DLA Piper Intelligence

Data Protection
Laws of the World

Law

Cayman Islands
Cayman Islands

There is no comprehensive data protection framework currently in force in the Cayman Islands. The Legislative Assembly of the Cayman Islands passed the 2017 Data Protection Law (Law) on March 27, 2017, but this and any implementing regulations are not expected to take effect until the end of September 2019 (the date has been delayed from January 2019). The precise date the Law will come into force will be set by Cabinet Order.

Notwithstanding the lack of data protection legislation in force, the Cayman Islands recognizes a duty of confidentiality in certain circumstances, under both the common law and, implicitly, the provisions of the 2016 Confidential Information Disclosure Law (CIDL). The CIDL functions primarily to enumerate a non-exhaustive list of instances in which disclosure of confidential information may lawfully be made (see definitions below). The CIDL also repeals the previous Confidential Relationships Preservation Law (as revised) of the Cayman Islands, which regulated disclosures of confidential information by professional persons, and provided for criminal sanctions, among other penalties, for certain breaches of confidentiality on an extra-territorial basis.

Last modified 28 Jan 2019
Law
Cayman Islands

There is no comprehensive data protection framework currently in force in the Cayman Islands. The Legislative Assembly of the Cayman Islands passed the 2017 Data Protection Law (Law) on March 27, 2017, but this and any implementing regulations are not expected to take effect until the end of September 2019 (the date has been delayed from January 2019). The precise date the Law will come into force will be set by Cabinet Order.

Notwithstanding the lack of data protection legislation in force, the Cayman Islands recognizes a duty of confidentiality in certain circumstances, under both the common law and, implicitly, the provisions of the 2016 Confidential Information Disclosure Law (CIDL). The CIDL functions primarily to enumerate a non-exhaustive list of instances in which disclosure of confidential information may lawfully be made (see definitions below). The CIDL also repeals the previous Confidential Relationships Preservation Law (as revised) of the Cayman Islands, which regulated disclosures of confidential information by professional persons, and provided for criminal sanctions, among other penalties, for certain breaches of confidentiality on an extra-territorial basis.

Last modified 28 Jan 2019
Definitions

Definition of personal data

There is no definition of “personal data” contained in any legislation currently in force.

In common law, information is generally regarded as “confidential” if it has a necessary quality of confidentiality and has been either communicated or become known in such circumstances as give rise to a reasonable expectation of confidence; for example if information is obtained in connection with certain professional relationships, if it is obtained by improper means, or if it is received from another party who is subject to a duty of confidentiality.

Definition of sensitive personal data

There is no definition of “sensitive personal data” contained in any legislation currently in force.

Last modified 28 Jan 2019
Authority

There is currently no Data Protection Authority or similar regulatory body in the Cayman Islands. However, when the Law takes effect, the Information Commissioner - who currently oversees the Freedom of Information Law - will be charged with implementing and enforcing the Law.

Last modified 28 Jan 2019
Registration

N/A (see National Data Protection Authority section).

Last modified 28 Jan 2019
Data Protection Officers

There is currently no requirement to appoint a data protection officer.

Last modified 28 Jan 2019
Collection & Processing

There are no statutory provisions currently in force that specifically address the collection and processing of personal information.

Under common law, however, it is generally a breach of confidence to misuse or threaten to misuse confidential information. The concept of misuse is a broad one, but will often include any unauthorized disclosure, examination, copying or taking of confidential information. The precise scope of the term will depend largely on the specific circumstances, including the relevant relationship and the nature of the information.

Last modified 28 Jan 2019
Transfer

Absent a breach of an obligation of confidentiality under common law, there is no statutory regulation of the transfer of information from or within the Cayman Islands. The Cayman Islands Monetary Authority (CIMA), has issued guidance in relation to the outsourcing of core functions by regulated entities to third party service providers that impacts the transfer, storage and processing of customer confidential information.

Last modified 28 Jan 2019
Security

There are no statutory provisions in force requiring specific measures be taken to protect against or prevent disclosure, or other unlawful use of confidential information. However, a person who misuses or divulges confidential information (deliberately or otherwise) may be liable under common law.

Last modified 28 Jan 2019
Breach Notification

There are no general requirements to notify any authority or any other person of a breach of confidentiality.

Last modified 28 Jan 2019
Enforcement

A breach of the duty of confidentiality may give rise to a claim for, among other remedies, damages and / or an injunction. These remedies are sought through and enforced by Cayman Islands courts.

Last modified 28 Jan 2019
Electronic Marketing

There are no specific restrictions addressing the use of confidential information in electronic marketing beyond those generally applicable to the use of confidential information.

Last modified 28 Jan 2019
Online Privacy

There are no specific restrictions addressing online privacy beyond those generally applicable to the use of confidential information.

Last modified 28 Jan 2019
Contacts
Nick Bullmore
Nick Bullmore
Partner
T +1 345 749 2000
Graham Stoute
Graham Stoute
Counsel
T +1 345 749 2014
Last modified 28 Jan 2019