motion investigation (OMI) into a data protection complaint about the government’s “vaccine challenge” event, in which the ministry failed to comply with the law. During 2022 the Ombudsman was notified of 101 data breaches, received 28 complaints and dealt with 136 inquiries. It also investigated its first criminal prosecution under the law last year, which is still before the courts.
In a press release, the OMB outlined the findings of the OMI into the Ministry of Tourism’s vaccine draw, which was rolled out as a way to incentivize the public to get vaccinated against COVID-19. As part of the event, it published lists of winners’ names, but that data was sensitive as it revealed the vaccination status of those individuals.
During its investigation, the OMB concluded that the ministry did not provide an adequate privacy notice explaining the purposes for processing the data. Nor did the government officials have valid consent or any other legal basis for the publication of the data, which was also found to be excessive in relation to the stated purposes.
However, the office said that as the ministry fully cooperated with the ombudsman and ceased the publication of the sensitive personal data of the winners of the challenge, including its removal from all media and social media under its control, the case was closed and no formal report was published.
“The ombudsman made recommendations for any similar initiative in the future, including that individuals should be provided with a compliant privacy notice, that a legal basis for processing should exist, and that more privacy-friendly options be found,” the office said in the release.
The Data Protection Act contains important privacy rights for individuals, including the right to be informed about how personal data is used. Individuals also have the right to request corrections to inaccurate personal data, to object to direct marketing and to request access to their personal data.
The law also sets out how personal data can be handled by public and private sector organisations based on eight core principles, including fairness, data minimisation, adequacy, retention and security of personal data processing. The OMB concluded that the ministry breached three of these principles with the vaccine prize draw.
The Office of the Ombudsman is tasked with oversight and enforcement of the law and people have the right to complain to the office if they believe their data is not being processed legally or fairly. Businesses, organisations and public authorities must report personal data breaches to the OMB as well as to the individuals affected.
“In the coming year the Office of the Ombudsman will continue periodic outreach and public education efforts to ensure compliance with the important privacy protection requirements contained in the Act,” officials said.
Visit the OMB website for more information, including FAQs, guidance and other resources about data protection rights and obligations.
Questions can be emailed to info@ombudsman.ky
- Fascinated
- Happy
- Sad
- Angry
- Bored
- Afraid
Category: Politics, Private Sector Oversight
Hilarious – not allowed to ask peoples vaccine status when they are suffering any illness (as it could not possibly be a side effect) but no problem asking when only vaccinated were permitted to attend carnivals, travel and other social settings. The division of society as far as their freedom to move around and access certain ‘privileges’ was already visually clear when we put either an entry band on their wrists or red A on their chests.
This is not the first time that the CI Government has acted unlawfully and breached a fundamental human right. In fact, this might be one of the most harmless breaches of the law by CIG, because other breaches have had (and, in some cases, are still having) detrimental affects on the rights of Caymanians.
clown show.
except nobody is laughing.
And no one at the ministry cares either. So what is the refrain
What a waste of time and resources.
Describing Kenny to a T.
Medical data??
Every time I travel I’m asked for vaccine status.
If I give consent for my name to be published in a draw to win a free trip, and the only criteria is that I’m vaccinated, whats the problem??
It’s my data.
I gave permission.
I entered the draw.
Exactly. This decision makes no sense whatsoever.
You need to understand what valid consent is.
What am I missing?
1. I enter a Vaccination Drive contest.
2. I must be vaccinated to enter.
3. I sign an entry form which says by entering I agree for my name to be published.
4. My name is published.
Recap: I enter a vaccination contest that the single criteria is I have be vaccinated and I give permission on the entry form for my name to be published.
WHATS THE PROBLEM?
If I didnt want anyone to know my vaccination status I wouldnt have entered a vaccine contest, posed for publicity pictures and given permission in writing for my name to be published.
Some of us … My entire family got both doses by April, before the vaccine drive raffle foolishness… and we did not consent to be entered into any draw yet we were !!!
What are you missing? The facts.
And some much needed IQ points.
Kenny Bryant’s low IQ strikes again!
Change the voting laws so we can get rid of these idiots!
He’s unfortunately going to be the new McK-eew-va
And if they hadn’t published the names there would have been an outcry as to the recipients beings concealed because they were friends family and associates.
Yet no laws would have been broken 🤷♂️
No law was broken. The entrants signed consent.
No they didn’t.
Firstly, no consent given by those vaccinated much earlier, and secondly DMS, a for-profit business entity, is not the intended data controller for private HSA medical data. Using IQ Health off-island servers to host even more confidential MyHSA data was a bit racy with the GDPR too, but that for now seems to avoid scrutiny.
In fact, that’s exactly why a vaccine lottery was a very stupid idea
1. Vaccine lottery’s were happening all over the world. Not invented here.
2. It helped to get our borders open. If we hadn’t achieved 80% vaccinated population borders would still be closed.
A stupider idea would have been to sit back and do nothing.
Problem is that it didn’t even open our borders when we reached 80%. They kept us locked up for another 6 months.
And yet that is exactly what Sweden did and the bodies didn’t pile up.
Cayman is decades behind the civilized world when it comes to pretty much everything. They just don’t “get it”. They don’t get that lipstick on the Dump is not a “Waste Management System “ or “just purchase larger buses” is not a “Public Transportation System”. Data and privacy protection? It’s like explaining to an ant what it is and why it is important.
Not sure who you are but you obviously don’t inform yourself properly. Ants are extremely well organised and efficient, and their colonies operate under very strict rules which ALL members comply with.
Stupid is as Stupid does.
Law? Gambling? Only applies to those that know they can get away with it, money and power in their pocket.
Is he crying in his car again?
Hogwash. It was made clear that winners names would be announced. If they didn’t want their names published then they should not have taken part in the draw.
Exactly!
‘Vaccine Prize Draw’.
The clue is in the name.
No vaccine no entry.
And there was a statement on the entry form making it clear that by entering you were giving permission for your name to be published.
Why make drama now? Foolishness.
There was no entry form you damn fool.
Thank you!!!
It really is that simple.
Fired for what?
announcing that names would be published, getting consent from each participant to publish and then publishing?
There was complete transparency. If there wasn’t you’d still be asking for someone to be fired.
There was no consent. Fire those responsible immediately.
Where was the mechanism to opt out? We’ll wait.
Who will be fired? Who will be prosecuted? Who will be relieved of their Ministerial post?
Nada! This is only verbiage to indicate work being done. Some jobs need protecting ya know.
No one. You’re asking a question that I’m sure you know the answer too.
Brought to you by the Minister of illegal billboards.
Yeah, why is Sharon and crew not dealing with the billboard issue. God knows there have been enough complaints about that.
Just another example of more talking than thinking from the Minister of tourism, no foresight or care for actions that carry legalities
Not his fault. He came up with an idea. Do you know how many employees and legal team the government has? Sales people sell, the back team figures out what can and cannot be done. They dropped the ball, not the minister
Every entrant signed consent for their name to be published. Case closed.
No they didn’t. Case reopened.
…and it was your civic duty to get the vaccine to prevent spread, except that it didn’t.
He of illegal billboards. Hardly surprising.
It’s very strange that voters names addresses and occupations are openly published on the worldwide web. Even before GDPR it seemed a bit loosey-goosey. Anyone can export that data into a spreadsheet, buy cell numbers from telecoms and create a lobbyist database. The PPM have been using it that way for years.
Not medical data.
Vaccine Draw!!!
Must be vaccinated to WILLINGLY enter.
No one’s medical information was published.
The issue is I can know you’re vaccinated because you WILLINGLY entered a contest called Vaccine Draw and gave written permission for your name to be published.
Many of us were vaccinated months before the draw idea came around to nudge reluctant conspiracists over the line, some of us close to a year earlier. We were on 3rd and 4th booster doses by then. But we didn’t consent to being entered into a private-public DMS contest using our private HSA medical data. Show me where we consented to that. Such consent doesn’t exist.
“the data was sensitive as it revealed the vaccination status…”
It was a vaccine drive with ONE condition, MUST be vaccinated to enter!
By entering the individual knowingly revealed their status and signed a consent to publish their name.
It’s really not that hard to understand.
It isn’t hard to understand and unfortunately you don’t.
nah thats normal. It has to be a public register.
That draw was just another thing to support the bad guys. The good guys that was willing and already got the covid shots for the good of the country got nothing.
That’s why I’m registered somewhere to at I don’t live. Not giving out my address.
Isnt that illegal?
So are political billboards. Your point?