Ombudsman issues data protection enforcement order against Department of Agriculture

The Ombudsman has ordered the Department of Agriculture (DoA) to stop collecting personal data from customers purchasing retail goods and to delete any personal data collected without a legal basis. The DoA must also provide a privacy notice when collecting personal data.

A member of the public submitted a complaint stating that the DoA was unnecessarily collecting personal data from individuals purchasing retail goods such as plants and trees. The information collected included the person’s name, street address, postal address, email address and telephone contact.

The Ombudsman found the DoA had no privacy notification process to inform its customers who was processing the information or the specific purposes for which that information was being processed. She also found the DoA had no legal basis for processing the personal data of its customers and that collecting the data listed above for a simple retail purchase was unnecessary and excessive. The full text of the order can be found here: https://ombudsman.ky/images/pdf/decisions/dp_decisions/DP_Enforcement_Order_DoA_202000892.pdf

The DoA was given 30 days to action the required changes. As with all enforcement orders made under the Data Protection Act, the entity against which the order is made has 45 days to comply or seek judicial review of the Ombudsman’s decision.

In every transaction, whether in the public or private sector, a data controller should collect only the minimum personal data needed for a specified purpose. Customers have a right to know who is processing their information, for what purpose, and all processing must be conducted fairly and legally.

Anyone with questions about Cayman’s Data Protection Act, should go to our website www.ombudsman.ky for further information. Data protection complaints can be made to the Ombudsman’s office at 946-6283 or via email at info@ombudsman.ky.