A revised version of the controversial Cayman Islands Data Protection Bill is due to come before the Legislative Assembly in 2014.
The initial bill, which was reviewed in public consultation, was eventually sent back to the drawing board after less-than-positive feedback from individuals and the business community.
The Data Protection Draft Bill, 2011, was similar to legislation approved in the 1990s by the European Union and the United Kingdom, seeking to regulate the processing of personal data to ensure those records are maintained fairly, accurately and kept from those with no right to see them. The proposal also has major implications for the territory’s Freedom of Information Law and how journalists, writers and artists can make use of personal information.
“Data protection is aimed principally at giving effect to the rights to privacy in relation to data while ensuring that certain exceptions are allowed,” stated a memorandum attached to the draft bill, which was released in early September 2013 for public comment.
The Data Protection Bill would apply to everyone in the Cayman Islands, public and private sector alike, as well as entities outside the islands that have certain data processing functions here.
The Human Rights Commission, headed by chairman Richard Coles, reviewed the bill late in 2012 and reported on it to the Legislative Assembly. Among the concerns identified by the commission was that the general complexity of the bill makes it unfriendly for users.
“The aim of the Data Protection Law is to protect individuals’ rights with regard to data specific to them; persons cannot grasp, defend, nor exercise such rights without the requisite understanding of the law itself,” according to the commission’s report. “The extent to which persons, especially small business owners, will receive assistance in adhering to this new piece of legislation was also very concerning.”
Cayman Islands Chamber of Commerce members raised several issues in 2012 during a discussion of data protection, including what new costs would be placed on local firms seeking to comply with the bill’s requirements.
Russell Richardson of the Cayman Islands Information and Communication Technology Authority served on the data protection working group.
“For medium to small businesses, there’s not that much that needs to be done,” Mr. Richardson told Chamber members. “But how you keep your data is important. Don’t put personal data in your bin that people can go through.”
Also, accidental emails that inadvertently send personal information to the wrong accounts can be a problem, he said.
Another issue identified by the commission as troubling was that the proposal had been based on European legislation and may need a more localized “Caymanian template” going forward rather than drawing from “a Jersey adaptation of a U.K. adaptation of an EU directive.”
For instance, the use of the Cayman Islands Information Commissioner’s Office as the arbiter of data protection dispute seemed “strange,” according to the commission.
“In many respects, the principles behind freedom of information and data protection are diametrically opposed,” the commission noted in its report. “One promotes dissemination of information and the other promotes privacy.”
Another matter raised by the commission involved a lack of definition with regard to what is considered to be in the “public interest” in cases where data protection to protect personal privacy is invoked.
“Implementing the Data Protection Bill without regulations or codes of practice appears to leave open the possibility for data controllers to arbitrarily apply a “public interest test,” the commission noted.
Journalism and the arts
One effect of the initial legislation was that, for the first time, a formal complaints process can be used against news organizations, as well as against other public and private entities that process personal information.
The draft bill sets out a number of exemptions from application of the law, including national security, police and court matters and certain functions of the crown. Included among those is a “special purpose” exemption for the sake of journalism, literature or art.
That means certain requirements under the initial draft of the Data Protection Bill, such as turning over someone’s personal records kept by the organization or person that holds them, would not apply to journalists or artists.
There are some caveats to that exception, according to the draft bill. The person or organization processing the personal data ensures that task is “undertaken with a view to the publication by a person of any journalistic, literary or artistic material.”
Also, according to the draft bill, the person or organization processing the information – known as the data controller – must “reasonably believe” that publication of the matter would be in the public interest and that compliance with data protection legislation is “incompatible” with the special purpose exemption.