Frequently asked questions

The Office of the Ombudsman was established by The Ombudsman Act, 2017 with the power and authority to investigate complaints of government maladministration under The Complaints (Maladministration) Act (2018 Revision) and The Police (Complaints by the Public) Act, 2017.

We operate in a fair and independent manner to decide whether injustice has been caused by improper, unreasonable or inadequate government administrative conduct or police misconduct.

Examples include:

• Police misconduct
• Bias, lack of impartiality
• Abuse of power
• Poor or delayed service
• Refusal to answer reasonable questions
• Neglecting to inform a complainant about their rights or entitlement, including appeal routes
• Knowingly giving misleading or inadequate advice
• Failure to adequately monitor compliance with procedures

A committee made up of Members of Parliament called the Select Committee to Oversee the Performance of the Office of the Ombudsman.

You can fill out a Maladministration Complaint Form, fill out a Police Complaint Form, you can call us (946-6283) or you can come to our office at the 5th floor of the Anderson Square building in George Town.

We work to resolve your complaint as soon as possible.

Yes, we conduct our investigations in private and maintain confidentiality of your information.

Yes, we have jurisdiction to investigate all government ministries, companies, departments, portfolios, statutory boards and all other government authorities in the Cayman Islands. 

We might ask the organisation to:

• apologise to you
• provide a service you should have received
• make a decision that should have been made before
• reconsider a decision that was made improperly
• improve procedures so similar problems do not happen again
• follow their complaints process

We do not have the legal powers to force organisations to follow our recommendations, but they do so in most cases.

We cannot consider complaints regarding the following:

• actions certified by the Governor to affect relations or dealings between the government and any other government
• matters involving defence, external affairs or internal security
• actions taken by the Director of Public Prosecutions, the Commissioner of Police, the Director of Workforce Opportunities and Residency Cayman or the Director of Customs and Border Control for the purposes of investigating crime, or protecting the security of the islands
• actions taken in connection with the Governor's power of pardon
• civil or criminal proceedings
• staffing decisions made by the government (appointments, removals, pay, discipline or other personal matters)
• legal advice given by the Attorney General or the Director of Public Prosecutions
• action taken by the Auditor General
• any judicial function

We will discuss your complaint with you to gain a full understanding of your concerns. Ensuring that your complaint is clear and concise will improve the likelihood of finding a satisfactory resolution. We will also contact the organisation you are complaining about to understand their position and find out if anything can be done to put things right.

We want to find out:

• what happened
• what should have happened
• why you are complaining
• why you feel it is still not resolved after complaining
• what would put things right for you

This Act was enacted to encourage, help and protect employees who choose to report improper conduct by their employer.

The Whistleblower Protection Act applies to all employers and employees in the Cayman Islands. This includes public and private employers and employees.

A whistleblower must act in good faith and in the public interest. You must honestly believe that a person is engaging in improper conduct.

The following people are considered to be 'employees' and entitled to make a disclosure:

• an employee in the public or private sector
• any person who assisted an employer for free
• any person who had a contract with or was an agent of an employer

Yes, your identity and the information you give to us is secret and confidential. The Freedom of Information Act does not apply to disclosures.

An employee shall not be liable in any civil or criminal proceedings or to any disciplinary proceeding because he or she has made a disclosure in accordance with the Whistleblower Protection Act.

The requirement for a disclosure to be made in the public interest is to prevent employees from making disclosures purely in their own self-interest or using the Act to bring employment disputes to the Ombudsman.

Improper conduct is defined as:

• a criminal offence
• a failure to carry out a legal obligation
• conduct that has, or is likely to:
  • result in a miscarriage of justice
  • be a detrimental action
  • result in a violation of human rights
  • result in a threat to health and safety
  • result in a threat or damage to the environment
• conduct that shows gross mismanagement, impropriety or misconduct involving public funds
• willful concealment of any act described above

We receive, investigate, recommend and report on disclosures of improper conduct and detrimental actions. We also plan, implement and monitor public awareness programmes aimed to educate and inform employees, employers and the general public.

Contact our office or get legal advice from an attorney-at-law.

You will be protected from any detrimental action taken against you for making a disclosure.

Yes, the Ombudsman can refuse to deal with a disclosure or refuse to commence an investigation into improper conduct or cease an investigation in the following circumstances:

• the disclosure is not protected
• the subject matter of the disclosure or investigation has been adequately dealt with
• the disclosure is frivolous or not sufficiently important to warrant an investigation
• the circumstances have changed so the investigation is unnecessary

If the Ombudsman refuses to investigate, we will notify you in writing and provide reasons for the refusal within 15 days.

If you have made a disclosure and your employer acts in reprisal, this is a detrimental action and includes:

• action causing injury, loss or damage
• intimidation or harassment
• unlawful discrimination, disadvantage or adverse treatment
• preventing, restraining or restricting an employee from making a protected disclosure
• inducing any person by threats, promises or otherwise to contravene The Whistleblower Protection Act, 2015

If a person takes detrimental action against you, they are liable to receive a fine or be imprisoned. If the courts convicts the person, the court may order (if the employer and employee agree) the employer to reinstate you. You can, in addition to any other rights or remedies available to you under the Act, sue the person who took detrimental action against you for any injury, loss or damage you suffered. You may ask the court to remedy the detrimental action or ask the court to grant an injunction with any terms the court considers appropriate.

You may file a complaint with the Director of Labour under the Labour Act (2011 Revision) on the ground that you have been subjected to a detrimental action. The Director will refer your complaint to a labour tribunal. Before you make a complaint, you must ask the Ombudsman to decide whether your disclosure is a protected disclosure under the Act.

If you are a civil servant, the Ombudsman may request the Deputy Governor transfer your employment within the civil service, with your consent.

If you have suffered detriment as a result of your protected disclosure, we can make recommendations to your employer to:

• permit you to return to your duties
• reinstate you, or pay compensation instead of reinstatement if the relationship of trust cannot be restored
• pay you in an amount equivalent to the damage you have suffered
• rescind any disciplinary action and pay compensation equivalent to any financial or other penalty imposed
• pay your expenses directly related to the reprisal
• compensate you for up to $10,000 for pain and suffering as a result of the reprisal

You will be treated by the court or the labour tribunal as having been unfairly dismissed if you choose to take civil action or make a complaint to the Director of Labour.

There are no specific responsibilities of an employer under this Act. However, employers should promote ethical practices as well as a positive environment for disclosing improper conduct.

Employers have the right to be heard, the right to provide an explanation and to receive a report of our investigation and recommendations.

Employers will receive notice of a disclosure and details of the alleged improper conduct. You may be interviewed as part of our investigation and you will be invited to make written submissions on the allegations against you. Once all submissions have been received, the Ombudsman will provide you with a draft report for your comment and review. Once all comments have been received and reviewed, a final report will be issued by the Ombudsman. You will receive a copy of this report.

No, employment agreements are void if they prevent you from making a protected disclosure.

Employment agreements may not require you to:

• agree not to make a disclosure during or after your employment
• refrain from instituting any proceedings pursuant to this Act
• withdraw or abandon any disclosure made under this Act

Under the Whistleblower Protection Act, the Governor has responsibility for:

• overseeing and inspecting the work of the Ombudsman under the Whistleblower Protection Act
• reviewing our annual report

The Governor may also give directions as to the policy and performance in relation to matters appearing to concern the public interest.

We have the following guidance:

• Overview for organizations (with an FAQ section at the bottom of the page)
• Guidance for organizations
  • Online version
  • PDF version
• Overview for individuals (with an FAQ section at the bottom of the page)
• Guidance for individuals
  • Online version
  • PDF version

The EU has no legal authority to enact laws in the Cayman Islands. However, if you collect personal data about individuals who are resident in the EU, you may be subject to the GDPR. For more details read our news item Cayman Islands Businesses & General Data Protection Regulations (GDPR).

The DPA grants you a number of powerful rights. The DPA also lays down data protection principles that govern how an organization may use your personal information. We can help you if an organization refuses to respect your rights or where it is using your personal information contrary to the principles.

In the vast majority of cases, you should first contact the organization that is using your personal information to try to resolve your issue. For example, the organization should be the first point of contact when the issue relates to:

• How your information is being used and handled.
• Access to your information.
• Security of your information.
• Accuracy of your information.
• Storage duration of your information.
• Automated decisions based on your information.
• Direct marketing use of your information.
• Stopping the use of your information.

Please contact us for informal advice if you are unsure whether you should first try to resolve the issue with the organization or whether it would be more appropriate to contact the Ombudsman first.

We recommend that you first try to resolve your issue directly with the organization that is using your information, before coming to us. This is particularly the case when you are exercising one of your data protection rights towards the organization.

If you are dissatisfied with the organization’s final response or if they fail to reply to you within a reasonable period of time, or – where provided in the DPA – within 30 days, please contact us using the complaint form.

Yes, if the violation is still ongoing, for example where an organization is holding information on you beyond what is needed (see the principle of data minimization).

You cannot complain if the violation is no longer ongoing, for example if the organization has already stopped sending you unwanted direct marketing.

You have a right to stop direct marketing. You should contact the organization responsible for the direct marketing and notify them that you no longer wish to receive direct marketing.

Please contact us if an organization has refused to stop sending you direct marketing.

Organizations have 30 days to reply to a request, such as a request to access your personal information.

Please contact us if the organization has missed its deadline to reply to your request.

The Office of the Ombudsman has prepared detailed guidance for organizations and guidance for data subjects.

You can find all resources on our resource page.

The organization (controller) itself is responsible. Where the organization is a legal person, such as a company, the internal structure of the organization, as reflected in the company’s constitutional documents, will decide who is responsible for ensuring the organization’s compliance. For example, this may be the board of directors, although the board may delegate specific functions.

Section 58 DPL recognizes personal liability for offences under the DPL committed by a body corporate. The personal liability is assigned to “any director, secretary or similar officer of the body corporate” or “any person who was purporting to act in any such capacity” where it is proved that the offence was committed with those individuals’ consent or connivance or attributable to their neglect.

Our primary goal is to help organizations become compliant and to support individuals in the exercise of their data protection rights.

The Ombudsman has substantial enforcement powers under the DPL. These assume different forms: information orders, enforcement orders, inspection and seizure powers, and monetary penalty orders. 

The Ombudsman takes all relevant circumstances into account when deciding on the appropriateness and severity of enforcement measures, such as:

1. The economic strength of the data controller. This will involve a holistic assessment of the economic unit (eg a relevant group of companies) the data controller belongs to.
2. The nature, gravity, and duration of the infringement, considering the specifics of the processing activity, the number of data subjects affected, and the level of damage or distress suffered by them.
3. The categories of data subjects and the types of personal data involved.
4. Whether the contravention was intentional or negligent in character, as well as the nature of technical and organizational measures taken pursuant to the seventh data protection principle.
5. Any evidence of due diligence towards compliance with the DPL.
6. Any measures taken to mitigate the damage or distress suffered by the data subjects as a result of the data protection violation.
7. The manner in which the contravention became known to the Ombudsman, such as whether through a complaint, the media, or directly from the data controller.
8. The level of cooperation with the Ombudsman concerning the investigation and resolution of the contravention.
9. The data controller’s history of data protection compliance.
10. Any other aggravating or mitigating factors, such as financial benefits gained, or losses avoided, directly or indirectly, from the contravention.

Yes. The DPL applies to organizations of all sizes, as long as they process personal data.

Note that compliance may be relatively easy if you do not engage in complex processing of sensitive types of personal data. The Office of the Ombudsman is preparing specific guidance for non-complex processing.

Read about the applicability of the DPL.

Yes. The processing of any personal data will be subject to the DPA, regardless of when the personal data was collected, as long as it is still being held.

The level of outreach depends on how the personal information was initially collected and what it is used for. Where the individual was likely aware of your identity and the current processing purposes, you will generally not need to actively reach out to the individual. Passive outreach, eg through a privacy notice on your website, should be sufficient. However, where the individual was likely unaware of your identity and/or the current processing purposes, you should actively reach out to the individual to comply with your information obligations.

Read about your information obligations.

Yes. However, section 9(1)(a) DPL excludes such personal data from subject access requests that would demand disproportionate effort. Whether a search represents disproportionate effort depends on a number of factors including the nature of the personal data, what it is required for and what circumstances led to the increased effort required to comply with the subject access request.

Read about subject access requests and the storage limitation principle.

No. The DPL does not require an organization to appoint a DPO, though this may be recommended for certain larger or complex organizations.

Yes, indirectly. The controller remains responsible for any processing activities carried out by its processors under its instructions, as manifested in the data processing agreement with the processor. As such, the processing of the processors must be compliant with the DPA.

Read about data processing agreements.

No. The EU-US Privacy Shield is a bilateral framework between the EU and the US. It provides rights only to individuals in the EU. It does not provide rights to individuals in the Cayman Islands. However, other conditions for transferring personal data to the US may apply.

Read about international transfers of personal data.

The DPL requires that all personal data breaches are reported to both the Ombudsman and the affected individuals within 5 days. However, notification may not be necessary if the breach is unlikely to prejudice the rights and freedoms of the data subjects. To notify the Office of the Ombudsman of a personal data breach, please see the contact page on our website: http://ombudsman.ky/get-in-touch. Please use our breach notification form (forthcoming) to submit the details of the breach. You may also contact us if you are unsure whether a breach is reportable.

Read about personal data breaches.

Anyone can request information under the Freedom of Information Act, regardless of their nationality, physical location or age.

You should direct your request to the information manager (IM) of the public authority that you believe holds the records. You can find out who the IM is by:

• calling, emailing or visiting the public authority;
• looking up the name of the IM on the list of public authorities;
• looking up the contact details on the whole of government publication scheme.

If you wish, you may use the standard FOI Request Form

If you make your request to the wrong public authority, the Act requires the IM to transfer your request within 14 days to the public authority that holds the record(s) or whose functions are more closely connected with the subject matter of your request.

In order for your request to qualify as a request under the FOI Act it must:

• be made in writing, which includes email
• contain enough information to enable the public authority to identify the records

You do not need to mention the FOI Act, but it may help to do so.

You can ask for any information the government holds. In some cases the government may legitimately withhold information from you because there are certain limited exemptions from disclosure under the FOI Act. The government may also defer disclosure of certain information.

For more on exemptions, see sections 15 to 25 of the FOI Act.

You should try and make your request for a 'record', if possible. If you don’t know what record to ask for, you should seek assistance from the information manager (IM) you are dealing with. The IM has a duty to communicate with you and help you refine your request.

A proper request for records would be: “I want access to the travel receipts for the month of December”.

A poor request would be: “I want to know how much government spent on travel in December?”.

The FOI Act grants a right to obtain access to records. A record is defined as 'information held in any form'. This includes a record in writing, a map, plan, graph or drawing, a photograph, a disk tape, sound track, any film, etc.

Yes, you have to supply a name when you make a request or an appeal, but it does not have to be your real name. You can ask that a copy of the records be sent to an email address without revealing your real name.  If you ask for your own personal information you cannot make your request anonymously - you will need to show proof of identity.

No, you do not have to give any reasons why you want the information or how you intend to use it. In some cases background information you can provide may assist the Information Manager in locating the records you have requested. Some background information may also assist the public authority and the Ombudsman in determining the public interest.

A public authority must acknowledge your request within 10 calendar days and reply within 30 calendar days. If the request has to be transferred to another public authority, the transfer itself must be completed within 14 calendar days and the second public authority then has 30 calendar days from the date of the transfer.

The initial 30-day period can be extended for good cause by a further 30 calendar days.

When the Information Manager gives you the public authority’s initial decision, the reply should:

• provide the records (if any are held) that were requested in full or in part, with the legal reasons for any entire records or parts of records that are being withheld
• include the options available to you, e.g. whether and how you can request an internal review or an appeal to the Ombudsman

If the public authority does not hold any records relevant to your request, this should be stated in the decision. The search efforts that were made should be explained to you.

If you do not get an acknowledgment of your request within 10 calendar days and you do not know if your request has been received, you could contact the person you made the request to. If you do not get a response to your request within 30 calendar days, you should contact the information manager and ask for an internal review. Under the FOI Act a non-response is the same as a refusal to grant access. Therefore, you are entitled to ask that the responsible chief officer conduct an internal review.

If you request an internal review, and it is not conducted within 30 calendar days, you are entitled to appeal the request to the Ombudsman.

The FOI Act grants the general public a right to access government records. However, there are a number of valid reasons why public authorities may withhold a record. Many records are fully or partially exempted and you are entitled to know the legal reason for withholding a record or part of a record. If you do not believe a record should be withheld, you are entitled to ask the information manager for an internal review of the decision. An internal review must be completed within 30 calendar days by the chief officer responsible for the public authority.

If you are not satisfied with the decision of the chief officer’s internal review, you can appeal to the Office of the Ombudsman. In some circumstances you can appeal directly to the Office of the Ombudsman, without an internal review. If at any time you have any questions about this process, contact the Office of the Ombudsman and we will point you in the right direction.

If your complaint is not about accessing government information, you should consider making a customer service complaint, or complaining under the Complaints (Maladministration) Act.  Learn more about the Office of the Ombudsman's own internal complaint policy. 

The Office of the Ombudsman can only accept an appeal under the FOI Act when all other avenues have been exhausted. This normally means that first you have to ask for an internal review as described above, before you can make an appeal with the Ombudsman. Your request for an appeal with the Ombudsman needs to be in writing.

To make an appeal please complete the appeal request form. 

When you make an appeal we will ask you for copies of the following documentation

• your initial request
• the public authority’s initial decision
• your request for an internal review
• the chief officer’s internal review decision
• any records that were disclosed to you, including redacted records

We will review your documentation and confirm whether we can accept an appeal under the Act or not. See our Appeal Policy and Practical Guidelines for more information

No, it is entirely up to you if you wish to use legal representation. You will be liable for all your own legal costs.

The government must show that it fulfilled its obligations under the FOI Act. Therefore, applicants are not required to file complex legal arguments, although you will have an opportunity to state your position if the appeal reaches the formal hearing stage.

The duration of an appeal will depend on a number of factors, including whether it can be resolved informally or whether it proceeds to a formal hearing.

The formal decisions can be found here.