News
Ombudsman issues data protection enforcement order against Registrar of Companies
The Ombudsman has ordered the Registrar of Companies to stop collecting personal data from individuals who hold company shares or voting rights in circumstances where it has no legal basis to do so.
The Ombudsman was made aware via a complaint that the Registrar requested personal information about individuals who were 1% shareholders in a company. Under the Companies Law (2020 Revision), a person who would be required to provide information for the company register - a beneficial owner - is someone who holds more than 25% of shares or voting rights in a company, or any individual who is able to vote to remove a majority of the company’s board of directors.
The Ombudsman noted that there may be specific circumstances where personal information could be requested about someone holding fewer than 25% of a company’s shares, but the Registrar cannot apply a “blanket” requirement to do so without establishing a legal basis and informing the person of the reason for the data collection.
“The Registrar was using a blunt instrument to collect data on all company shareholders rather than the lancet the law requires,” said Ombudsman Sandy Hermiston. “All entities collecting personal data must respect the data protection principles, which include the requirement that processing personal data must have a legal basis and that the person whose data is being processed is informed of the purposes for the processing..”
In addition to the order to stop processing data of individuals who are not considered registerable shareholders under the Companies Law, the Registrar was ordered to develop a suitable privacy notice to include on the Cayman Business Portal where companies are registered. The Ombudsman also recommended that the Registrar develop a policy setting out fair and reasonable criteria in circumstances where additional data collection for non-registerable shareholders is sought.
As with all enforcement orders made under the Data Protection Law, the entity against which the order is made has 45 days to seek judicial review of the Ombudsman’s decision.
The decision is not yet available on our website but will be posted shortly. For your ease, we have attached a copy of the order with the press release.
Anyone with questions about Cayman’s Data Protection Law, which took effect on 30 September 2019, should go to our website www.ombudsman.ky for further information. Data protection complaints can be made to the Ombudsman’s office at 946-6283 or via email at info@ombudsman.ky.
