Data Protection Policy

This Data Protection Policy (“this Policy”) establishes how the Department of Planning and associated statutory bodies protects Personal Data based on the Cayman Islands Data Protection Act (2021 Revision) (“DPA”) and Data Protection Regulations, 2018 (“Regulations”) and in line with the Cayman Islands Government (“CIG”) Privacy Policy.

This Policy ensures the Department of Planning’s employees and other Public Officials and Suppliers who have access to Personal Data processed by the Department of Planning and associated statutory bodies understand the rules governing the use of Personal Data.

View the full Data Protection Policy here

1. Scope

The Cayman Islands Government Department of Planning (“the Department”) and associated statutory bodies (namely the Central Planning Authority (“CPA”), the Development and Control Board (“DBC”), the Electrical Board of Examiners (“EBE”) and the Builders Board (“BB”)), respect your privacy and take care in protecting your personal data. As data controllers, we comply with the Cayman Islands Data Protection Act (2021 Revision) (the “Cayman Islands DPA” or “DPA”).

This privacy notice (“Privacy Notice”) demonstrates our commitment to ensuring your personal data is handled responsibly. It applies to the Department, the CPA, the DCB, the EBE and the BB, who are data controllers with respect to personal data processed in exercise of their respective functions under the following enactments:

  1. In the case of the CPA and the DCB, their functions under the Development and Planning Act (2021 Revision) in relation to the use and development of land, more particularly consideration of applications for permission for development of land;
  2. In the case of the Department, the functions of the Department and Director of Planning under the Development and Planning Act (2021 Revision), including in relation to the enforcement of planning control, and under the Building Code Regulations (2022 Revision);
  3. In the case of the EBE, its functions under the Electricity Act (2008 Revision) with respect to the licensing of persons to carry out electrical work in the Island Electricity Act (2008 Revision); and
  4. In the case of the BB, its functions under the Builders Act (2020 Revision) with respect to the registration of business entities and qualified persons.

In addition to being a data controller with respect to the personal data it processes in respect of its own functions under the Development and Planning Act (2021 Revision), the Department is also a data processor with respect to the personal data it processes on behalf of the CPA and DCB, more particularly pursuant to section 4 of the Development and Planning Act (2021 Revision). It is also a data processor with respect to personal data processed on behalf of the EBE and BB.

Because the functions of the CPA, DCB, EBE and BB are, or are typically considered by the public, to be closely related to those of the Department, it is both administratively convenient, and in keeping with the first data protection principle, for one external privacy notice to be issued on behalf of all five public authorities. In the remainder of this Privacy Notice, and save where the context makes clear, “the Department of Planning” is to be read as including the CPA, DCB, EBE and BB.

This Privacy Notice does not apply to the Department when we are processing personal data relating to our employees, who are covered under The Ministry of Planning, Agriculture, Housing, Infrastructure, Transport & Development’s (PAHITD) Employee Privacy Notice.

2. What Personal Data We Collect

The Department of Planning collects personal data, including sensitive personal data, directly from you and may also collect your personal data indirectly from third party sources. Personal data collected by the Department of Planning is limited to what is necessary for our processing activities. In this Privacy Notice, personal data includes any data relating to an identified or identifiable living individual and includes but is not limited to: name, email, address, phone number and any expressions of opinion you may share with us.

Personal data we collect directly from you
The Department of Planning collects the following information directly from you:

  1. Personal data you provide through the Department of Planning websites (www.planning.ky /www.plancayman.ky), such as:
    1. Personal data provided within comments and questions, including your name and/or email address if you provide these details in our web form. If you ask questions about our public services and programmes or provide information about your relationship with us, this may also reveal other personal data, e.g. your employment status, health, or property ownership;
    2. Your email address and subscription preferences if you sign up for our newsletters or notifications, and how you utilise our emails, including whether you open them and which links you click; and
    3. Your Internet Protocol (“IP”) address, details of which device or version of web browser you used to access our website content, and other information about how you used our website (see our Cookie Notice for more )
  2. Personal data you provide when you visit the Department of Planning offices and other locations, contact us by email or telephone, or access our programmes and services, including our online services (Community Works – formally OPS);
  3. Personal data that you provide when you inquire about or apply for a job with the Department of Planning; and
  4. Any other personal data where the collection is necessary to achieve our lawful purpose(s), such as the processing of applications for a licence from the EBE or for registration by the BB.

Personal data collected from other sources
The Department of Planning may collect personal data from other sources, including:

  • Third parties that verify personal data provided by the data subject (e.g. professional registration bodies);
  • Third parties that share employment and related information (e.g. references, background checks for prospective employees).
  • Third parties that file complaints or objections (e.g. enforcement complaints)

3. How We Use Your Personal Data

The purpose of the Civil Service is to make the lives of those we serve better. We are dedicated to supporting the elected government by delivering caring, modern and customer-centred public services and programmes, which deliver value for money. The Department of Planning may use your personal data for the following purposes:

  1. Implementing policies, providing services and programmes, and managing your relationship with us, including, in order to:
    • Promote compliance with the Development and Planning Act (2021 Revision),
    • Review and determine planning applications,
    • Consult with departments and agencies of government in accordance with section 7 of the Development and Planning Act (2021 Revision),
    • Receive and investigate complaints about illegal building works,
    • o Issue compliance letters,
    • Maintain a registry for approved engineers and contractors,
    • Review and determine applications to be licensed under the Electricity Act (2008 Revision), and
    • Review and determine applications to be licensed under the Builders Act (2020 Revision);
  2. Responding to your inquiries;
  3. Verifying your identity;
  4. Measuring how users interact with the Department of Planning’s website and continually improving our communications channels (including by aggregating personal data collected using cookies);
  5. Communicating and interacting with website visitors;
  6. Sending you marketing communications;
  7. Communications and public relations activities;
  8. Managing accounts payable and receivable, preventing fraud, and protecting public funds;
  9. Statistical and other reporting, both internally and externally;
  10. Seeking legal advice, and exercising or defending legal rights;
  11. Complying with our legal obligations, including all legislation that applies across the public sector e.g. with respect to records and information management and auditing;
  12. Communicating and interacting with job applicants and related third parties (e.g. references) and carrying out recruitment and selection processes.

 4. How We Share Your Personal Data

The Department of Planning may share your personal data as required, including under applicable legislation, with recipients that include joint data controllers, our data processors, and third parties. We will only share your personal data as permitted by the Cayman Islands DPA.

Your personal data may be shared with the following recipients that support our public functions and operations:

  1. With other public authorities:Personal data may be shared with other public authorities – here, “public authorities” means Ministries, Portfolios, Offices, Departments, Statutory Authorities, Statutory Bodies and Government Companies – for the purposes set out in this Privacy Notice.
  2. With data processors external to the CIG: Personal data may be shared with persons providing services to the Department of Planning and associated statutory bodies as a data processor in compliance with the Cayman Islands DPA. These service providers are only able to use personal data under our instructions and may include:
    1. Webhosting;
    2. Information Technology;
    3. Records and Information Management, including storage facilities;
    4. Communications;
    5. Marketing and campaigns;
    6. Events management; and
    7. Security operations and fraud prevention.
  3. The main service provider for the Department of Planning:
    1. Brac Informatics Centre – provider of digital services via a data controller to data processor relationship with its data centres domiciled in the Cayman Islands.
  4. With legal advisors and other persons if required by law or in relation to legal proceedings or rights: Personal data may be disclosed as legally required, for the purpose of or in connection with proceedings under the law, if necessary to obtain legal advice, or if the disclosure is otherwise necessary to establish, exercise or defend legal rights. This may include disclosing your personal data for the following purposes:
    1. Seeking legal advice;
    2. Exercising or defending legal rights;
    3. Complying with internal and external audits or investigations by competent authorities; and
    4. Complying with information security policies or requirements.

5. Our Legal Bases for Processing Your Personal Data

Depending on applicable laws and other circumstances, the Department of Planning will rely on specific legal bases, or “conditions of processing”, under the Cayman Islands DPA to process your personal data. These may include:

  1. A legal obligation to which the Department of Planning is subject, for example pursuant to the Development and Planning Act (2021) and Development and Planning Regulations (2024 Revision), the Builders Act (2020 Revision) & Builders Regulations (2018 Revision), the Electricity Act (2008 Revision) & Electricity Regulations (2011 Revision) and to comply with various obligations under the Procurement Act (2023 Revision) and Procurement Regulations (2022 Revision), the Public Management and Finance Act (2020 Revision) and Financial Regulations (2022 Revision), the Public Service Management Act (2018 Revision) and Personnel Regulations (2022
  2. To exercise public functions, including the functions of the Department of Planning to process planning applications, create a registry for approved engineers and issue plumbing & electrical licences.
  3. To perform or enter into a contract with you, e.g. Third-Party Building Inspection and Plan Review Program.
  4. Consent, e.g. to send you marketing communications or to administer surveys, polls and updates, including in relation to Plan Cayman; and
  5. For the purposes of legitimate interests pursued by the Department of Planning or by a third party or parties to whom the personal data may be disclosed, e.g. when disclosing records containing third party personal data in response to a request submitted under the Freedom of Information Act (2021 Revision).

Where we process your sensitive personal data, we will also meet a second legal basis. These may include:

  1. To exercise our public functions; and
  2. In relation to legal proceedings, including obtaining legal advice and otherwise establishing, exercising or defending legal right

6. Children’s Personal Data

Unless explicitly stated or implied otherwise, the Department of Planning, the Department of Planning’s website and the various public services and programmes offered, are not intended for, or intentionally targeted at, children. We do not knowingly collect or maintain personal data about persons under the age of 18.

7. Security and International Transfers

The Department of Planning has put in place appropriate technical, physical and organisational measures in order to keep your personal data secure. These safeguards to maintain the confidentiality, integrity and availability of your personal data may include:

  • Key card access controlled secured storage rooms
  • Locking devices on secured vaults and cabinets
  • Redacting personal data when necessary
  • Robust network security
  • Backup and recovery servers domiciled in the Cayman Islands
  • Secured cloud and electronic storage
  • Staff data security awareness training

We will only transfer your personal data to a country or territory that ensures an adequate level of protection for your rights and freedoms in relation to the processing of your personal data, unless there is a relevant exemption or exception under the Cayman Islands DPA. Exceptions may include your consent or appropriate safeguards.

8. How Long We Keep Your Personal Data

The Department of Planning may store your personal data for as long as we need it in order to fulfil the purpose(s) for which we collected your personal data, and in line with any applicable laws. This includes the National Archive and Public Records Act (2015 Revision), which governs the creation, maintenance and disposal of all public records. Sometimes, we may anonymise your personal data so that it is no longer associated with you.

9. Cookies

Cookies, in combination with pixels, local storage objects, and similar devices (collectively, “Cookies” unless otherwise noted), are used to distinguish between visitors to a website.

When you visit our websites, small files known as Cookies may be stored on your computer, phone, tablet or any other device through your web browser. Information is stored in these text files. DOP External Privacy Notice v1.0 6

Enabling Cookies allows for a more tailored browsing experience and is required for certain website functionality by providing us with information about how users interact with our websites such as the number of visitors to the site, the pages they visit and the length of time spent on the site. All of the information that the cookies collect is aggregated and anonymous. You may change your browser settings to delete and block cookies. To find out how, please visitwww.allaboutcookies.org.

Please see the website’s Cookie Notice for more information about the use of Cookies.

10. Your Rights

The Department of Planning will respect and honour your rights in relation to your personal data and implement measures that allow you to exercise your rights under the DPA and other applicable legislation.

In accordance with the DPA, your rights in relation to your own personal data include:

  1. The right to be informed and the right of access: The right to request access to all personal data the Department of Planning maintains about you as well as supplementary information about why and how we are processing your personal data. This is commonly known as a Data Subject Access Request and certain supplementary information about our processing is contained within this Privacy Notice.
  2. Rights in relation to inaccurate data: The right to request the rectification, blocking, erasure or destruction of any inaccurate personal data the Department of Planning maintain on you. We will ensure, through all reasonable measures, that your personal data is accurate, complete and, where necessary, up‑to‑date, especially if it is to be used in a decision-making process.
  3. The right to stop or restrict Processing: The right to restrict or stop how the Department of Planning and associated statutory bodies uses your personal data in certain circumstances.
  4. The right to stop direct marketing: The right to cease the use of your personal data by the Department of Planning and associated statutory bodies for direct marketing purposes.
  5. Rights in relation to automated decision making: The Department of Planning and associated statutory bodies does not currently use automated means to make decisions about you. However, we will update this Privacy Notice and we will also notify you in writing as required if this position changes.
  6. The right to complain: The right to complain to the Ombudsman about any perceived violation of the DPA by the Department of Planning and associated statutory bodies.
  7. The right to seek compensation: The right to seek compensation in the Court if you suffer damage due to a contravention of the DPA by the Department of Planning and associated statutory bodies.

You may contact the Department of Planning, regarding data protection using the contact details listed below, to access and review your personal data or to exercise any other rights provided to you under the DPA. The Department of Planning will take into consideration circumstances where, under the DPA or other applicable legislation, your rights may be limited or subject to conditions, exemptions or exceptions.

Upon contacting the Department of Planning we may need to verify your identity prior to fulfilling a request and may request additional information as required. In accordance with the DPA, the Department of Planning may also charge a reasonable fee in relation to your request if it is unfounded or excessive in nature, or the Department of Planning may reserve the right not to comply with the request at all.

To learn more about your rights, visit www.ombudsman.ky.

11. Data Protection Principles

When processing your personal data, the Department of Planning will comply with the eight Data Protection Principles defined within the Cayman Islands DPA:

  1. Fair and lawful processing: Personal data shall be processed fairly. In addition, personal data may be processed only if certain conditions are met, for example the data controller is subject to a legal obligation that requires the processing or the processing is necessary for exercise of public functions.
  2. Purpose limitation: Personal data shall be obtained only for one or more specified, explicit and legitimate purposes, and not processed further in any manner incompatible with that purpose or those purposes.
  3. Data minimisation: Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are collected or processed.
  4. Data accuracy: Personal data shall be accurate and, where necessary, kept up-to-date.
  5. Storage limitation: Personal data processed for any purpose shall not be kept for longer than is necessary for that purpose.
  6. Respect for the individual’s rights: Personal data shall be processed in accordance with the rights of data subjects under the DPA, including subject access.
  7. Security – confidentiality, integrity and availability: Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
  8. International transfers: Personal data shall not be transferred to a country or territory unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

12.  How to Contact Us

The Department of Planning and associated statutory bodies has appointed a Data Protection Leader. If you have any questions about this Privacy Notice or how your personal data is handled, or if you wish to make a privacy related complaint, please contact:

Name: Kevon Thompson – Data Protection Leader
Telephone number: (345) 244-6501
Email Address: kevon.thompson@gov.ky
Address: The Department of Planning Cayman Islands Government, PO Box 113 Grand Cayman KY1-9000 Cayman Islands
The Department of Planning aims to resolve inquiries and complaints in a respectful and timely manner.

13. Changes to this Privacy Notice

The Department of Planning reserves the right to update this Privacy Notice at any time and will publish a new Privacy Notice when we make any substantial updates. Occasionally, the Department of Planning may also notify you about the processing of your personal data in other ways, including by email or through our publications.

This Privacy Notice was last updated on June 01, 2024