Privacy - National Council for Persons with Disabilities
NCPD External Privacy Notice
Responsibility
Data Protection Leader ("DPL")
Revision Description
Author
Aubrey Bodden
Version
Version Control Notice:
This document is a controlled document that supersedes all previous versions. Please discard any previous copies of this document dated prior to the version and publication date noted above this page.
Anyone who obtains an electronic or printed version of this document is responsible for ensuring that they have the latest version. The latest version of this document is available on the Cabinet Office L: Drive and can also be obtained by email on request to the Cabinet Office Data Protection Leader as set out in section 11.
1. Scope
The National Council for Persons with Disabilities (“NCPD”) respects your privacy and takes care in protecting your personal data. As a data controller, we comply with the Cayman Islands Data Protection Act (2021 Revision) (the “DPA”). This privacy notice (“Privacy Notice”) demonstrates our commitment to ensuring your personal data are handled responsibly and applies to the NCPD, which has been established pursuant to section 3 of the Disabilities (Solomon Webster) Act, 2016 (the “Act”).
The NCPD consists of members appointed by the Cabinet, which include persons with disabilities, representatives of private sector or non-Governmental advocacy or service organisations that work for the rights of persons with disabilities, public officers with substantial knowledge and/or experience in relevant areas, and an attorney-at-law. The Cabinet also appoints an Executive Secretary to manage the affairs of the NCPD in accordance with applicable legislation, NCPD directives and NCPD policies. The Executive Secretary is an employee of the Cabinet Office.
2. What Personal Data We Collect
The NCPD collects personal data, including sensitive personal data, directly from you and also indirectly from third party sources. Personal data collected by the NCPD is limited to what is necessary for our processing activities. In this Privacy Notice, personal data means any data relating to an identified or identifiable living individual and includes your name, contact details, educational and/or employment status and history, medical data, data about your physical or mental health, information about your family status, opinions about you, expressions of opinion you may share with us, and any indication of the intentions of the NCPD or any other person in relation to you.
The NCPD may collect the following information:
Personal data that you provide when you contact us by email or telephone, or when you visit the NCPD secretariat offices for a scheduled meeting at the Government Administration Building in Grand Cayman;
Personal data that you provide when you access any services that are offered by the NCPD;
Personal data that you provide through the NCPD website, disabilitycouncil.gov.ky, which may include:
i. Your Internet Protocol (“IP”) address, details of which device or version of web browser you used to access our website content, and other information about how you used our website; and
ii. Personal data within comments and questions, including your name and/or email address if you provide these details in a web form. If you ask questions about our public services and programmes or provide information about why you are contacting us, this may also reveal other personal data, e.g. your employment or education status, health information, or family relationships;
Personal data that you provide when interacting with the NCPD on Facebook, @DisabilityCouncilCayman;
Personal data that may be provided by a member of your family, a government entity, or some other person who is closely connected to you or is currently providing you with relevant services. Third parties may contact us through any of the avenues described in paragraphs (a) to (d) above, e.g. your parent or legal guardian may contact the NCPD on your behalf via email in relation to our functions; and
Any other personal data where the collection is necessary to achieve our lawful purpose(s).
3. How We Use Your Personal Data
In accordance with the Cayman Islands Disability Policy (2014-2033) (the “Policy”), the NCPD performs various functions as may be necessary for the purpose of —
reinforcing and promoting recognition and acceptance within the Cayman Islands of the principle that a person with a disability, has the same fundamental rights as a person who does not have a disability;
promoting the dignity and autonomy of persons with disabilities, including their freedom of choice and independence;
ensuring full and effective participation in the Islands for persons with disabilities on an equal basis with persons who do not have disabilities;
promoting respect for, and acceptance of, persons with disabilities;
serving as a ‘watchdog’ on disability matters in the community; and
monitoring the implementation of the Policy.
In carrying out our functions, the NCPD adopts a consultative approach in relation to the community of persons with disabilities and other critical stakeholders.
The NCPD may use your personal data for the following purposes:
a. Responding to your enquiries, which may also require verifying your identity;
b. Carrying out our functions under the Act and the Policy;
c. Statistical and other reporting, both internally and externally (the NCPD does not currently maintain statistics in relation to contact from members of the public and will never publish statistics that include any personal data relating to individuals who are identified or identifiable);
d. Seeking legal advice, and exercising or defending our legal rights; and
e. Complying with our legal obligations, including all legislation that applies across the public sector, e.g. legislation that provides for records and information management, financial management and audit.
4. How We Share Your Personal Data
The NCPD will only share your personal data as permitted by the DPA. We may share your personal data as required, including under applicable legislation, with recipients that include our data processors and third parties. Your personal data may be shared with the following recipients, including those that support our operations:
With other public authorities: Personal data may be shared with other public authorities – here, “public authorities” means Ministries, Portfolios, Offices, Departments, Statutory Authorities, Statutory Bodies and Government Companies – for the purposes set out in this Privacy Notice. In the process of assisting you with a specific enquiry or complaint that you have made to us, and particularly if you have sought to involve the NCPD in your communications with the public authority, the NCPD may share your personal data with the Ministry of Social Development & Innovation, Department of Children & Family Services, Sunrise Adult Training Centre, Department of Financial Assistance, Ministry of Education, Department of Education Services, Lighthouse School, Ministry of Health, Health Services Authority, CINICO, Department of Health Regulatory Services, Department of Labour & Pensions, Ministry of District Administration & Lands, Public Lands Commission, Ministry of Planning, Agriculture, Housing, Infrastructure, Transport & Development, Public Works Department, and Elections Office.
With data processors: Personal data may be shared with persons providing services to the NCPD as a data processor in compliance with the DPA. When they are acting as data processors, these service providers are only able to use personal data under our instructions. We engage data processors for a variety of processing activities, which include information technology and records and information management.
With legal advisors and other persons if required by law or in relation to legal proceedings or rights: Personal data may be disclosed as legally required, for the purpose of or in connection with proceedings under the law, if necessary to obtain legal advice, or if the disclosure is otherwise necessary to establish, exercise or defend legal rights. This may include disclosing your personal data for the following purposes:
i. Seeking legal advice;
ii. Exercising or defending our legal rights;
iii. Complying with internal and external audits or investigations by competent authorities; and
iv. Complying with information security policies or requirements.
With other third parties: Personal data may be disclosed to other third-party recipients for the purposes set out in this Privacy Notice and in accordance with the DPA, e.g. private and non-profit educational institutions and training centres, healthcare providers, disability services and support organisations, and health insurance companies.
5. Our Legal Bases for Processing Your Personal Data
Depending on applicable laws and other circumstances, the NCPD will rely on specific legal bases, or “conditions of processing”, under the DPA to process your personal data. These include:
A legal obligation to which the NCPD is subject;
To exercise public functions;
To protect your vital interests;
Your consent; and
For the purposes of legitimate interests pursued by the NCPD or by a third party or parties to whom the personal data may be disclosed.
Where we process your sensitive personal data, we will also meet a second legal basis. These include:
To exercise our public functions;
To protect your vital interests;
Your consent;
In relation to legal proceedings, including obtaining legal advice and otherwise establishing, exercising or defending our legal rights; and
If you have taken steps to make the personal data public.
6. Children’s Personal Data
The NCPD collects personal data relating to children under the age of 18 to enable us carry out our functions. We may collect children’s personal data for any of the purposes set out in section 3 of this Privacy Notice.
7. Security and International Transfers
The NCPD has put in place appropriate technical, physical and organisational measures to keep your personal data secure. These safeguards to maintain confidentiality, integrity and availability of your personal data may include:
Training members of the NCPD, the Executive Secretary, and other individuals who handle personal data on behalf of the NCPD to ensure they are aware of confidentiality obligations and other requirements;
Developing and maintaining written plans to identify, prevent, detect, respond to, and recover from security threats, events and incidents;
Developing robust authentication procedures for accessing all systems that store personal data;
Administrative and technical controls to restrict access to personal data on a “need to know” basis;
Maintaining systems, software and applications, anti-virus software, firewalls, and other computer security safeguards, and taking appropriate measures to ensure these safeguards up to date;
Maintaining appropriate records of access to and processing of personal data;
Using appropriate measures, such as encryption, pseudonymisation and chain of custody records, to protect personal data, including when stored on laptops, tablets and other storage devices;
Utilising appropriate and secure methods to destroy personal data as legally required; and
Taking other reasonable measures as required at any time by legislation, rules and policies.
The NCPD will only transfer your personal data to a country or territory that ensures an adequate level of protection for your rights and freedoms in relation to the processing of your personal data, unless there is a relevant exemption or exception under the DPA. Exceptions may include your consent or appropriate safeguards.
8. How Long We Keep Your Personal Data
The NCPD may store your personal data for as long as we need it in order to fulfil the purpose(s) for which we collected your personal data, and in line with any applicable laws. This includes the National Archive and Public Records Act (2015 Revision), which governs the creation, maintenance and disposal of all public records. For the purposes of this law, NCPD records are held and managed by the Cayman Islands Government Cabinet Office.
Sometimes, we may anonymise your personal data so that it is no longer associated with you.
9. Your Rights
The NCPD will respect and honour your rights in relation to your personal data and implement measures that allow you to exercise your rights under the DPA and other applicable legislation.
In accordance with the DPA, your rights in relation to your own personal data include:
The right to be informed and the right of access: The right to request access to all personal data the NCPD maintains about you as well as supplementary information about why and how we are processing your personal data. This is commonly known as a Data Subject Access Request and certain supplementary information about our processing is contained within this Privacy Notice.
Rights in relation to inaccurate data: The right to request the rectification, blocking, erasure or destruction of any inaccurate personal data the NCPD maintains on you. We will ensure, through all reasonable measures, that your personal data is accurate, complete and, where necessary, up‑to‑date, especially if it is to be used in a decision-making process.
The right to stop or restrict processing: The right to restrict or stop how the NCPD uses your personal data in certain circumstances.
The right to stop direct marketing: The right to cease the use of your personal data by the NCPD for direct marketing purposes.
Rights in relation to automated decision making: The right to obtain information about and object to the use of automated decision making by the NCPD using your personal data. The NCPD does not currently use automated means to make decisions about you. However, if this position changes, we will update this Privacy Notice and we will also notify you in writing as required.
The right to complain: The right to complain to the Ombudsman about any perceived violation of the DPA by the NCPD.
The right to seek compensation: The right to seek compensation through the Courts if you suffer damage due to a contravention of the DPA by the NCPD.
You may contact the NCPD, using the contact details listed below, to request access to your personal data or exercise any other rights provided under the DPA. The NCPD will take into consideration circumstances where, under the DPA or other legislation, your rights may be limited or subject to conditions, exemptions or exceptions.
Upon contacting the NCPD, we may need to verify your identity prior to fulfilling a request and may request additional information as required. In accordance with the DPA, the NCPD may also charge a reasonable fee if your request is unfounded or excessive in nature, or reserves the right not to comply with the request at all.
To learn more about your rights, visit www.ombudsman.ky.
10. Data Protection Principles
When processing your personal data, the NCPD will comply with the eight Data Protection Principles defined within the DPA:
a. Fair and lawful processing: Personal data shall be processed fairly. In addition, personal data may be processed only if certain conditions are met, for example, if the data controller is subject to a legal obligation that requires the processing or if the processing is necessary for exercise of public functions.
b. Purpose limitation: Personal data shall be obtained only for one or more specified, explicit and legitimate purposes, and not processed further in any manner incompatible with that purpose or those purposes.
c. Data minimisation: Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are collected or processed.
d. Data accuracy: Personal data shall be accurate and, where necessary, kept up-to-date.
e. Storage limitation: Personal data processed for any purpose shall not be kept for longer than is necessary for that purpose.
f. Respect for the individual’s rights: Personal data shall be processed in accordance with the rights of data subjects under the DPA, including subject access.
g. Security – confidentiality, integrity and availability: Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
h. International transfers: Personal data shall not be transferred to a country or territory unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
11. How to Contact Us
The Cabinet Office Data Protection Leader provides privacy support to the NCPD. If you have any questions about this Privacy Notice or how your personal data is handled, or if you wish to make a complaint, please contact:
Name: Kim Bullings
Telephone number: +1 345 244 2209
Email Address: foi.cab@gov.ky
Address: Government Administration Building Box 105, 133 Elgin Ave, Grand Cayman KY1-9000
The NCPD aims to resolve enquiries and complaints in a respectful and timely manner.
12. Changes to this Privacy Notice
The NCPD reserves the right to update this Privacy Notice at any time and will publish a new Privacy Notice when we make any substantial updates. From time to time, the NCPD may also notify you about the processing of your personal data in other ways, including by email, through our publications, and on websites.
This Privacy Notice was last updated on 3 March 2025.
