The Ombudsman has ordered St. Ignatius Catholic School to destroy all copies of a recording of a meeting with a member of staff, finding that the school made the recording without a legal basis under the Cayman Islands Data Protection Law (2017). The Ombudsman’s order also made several recommendations on how the school could improve data protection measures related to its employees.   

The Ombudsman expressed concern about the meeting, in that consent was not an appropriate legal basis for the recording as argued by the school, the employee was not initially told the recording was taking place and then did not receive a copy of the recording within the statutory 30 days.   

“The Data Protection Law requires that when processing personal data, including the recording of a conversation, the person being recorded must be aware the processing is taking place and the reason for it,” said Sandy Hermiston, Cayman Islands Ombudsman. “It is also crucially important that consent is only used when appropriate, but not where there is a significant imbalance, such as between an employer and an employee.”  

Under the law, consent must also be freely and knowingly given, not implied. Ms. Hermiston said school officials did not meet that requirement in this instance and that it appears the employee was never told why the recording was taken.    

“Even asking someone ‘is it OK if I record this?’ does not pass muster with the law, if they are not told the reasons it is happening,” said Deputy Ombudsman Jan Liebaers. “In this instance, seeking consent for the recording after the meeting had already started and then merely asking for the employee’s permission to record – without informing her of the reasons – is not what the Data Protection Law requires.”   

The full text of the enforcement order can be found here: https://ombudsman.ky/images/pdf/DP_Enforcement_Order_202000820_-_Exec_Summary_Final.pdf

As with all enforcement orders made under the Data Protection Law, the entity against which the order is made has 45 days to seek judicial review of the Ombudsman’s decision. 

Anyone with questions about Cayman’s Data Protection Law, which took effect on 30 September 2019, should go to our website www.ombudsman.ky for further information. Data protection complaints and/or notifications can be made to the Ombudsman’s office at 946-6283 or via email at [email protected].