Version	Date	Revision Description	Author
0.1	29 Nov 2024	Initial draft provided to DPP for review and feedback	Simon S
1..0	23 Dec 2024	Version 1.0 Published	Simon S

Version Control Notice:

This document is a controlled document that supersedes all previous versions. Please discard any previous copies of this document dated prior to the version and publication date noted above this page.

Anyone who obtains an electronic or printed version of this document is responsible for ensuring that they have the latest version. The latest version of this document is available on the Cabinet Office L: Drive and can also be obtained by email on request to the Cabinet Office Data Protection Leader as set out in section 11.

The Office of the Director of Public Prosecution (“ODPP”) respects your privacy and takes care in protecting your personal data. As a data controller, we comply with the Cayman Islands Data Protection Act (2021 Revision) (the “DPA”). This privacy notice (“Privacy Notice”) demonstrates our commitment to ensuring your personal data are handled responsibly.

The Director of Public Prosecutions (“DPP”) is created by Section 57 of the Cayman Islands Constitution Order 2009 with the power:

• To institute and undertake criminal proceedings against any person before any court in respect of any offence against any law in force in the Cayman Islands;
• To take over and continue any such criminal proceedings that have been instituted by any other person or authority; and
• To discontinue at any stage before judgment is delivered any such criminal proceedings instituted or undertaken by himself or herself or any other person or authority.

The DPP may delegate his powers to those within the ODPP. This Privacy Notice applies to the ODPP in the exercise of our various functions.

This Privacy Notice does not apply to the ODPP as a Civil Service Entity when we are processing personal data relating to our employees, who are covered under our Employee Privacy Notice. This Privacy Notice also does not apply to the operations of Cayman Islands Investigating Organisations in relation to their investigatory functions or to the Cayman Islands Law Courts in relation to their judicial functions.

The ODPP collects personal data, including sensitive personal data, directly from you and also indirectly from third party sources. Personal data collected by the ODPP is limited to what is necessary for our processing activities.

In this Privacy Notice, personal data includes any data relating to an identified or identifiable living individual, such as your name, birthdate, contact details, citizenship, country of origin, educational/training history, employment status and history, financial information, voluntary activities, memberships in clubs or associations, property ownership, investments, medical data, data about your physical or mental health, criminal offence data, opinions about you, your expressions of opinion, and any indication of a person’s intentions in relation to you.

The ODPP may collect the following information directly from you:

a. Personal data you provide when you visit the ODPP and other locations or via email correspondence or telephone, including to enquire about a legal matter and/or the functions of the ODPP;

b. Personal data you provide when you interact with our specialist witness care officer, who is trained to provide assistance and guidance to victims and witnesses, and other ODPP representatives; and

c. Any other personal data where the collection is necessary to achieve our lawful purpose(s).

The ODPP may also collect your personal data from other sources, including:

a. Cayman Islands Investigating Organisations (including the Royal Cayman Islands Police Service (“RCIPS”), Cayman Islands Coast Guard (“CICG”), Customs & Border Control (“CBC”), Workforce Opportunities & Residency Cayman (“WORC”), Department of Commerce & Investment (“DCI”), Department of Environmental Health (“DEH”), Department of Environment (“DoE”), Anti-Corruption Commission (“ACC”)Department of Planning (“DoP”), Lands & Survey Department (“L&S”), Utility Regulation & Competition Office (“OfReg”), the Water Authority - Cayman, Portfolio of Legal Affairs (“POLA”), and the Office of the Governor,) as well as any country or territory specified in Schedule 1 of The Criminal Justice (International Cooperation) Act (2024 Revision), the Assistance Under the Mutual Legal Assistance (United States of America) Act (2015 Revision), and The Extradition Act 2003 (Overseas Territories) Order 2016;

b. Your attorney, agent or other authorised representative, if you choose to appoint one;

c. An individual employee of or expert witness or external counsel retained by the ODPP, where that employee or counsel is required to disclose a personal or pecuniary interest, direct or indirect, in a matter which is to be determined or otherwise handled by the ODPP, e.g. an employee of the ODPP declares that they have a personal or business relationship with you, disclosing this fact before they recuse themselves from your matter;

d. If the ODPP is unable to contact you – directly and through your agent or other authorised representative if one was appointed – and it is necessary to contact you in relation to your matter, we may contact your (last known) employer, family members, or other persons whose information has been provided in the course of your matter to try to obtain your current contact details. If necessary, we may also use publicly available sources of information to ascertain your whereabouts and/or obtain your contact details; and

e. Any other personal data where the collection is necessary to achieve our lawful purpose(s).

The DPP is responsible for all criminal proceedings brought within the Cayman Islands and is the Government’s principal legal adviser on criminal matters. The DPP prosecutes offences in the Traffic Court, Summary Court, and Grand Court, as well as proceedings before the Court of Appeal and the Privy Council. The DPP is also the Central Authority under the Criminal Justice International Co-operation Act (2021 Revision) and exercises functions under the Justice Protection Act (2017 Revision).

In particular, the DPP:

• Decides which cases to prosecute,
• Determines the appropriate charges in any case,
• Prepares cases and presents them at court, and
• Provides information, assistance and support to victims and prosecution witnesses.

Crown Counsel of the ODPP are responsible for providing charging decisions on all files submitted by the RCIPS and other Cayman Islands Investigating Organisations. Those charging decisions are made in accordance with Internal Rulings Standards and the Full Code Test set out in the UK ‘Code for Crown Prosecutors’.

The ODPP consists of members of the office appointed by DPP and external counsel or expert witnesses appointed to prosecute matters involving you or a third party.

The ODPP may use your personal data for the following purposes:

a. Responding to your enquiries, which may also require verifying your identity;
b. Carrying out our functions under Section 57 of the Cayman Islands Constitution Order 2009;
c. Statistical and other reporting, both internally and externally;
d. Seeking legal advice, and exercising legal matters; and
e. Complying with our legal obligations, including all legislation that applies across the public sector, e.g. legislation that provides for records and information management, financial management and audit.

The ODPP will only share your personal data as permitted by the DPA. We may share your personal data as required, including under applicable legislation, with recipients that include our data processors and third parties. Your personal data may be shared with the following recipients, including those that support our operations:

a. With data processors: Personal data may be shared with persons providing services to the ODPP as a data processor in compliance with the DPA. When they are acting as data processors, these service providers are only able to use personal data under our instructions. We engage data processors for a variety of processing activities, which include information technology and records and information management.

b. With the Investigating Organisations, defence chambers and the Judiciary (including the Cayman Islands Law Courts): Personal data may be shared with organisations involved in the legal process for the purposes set out in this Privacy Notice and as required by law.

c. With legal advisors and other persons if required by law or in relation to legal proceedings or rights: Personal data may be disclosed as legally required, for the purpose of or in connection with proceedings under the law, if necessary to obtain legal advice, or if the disclosure is otherwise necessary to establish, exercise or defend legal rights. This may include disclosing your personal data for the following purposes:

i. Seeking legal advice;

ii. Exercising or defending legal rights;

iii. Complying with internal and external audits or investigations by competent authorities; and

iv. Complying with information security policies or requirements.

d. With other third parties: Personal data may be disclosed to other third-party recipients for the purposes set out in this Privacy Notice and in accordance with the DPA, e.g. if we are trying to locate you.

Depending on applicable laws and other circumstances, the ODPP will rely on specific legal bases, or “conditions of processing”, under the DPA to process your personal data. These include:

a. A legal obligation to which the ODPP is subject;

b. To exercise public functions, including but not limited to under Section 57 of the Cayman Islands Constitution Order 2009,

c. To protect your vital interests;

d. To perform or enter into a contract with you, e.g. as a supplier to the ODPP or as the successful candidate following a recruitment process for a vacancy within the ODPP; and

e. For the purposes of legitimate interests pursued by the ODPP or by a third party to whom the personal data may be disclosed.

Where we process your sensitive personal data, we will also meet a second legal basis. These include:

a. To exercise our public functions;

b. In relation to legal proceedings, including obtaining legal advice and otherwise establishing, exercising or defending legal rights;

c. To protect your vital interests or the vital interests of another individual; and

d. If you have taken steps to make the personal data public, e.g. when we are trying to contact you in relation to your appeal and have been unsuccessful using the contact details provided in your appeal.

The ODPP collects personal data relating to children under the age of 18 to enable us carry out our functions. We may collect children’s personal data for any of the purposes set out in section 3 of this Privacy Notice

The ODPP has put in place appropriate technical, physical and organisational measures to keep your personal data secure. All employees of the ODPP and external counsel and expert witnesses retained by the ODPP are legally and contractually required to keep all facts and any particulars of, or relating to, any matter being considered or prosecuted as confidential.

Additional safeguards to maintain the confidentiality, integrity and availability of your personal data may include:

a. Developing and maintaining written plans to identify, prevent, detect, respond to, and recover from security threats, events and incidents;

b. Developing robust authentication procedures for accessing all systems that store personal data;

c. Administrative and technical controls to restrict access to personal data on a “need to know” basis;

d. Maintaining systems, software and applications, anti-virus software, firewalls, and other computer security safeguards, and taking appropriate measures to ensure these safeguards up to date;

e. Maintaining appropriate records of access to and processing of personal data;

f. Using appropriate measures, such as encryption, pseudonymisation and chain of custody records, to protect personal data, including when stored on laptops, tablets and other storage devices;

g. Utilising appropriate and secure methods to destroy personal data as legally required; and

h. Taking other reasonable measures as required at any time by legislation, rules and policies.

The ODPP will only transfer your personal data to a country or territory that ensures an adequate level of protection for your rights and freedoms in relation to the processing of your personal data, unless there is a relevant exemption or exception under the DPA. Exceptions may include your consent or appropriate safeguards.

The ODPP may store your personal data for as long as we need it in order to fulfil the purpose(s) for which we collected your personal data, and in line with any applicable laws. This includes the National Archive and Public Records Act (2015 Revision), which governs the creation, maintenance and disposal of all public records.

Sometimes, we may anonymise your personal data so that it is no longer associated with you.

The ODPP will respect and honour your rights in relation to your personal data and implement measures that allow you to exercise your rights under the DPA and other applicable legislation.

In accordance with the DPA, your rights in relation to your own personal data include:

a. The right to be informed and the right of access: The right to request access to all personal data the ODPP maintains about you as well as supplementary information about why and how we are processing your personal data. This is commonly known as a Data Subject Access Request and certain supplementary information about our processing is contained within this Privacy Notice.

b. Rights in relation to inaccurate data: The right to request the rectification, blocking, erasure or destruction of any inaccurate personal data the ODPP maintains on you. We will ensure, through all reasonable measures, that your personal data is accurate, complete and, where necessary, up‑to‑date, especially if it is to be used in a decision-making process.

c. The right to stop or restrict processing: The right to restrict or stop how the ODPP uses your personal data in certain circumstances.

d. The right to stop direct marketing: The right to cease the use of your personal data by the ODPP for direct marketing purposes. The ODPP does not undertake any direct marketing activities.

e. Rights in relation to automated decision making: The right to obtain information about and object to the use of automated decision making by the ODPP using your personal data. The ODPP does not currently use automated means to make decisions about you. However, if this position changes, we will update this Privacy Notice and we will also notify you in writing as required.

f. The right to complain: The right to complain to our Data Protection Leader or the Ombudsman about any perceived violation of the DPA by the ODPP.

g. The right to seek compensation: The right to seek compensation through the Courts if you suffer damage due to a contravention of the DPA by the ODPP.

You may contact the ODPP, using the contact details listed below, to request access to your personal data or exercise any other rights provided under the DPA. The ODPP will take into consideration circumstances where, under the DPA or other applicable legislation, your rights may be limited or subject to conditions, exemptions or exceptions.

Upon contacting the ODPP, we may need to verify your identity prior to fulfilling a request and may request additional information as required. In accordance with the DPA, the ODPP may also charge a reasonable fee if your request is unfounded or excessive in nature, or reserves the right not to comply with the request at all.

To learn more about your rights, visit www.ombudsman.ky.

When processing your personal data, the ODPP will comply with the eight Data Protection Principles defined within the DPA:

a. Fair and lawful processing: Personal data shall be processed fairly. In addition, personal data may be processed only if certain conditions are met, for example, if the data controller is subject to a legal obligation that requires the processing or if the processing is necessary for exercise of public functions.

b. Purpose limitation: Personal data shall be obtained only for one or more specified, explicit and legitimate purposes, and not processed further in any manner incompatible with that purpose or those purposes.

c. Data minimisation: Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are collected or processed.

d. Data accuracy: Personal data shall be accurate and, where necessary, kept up-to-date.

e. Storage limitation: Personal data processed for any purpose shall not be kept for longer than is necessary for that purpose.
ODPP External Privacy Notice V1.0 6

f. Respect for the individual’s rights: Personal data shall be processed in accordance with the rights of data subjects under the DPA, including subject access.

g. Security – confidentiality, integrity and availability: Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

h. International transfers: Personal data shall not be transferred to a country or territory unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

The ODPP has appointed a Data Protection Leader. If you have any questions about this Privacy Notice or how your personal data is handled, or if you wish to make a complaint, please contact:

Telephone number: +1 345 949 7712
Email Addresses: foi.dpp@gov.ky to make Data Subject Access or dpp.complaints@gov.ky for all other matters
Address: P.O. Box 2328, George Town, KY1-1106 |2nd Floor, Building 3, Bermuda House, Cayman Financial Centre, Dr. Roy’s Drive, George Town.

The ODPP aims to resolve enquiries and complaints in a respectful and timely manner.

The ODPP reserves the right to update this Privacy Notice at any time and will publish a new Privacy Notice when we make any substantial updates. From time to time, the ODPP may also notify you about the processing of your personal data in other ways, including by email, through our publications, and on websites.