External Privacy Notice

The Government Communications Service led by the DOC is the Civil Service functional and professional body for people working in communication roles across the public sector. We hold expertise in all communications disciplines and are made up of collaborating units, each leading on various functions to produce the very best in modern-day, inclusive, informative and creative communications.

Led by the Director of Communications, the DOC supports Government priorities, enables the effective operation of public services and makes the lives of those we serve better. The role of Government Communications is to drive public trust and engagement in government priorities through audience driven campaigns, content and channels.

In delivering on our mission, the DOC may use your personal data for the following purposes:

a.     Implementing policies, providing services and programmes, and managing your relationship with us;

b.     Responding to your enquiries;

c.     Verifying your identity;

d.     Measuring how users interact with the DOC’s website, GOV.KY, (including by aggregating personal data collected using cookies) and other CIG channels to continually improve how we communicate with our audiences;

e.     Communicating and interacting with website visitors and social media users;

f.      Sending you marketing communications;

g.     Communications and public relations activities, including sending you marketing communications;

h.     Media relations activities;

i.      Publishing notices in the Gazette where required or authorised by law or by the Governor in accordance with the Official Gazette Act (1997 Revision), e.g. relating to the appointment of liquidators, declaration of prohibited immigrants by the Cabinet, applicants for probate, appointment/reappointment/revocation of appointment of members of statutory bodies (i.e. boards, committees, commissions, tribunals, authorities, councils and similar) by the Cabinet, and other individuals whose personal data are included within commercial and government notices that have been submitted for publication in the Gazette;

j.      Coordinating and leading the public communicators community of practice and supporting individual public servants working in the communications profession across the public sector;

k.     Statistical and other reporting, both internally and externally;

l.      Seeking legal advice, and exercising or defending legal rights;

m.   Complying with our legal obligations, including all legislation that applies across the public sector, e.g. legislation that provides for records and information management;

n.     Ensuring other agencies are able to carry out their public functions if it is necessary for us to disclose your personal data directly to them, including to verify information you have provided;

o.     Reporting a suspected crime or other breach of the law, or assisting a law enforcement agency or other competent authority in the course of an investigation; and 

p.     Disclosing and/or publishing records held by the DOC if we are required to do so under the Freedom of Information Act (2021 Revision). If we receive a Freedom of Information (“FOI”) request for records that include your personal data, we will always consult with you in writing if we are considering disclosing any of your personal data and you will also have the right to appeal our final decision to the Ombudsman if you have not provided your consent for the disclosure

The DOC may share your personal data as required, including under applicable legislation, with recipients that include joint data controllers, our data processors, and third parties. We will only share your personal data as permitted by the DPA and in accordance with other applicable laws and policies.

Your personal data may be shared with the following types of recipients:

a.     Other public authorities: Personal data may be shared with other CIG ministries, portfolios, offices, departments, statutory authorities, statutory bodies and government companies as required or permitted by law and for one or more of the purposes set out in this Privacy Notice. In particular, the DOC may share any submissions you may make through GOV.KY or any of our social media channels if the content you have provided relates to another public authority and requires an action or response. If we collect your personal data through cookies on our website and analytics tools, we will not share the data in a way that could identify you unless sharing the identifying information is necessary and has a legal basis, e.g. for the Royal Cayman Islands Police Service or another law enforcement agency to detect and investigate breaches of the law.

b.    Data processors external to the CIG: Personal data may be shared with our service providers. When acting as data processors, our service providers are only able to use personal data under our instructions. We engage Data Processors for a variety of activities, which may include:

1. Webhosting;
2. Information Technology;
3. Records and Information Management, including storage facilities;
4. Communications;
5. Marketing and campaigns;
6. Events management; and
7. Security operations and fraud prevention.

In limited circumstances, service providers who act as data processors for the DOC may also act as a separate data controller in relation to their own purposes for processing your personal data, e.g. to provide customer support, or for analytics or machine learning in order to improve their services. These are unrelated to the purposes for which the DOC processes your personal data and this use of your personal data should be clearly and directly disclosed to you by the service provider through their own separate privacy notice. However, you may contact us to ask about our current service providers and specific instances, if any, that we are aware of where your personal data may be processed for a service provider’s own purposes.

c.     Legal advisors and other persons if required by law or in relation to legal proceedings or rights: Personal data may be disclosed as legally required, for the purpose of or in connection with proceedings under the law, if necessary to obtain legal advice, or if the disclosure is otherwise necessary to establish, exercise or defend legal rights. This may include disclosing your personal data for the following purposes:

1. Seeking legal advice;
2. Exercising or defending legal rights;
3. Complying with audits or investigations by competent authorities; and
4. Complying with information security policies or requirements.

d.    With other third parties: Personal data may be disclosed to other third-party recipients for the purposes set out in this Privacy Notice and in accordance with the DPA.

Depending on applicable laws and other circumstances, the DOC will rely on specific legal bases, or “conditions of processing”, under the DPA to process your personal data. These may include:

a.     A legal obligation to which the DOC is subject, e.g. as the appointed Editor of the Gazette we are legally required to publish the Gazette in accordance with the Official Gazette Act (1997 Revision), and as a public agency we are required to make and maintain complete and accurate public records in accordance with the National Archive and Public Records Act (2015 Revision);

b.     To exercise public functions, including those of the DOC as the functional and professional body for communications across the CIG;

c.     To protect your vital interests;

d.     Your consent, e.g. to send marketing communications or to administer surveys and polls; and

e.     For the purposes of legitimate interests pursued by the DOC or by a third party or parties to whom the personal data may be disclosed, e.g. when broadcasting or publishing photographs and videos taken at public events on our digital channels, or when responding to FOI requests or to enquiries from law enforcement agencies and other competent authorities.

If we process your sensitive personal data, we will also meet a second legal basis. These may include:

1. To exercise our public functions;
2. To protect your vital interests or those of another individual;
3. In relation to legal proceedings, including obtaining legal advice and otherwise establishing, exercising or defending legal rights;
4. If you have taken steps to make the personal data public; and
5. Your consent.

The DOC has put in place appropriate technical, physical and organisational measures in order to keep your personal data secure. These safeguards to maintain the confidentiality, integrity and availability of your personal data may include:

a.     Developing and maintaining written plans to identify, prevent, detect, respond to, and recover from security threats, events and incidents;

b.     Developing robust authentication procedures for accessing all systems that store personal data;

c.     Administrative and technical controls to restrict access to personal data on a “need to know” basis;

d.     Partnering with other government entities to maintain systems, software and applications, anti-virus software, firewalls, and other computer security safeguards, and appointing appropriate personnel to be responsible for keeping such safeguards up to date, including through actions such as patching, license renewals/expiry monitoring, system health checks and account/user access management;

e.     Contractually requiring that our Data Processors maintain appropriate security measures;

f.      Maintaining appropriate records of access to and processing of personal data;

g.     Ensuring employees are trained on security policies and measures that have been implemented;

h.     Using appropriate measures, such as encryption, pseudonymisation and chain of custody records, to protect personal data, including when stored on laptops, tablets and other storage devices;

i.      Utilising appropriate and secure methods to destroy personal data as legally required; and

j.      Taking other reasonable measures as required at any time by legislation, rules and policies.

The DOC will not transfer personal data to countries or territories that do not ensure an adequate level of protection for personal data. We will only transfer your personal data to a country or territory that ensures an adequate level of protection for your rights and freedoms in relation to the processing of your personal data, unless there is a relevant exemption or exception under the DPA. Exceptions may include your consent or appropriate safeguards.