From: Cayman Islands Human Rights Commission [HRC]

To: Secretary to the Data Protection Working Group c/o Cabinet Office

Government Administration Building

133 Elgin Avenue

Box 105 Grand Cayman KY1-9000

CAYMAN ISLANDS

18 November 2014

Via Email: [email protected]

Dear Secretary,

As you will be aware following the release of the Data Protection Bill in 2012 (“the 2012 Bill”), the Data Protection Working Group (“the DPWG”) facilitated a presentation to the Human Rights Commission (“the HRC”) regarding the content of the 2012 Bill. Subsequently, the HRC reviewed the 2012 Bill and provided extensive feedback in November 2012 (attached for ease of reference).

The right to private and family life is a basic fundamental human right that applies to all individuals in the Cayman Islands and greatly contributes to our civilised legal system. Whilst not an absolute right, such a right can easily be breached if an interference was not reasonably justifiable in a democratic society. The HRC reiterates that the Bill of Rights imposes a positive obligation on the Cayman Islands Government to ensure that the laws provide adequate protection against the unjustified disclosure of personal information.

The HRC has noted with interest the release of a revised Data Protection Bill (“the Revised Bill”) and, as such, has reviewed the same as a matter of follow up. During this review the HRC also conducted a comparison of the two Bills as they relate to the feedback provided by the HRC in

2. The HRC has noted that while some of the concerns were addressed, in general many were not. Amongst those include the definition of “sensitive personal data” still not including financial information; and the matter of issuing a certificate of exemption for national security reasons remaining with the Governor in her discretion alone and not with the Governor acting together with or on the advice of National Security Council.

Both draft Bills make express reference to the 1995 European Directive 95/46/EC (“the 1995 Directive”) and have been drafted in order to comply with its requirements. To a great extent the draft Bills are based in the English and Welsh Data Protection Act 1998 (“the DPA 1998”) but with certain provisions omitted or recast and with some significant changes. This legislative background creates a number of significant difficulties.

As the DPWG are aware, the 1995 Directive is outdated and has been subject to significant criticism.   At the time it was created the internet was in its infancy and there were no cloud computing or social networks.   Similarly, there have been huge advances in information technology and globalisation which have impacted data retention since 1995. As a result, in 2012, the European Commission announced a new draft legislative package to regulate data protection. It is intended that this will become law at some stage in 2015. The impact of this will be that compliance with the 1995 Directive will become meaningless when the new European law takes effect. The HRC notes that the DPWG have attempted to incorporate some of the anticipated amendments to the law but, regardless of the success of these attempts, it is clear that the Revised Bill will need to be redrafted once the new European law takes effect if Cayman wishes to comply with it.

Regardless of these concerns, the DPA 1998 itself has been subject of much criticism. It is convoluted and complex legislation even for lawyers.   Indeed it was described by the Court of Appeal of England and Wales as “inelegant and cumbersome”. As expressed during the presentation, the HRC remains concerned about the way in which this legislation is drafted and it is envisaged that the broader community will have great difficulty in understanding, and therefore fulfilling their duties, under the Revised Bill should it become law.

The HRC notes that the DPWG have attempted to simplify the Revised Bill compared to the DPA 1998, however, the HRC is extremely concerned that in doing so the Revised Bill in fact removes many of the fundamental protections contained in the DPA 1998 and thereby creates significant human rights concerns.

Section 49 the Revised Bill removes the “due diligence” defence provided in the similarly-worded s.40 of the DPA 1998. The HRC is unsure of the reason for this.

Section 50 of the Revised Bill requires compliance with the Information Commissioner’s Order within the time specified by the Commissioner. No time limit is placed on this power. Conversely, in s.40 of the DPA compliance is not required until after any appeal has been determined and in any event always allows at least 7 days for compliance.

Section 51 (and other sections) of the Revised Bill provide for a sentence of imprisonment of up to 5 years for breach of its terms (in contrast to fines only under the DPA 1998).   Whilst this is a draconian penalty, it is not, in of itself, a human rights concern, until one considers the way in which the rest of the Revised Bill’s provisions are drafted. In particular, the HRC notes the terms of s.52 – 53 of the Revised Bill.

Instead of providing a right of appeal, an individual or entity aggrieved by the Commissioner’s decision is required to bring Judicial Review proceedings. This is an extremely regrettable provision. It means that the ‘appeal’ process in Cayman will be expensive and time-consuming. Lawyers will almost certainly be required. It also, effectively, introduces a reverse burden of proof requiring the aggrieved applicant to demonstrate that the Commissioner has acted contrary to the principles of lawful administrative action. For example, by requiring the applicant to show that the Commissioner has been ‘Wednesbury unreasonable’. The HRC urges the DPWG to reconsider this provision of the Revised Bill.

More worryingly, s.53 of the Revised Bill provides that where a person has failed to comply with an enforcement order the Commissioner may certify that in writing to the Summary Court and that person “shall be deemed to have committed an offence”. This is a quite extraordinary provision. It effectively allows the Commissioner, acting as prosecutor, to certify guilt and send a person for sentencing – removing the right to a trial. This provision is fundamentally contrary to all accepted international human rights norms, various international treaties and Cayman’s own Constitution. The HRC urges the DPWG to remove this provision from the Revised Bill and introduce the right to a trial for those accused of a breach of the law.   (The HRC also notes that the Revised Bill purports to create an offence under section 53 by reference to section 24 of the Summary Jurisdiction Law (2006 Revision). Section 24 of that Law deals with the duties of police constables and we infer that this is an error. For the reasons articulated above the HRC obviously suggests removal of this provision of the Revised Bill in any event.)

S.60 of the Revised Bill allows the Commissioner to impose monetary penalties of up to $250,000 if satisfied ‘on the balance of probabilities’ that there has been a contravention of the law. It removes the protections in the similarly-worded s.55A and B of the DPA 1998 that allow a person to be notified of the intention to impose such a penalty and make representations or appeal the decision first. The HRC invites the DPWC to reintroduce this safeguard from the DPA 1998.

The HRC notes the terms of s.65 of the Revised Bill dealing with service of orders, notices or directions by the Commissioner. These allow these important documents to be “served” without requiring any proof that the intended recipient has received them, including by serving a person “appearing to be resident” at premises or just affixing a document to the premises.   Given the significant fines and draconian punishments alluded to above, the Revised Bill should require there to be proof of actual service before criminal proceedings or fines are imposed.

Finally, the HRC would have hoped to have seen more effort placed on public education during this second consultation. Whereas the obligation of other legislation (such as Freedom of Information Law) have been limited to the public service, the Data Protection Bill will impact the community at large and, as such, it is imperative that persons understand this highly significant legislation.

The HRC continues to commend the DPWG and the Cayman Islands Government for their work in this area and hopes this feedback will be of assistance to the advancement of the legislation.

Yours sincerely,

James Austin-Smith

Acting Chairman, Human Rights Commission

att:       Response to Draft Data Protection Bill 02 11 12