The Ombudsman in Cayman, Sandy Hermiston, has ordered the Department of Agriculture (DoA) to stop collecting personal data from customers purchasing retail goods and to delete any personal data collected without a legal basis.

Hermiston gave the order after a member of the public submitted a complaint stating that the DoA was unnecessarily collecting personal data from individuals purchasing retail goods such as plants and trees.

The information collected included the person’s name, street address, postal address, email address and telephone contact.

The Ombudsman has further said that the DoA must also provide a privacy notice when collecting personal data.

According to the Ombudsman, the DoA had no privacy notification process to inform its customers who was processing the information or the specific purposes for which that information was being processed.

She also found the DoA had no legal basis for processing the personal data of its customers and that collecting the data listed above for a simple retail purchase was unnecessary and excessive. The full text of the order can be found here:

The DoA was given 30 days to action the required changes. As with all enforcement orders made under the Data Protection Act, the entity against which the order is made has 45 days to comply or seek judicial review of the Ombudsman’s decision.

“In every transaction, whether in the public or private sector, a data controller should collect only the minimum personal data needed for a specified purpose,” Hermiston said.

“Customers have a right to know who is processing their information, for what purpose, and all processing must be conducted fairly and legally,” Hermiston added.