Knowledge

In November 2021 the decision of the Grand Court of the Cayman Islands ("Cayman") in RB440 Properties Ltd v The Proprietors, Strata Plan No 22 ("Beachcomber Case") dealt with the right of one of the members of the Strata to be given information by the strata corporation about other members in light of the provisions of the Cayman Islands Data Protection Act (2021 Revision) (the "DPA")

A "Strata" is a form of real property ownership where self-contained units have shared common areas on a single parcel of land. In order to 'manage' those common areas and to ensure that owners' properly contribute to maintenance and insurance, a corporation is established which functions to ensure that the rules (Bye-Laws) of the Strata are implemented and complied with. Each owner is a member of the strata corporation. An Executive Committee of members ("Ex-Co") is elected to ensure that the strata corporation's duties and rights are implemented. In Cayman the Strata Titles Registration Act (2013 Revision) (the "Act") establishes the strata regime.

In the Beachcomber Case the Bye-Laws allowed any member of the strata corporation to inspect any book or account or document whatsoever that were held by the Ex-Co. RB440 Properties Ltd (the "Owner") requested from the Ex-Co of The Proprietors, Strata Plan No 22 ("Strata 22") documents that the Owner believed that the Ex-Co had that would enable the Owner to determine whether the Ex-Co of Strata 22 was doing its' job properly and running Strata 22 efficiently. Strata 22 said that the documents requested by the Owner contained personal data i.e. data  relating  to  a  living  individual  who  can  be  identified, of other members of Strata 22 so it could not give the documents to the Owner without complying with the DPA.

Examples  of  some  of  the  types  of  personal  information  of members that  a strata  corporation  manages include:   (i) name, address and  phone  number;   (ii) banking  or  credit  card  information;   (iii) emergency  contact  information;   (iv)  owner/tenant’s  insurance  particulars;   (v) names  of  family  members living  with the borrower  or  occupying  the  strata lot;  and (vi)  debts  owed  to the strata  corporation by  an  owner.

The Court in the Beachcomber Case found that the DPA did apply as no exemption covered a strata corporation and that it is a data controller. It was also found that providing documents requested under the Bye-Laws was data processing and that members of Strata 22 were data subjects.

On that basis the Grand Court made the following decisions:

1. Strata 22 members had to be told that the Ex-Co of Strata 22 had their data and for what purpose it was going to be processed;

2. That processing purpose has to be fair. Providing information to the Owner which could benefit all members of Strata 22 was fair;

3. Strata 22 has to show that it was either processing (i) the personal data by consent, (ii) to perform a contract with the data subject, (iii) under legal obligation, (iv) to protect the vital interest of the data subject, (v) to perform a public function, or (vi) for a legitimate interest of Strata 22 as the data controller;

4. The act of purchasing a property and thereby agreeing to the Bye-laws under which the Owner had a right to personal data of members held by Ex-Co did not constitute consent for DPA purposes;

5. However, exemption (ii) above did apply to Strata 22 because Strata 22 had to process the data in order to give the requested documents to the Owners in the course of the performance of a contract i.e. the Bye-Laws, which are a statutory contract under the Act;

6. There was no legal obligation applicable to the data processing that Strata 22 would do in order to provide requested documents to the Owner. A legal obligation has to arise under legislation and Strata 22's obligation to provide the documents was under contract that is the Bye-Laws and not under the Act even though the Act required there to be Bye-Laws;

7. When deciding if the data processing is for a legitimate purpose of Strata 22, a balancing exercise should be conducted weighing up the nature of the data, the processing involved and the benefit and detriments of the processing and what can be done to ensure the data is secure. Strata 22 did have a legitimate interest in providing the data to the Owner based on the nature of the data and the benefits and detriments. Given that the Owner was willing to enter into a non-disclosure agreement to maintain the privacy of the personal data, which would assist to maintain security of the data, the overall balance was that there was a legitimate purpose for the data processing;

8. The members' data subject rights to information from Strata 22 as the data controller, including the right to cease or restrict data processing, as well at the requirement to take appropriate security measures in regard to personal data, were respected by imposing the condition that the Owner inspect the raw data at the Ex-Co offices after entering into an appropriate non-disclosure agreement.

This decision skilfully navigated the tricky waters where the rights of data subjects under the DPA intersect with a person's contractual right to information from the data controller. The Beachcomber Case provides clarity to Cayman strata corporations on how the DPA and Bye-Laws interact, but the same principles will have much wider application across a broad range of similar situations such as clubs and other member organisations.