$100k fine for abusing info

(CNS): Companies, government and even charities could face a hefty fine if they misuse information once the proposed Data Protection Law is implemented. The need for such legislation in Cayman has grown recently with the arrival of CCTV cameras and the soon to be implemented Bill of Rights. Presently, there are no controls over how personal information is used and the new law will ensure that no individual or entity can misuse sensitive data, according Deputy Information Commissioner Jan Liebaers. While the country does not yet have protective legislation, fortunately there is little evidence of any major misuse to date, he said. However, in future those that do breech the law could pay as much as $100,000 in fines.

Once the law is enacted, it will be monitored and enforced by the Information Commissioner’s Office (ICO), which will be striking the balance between transparency and protection.

The Data Protection Law is not just limited to government, however, as it extends to the private sector and all organisations, including churches. The people who control data will need to manage that information properly and take responsibility for the informaiton they hold. While entities will still be able to store and retain information for legitimate purposes, the law will focus on protecting people from the abuse and illegitimate use of information.

Jan Liebaers told CNS that the ICO will be embarking on a widespread awareness and education campaign well before the law is passed and, once it is passed, the implementation would likely be staggered over at least 12 months to enable everyone to comply.

Although the law will impact a wide cross-section of the community, many organisations will find that they are already compliant. Liebaers explained that the implementation of the Bill of Rights in November enshrines the right to a private life, which means that there must be legislation to uphold that right and consequences if privacy of personal and sensitive information is breeched.

There are exemptions about the use of data by law enforcement officials and even for legitimate purposes by journalists as the emphasis is on the proper management of information held by controllers that is considered sensitive and using it appropriately.

While the ICO will have powers to investigate complaints and enforce the law, Liebaers said that the introduction of the law was not all about enforcement but about ensuring that information is held properly and the individual's right to privacy is protected.

With budgets tight in government, Liebaers admitted that in order for the ICO to manage both freedom of information and data protection properly, the office will need to be properly resourced to ensure one or the other does not suffer. He estimated that once the law is enforced it would require around three new staff members.

The law is currently going through a consultation process and Liebaers, who was part of the work group that drew up the parameters of law, encouraged everyone to read and consider the draft legislation and submit their comments to ensure that the final draft is fit for purpose.

The 69 page draft Data Protection Bill 2012 and the accompanying consultation papers are available at www.dataprotection.ky and in hard copy from the Government Administration Building at 133 Elgin Avenue. Members of the public are asked to provide comments by Friday, 2 November 2012 and can call 244 3607 for more information.