Knowledge

As more and more social and economic activities are moving to take place online (especially during the Covid-19 pandemic), the importance of privacy and data protection is increasingly recognised.

The protection of personal information has emerged as a major political and social issue in an era of exponentially rapid change in business practices and personal behaviours. How rapid has the change been? Let's compare 2008 to 2020:

• in 2007 the iPhone went on sale and in 2008 android phones went on sale. Now there are 3.2 billion smart phone users;
• in 2008 there were 1.6 billion internet users and now there are 4.1 billion;
• online shoppers have more than doubled. The value of business to consumer e-commerce was less than $1 trillion in 2008 but is now $3.8 trillion; and
• Global Internet Protocol Traffic (a proxy for data flow) was 400 GB per second in 2008 and is now 100,000 GB per second.

(data published by United Nations Conference on Trade and Development ("UNCTAD") Digital Economy Report, 6 April 2020)

Where in the world is there personal privacy law?

Only 66% of the nations of the world safeguard people's data and privacy, according to UNCTAD data from April 2020. The share is 96% in Europe, 69% in the Americas, 57% in Asia and the Pacific and 50% in Africa.

"Given the rise of cybercrime, scams and online fraud during the COVID-19 pandemic, the survey results are very worrying," said Shamika N. Sirimanne, director of UNCTAD's division on technology and logistics.

"For e-commerce to effectively support development", she said, "consumers and businesses must feel protected".

"This is especially true in these trying times, when digital tools are increasingly the only vehicle to access goods and services."

Cayman Islands Data Protection Act ("DPA")

The DPA came into force in 2019 and it was drafted around internationally recognised privacy principles in order to give individuals control over their personal data and protect against its misuse in both public and private sectors.

It sets out certain duties of those holding personal data and, together with the Confidential Information Disclosure Act and certain other legal rights, gives the Cayman Islands the most comprehensive data protection regime in the region. Data must be processed lawfully, fairly and in a transparent manner; it must be limited to what is necessary, be accurate and be kept for no longer than is necessary and it must be kept secure.

The DPA codifies the fundamental right to privacy which is in the Cayman Islands' Bill of Rights, Freedoms and Responsibilities under the right to private and family life and also in Article 12 of the Universal Declaration of Human Rights. The right to privacy includes the right of individuals to determine who holds information about them and how the information is used.

Is having a privacy law enough?

For consumer confidence to pick up and people to trust e-commerce, countries must have legal frameworks that adequately protect individuals online but there must also be a means to enforce the individual's rights.

In the Cayman Islands the Ombudsman's office supervises compliance with the law and investigates, mediates and decides upon complaints as well as monitoring breaches and taking action where necessary. The Cayman Islands Ombudsman was busy in 2019 dealing with 192 enquiries and 37 cases in the first year the DPA existed. Outcomes for cases where the Ombudsman had jurisdiction were good but a couple of cases illustrated a global Issue.

No global privacy scheme

The flow of personal data takes place increasingly across territorial borders. Whilst the protection of privacy is a global issue, there is no universal framework of institutions for regulating collection, use, storage, communication of and access to personal information and enforcement authority jurisdiction stops at the border of the country in which the individual lives. This lack of global cohesion poses severe challenges for regulatory policy and practice.

The Cayman Islands Ombudsman had this very problem in a case where the owners of a website refused to take down the public profile of a Cayman Islands artist even though he told them he no longer wished for it to be available on that website. However, as the website was not hosted in the Cayman Islands and the company that owned it was not established in the Cayman Islands, there was no data controller in existence under the DPA and the data was not being processed in the Cayman Islands. The complaint was, therefore, out of the Cayman Islands Ombudsman's jurisdiction.

The takeaway

The Cayman Islands is part of a global community, that includes 128 of the 194 United Nations member countries, that has both laws to protect personal information and a robust system to enforce those laws. However, in the words of a popular 60s song, what the world needs now is not just "love, sweet love" but an international personal privacy enforcement regime.

If you would like any further information, please get in touch with your usual Bedell Cristin contact or one of the contacts listed.