Important Changes to WORC Services

Our Ref: DP6

Dear Customer,

Re: Notice of Personal Data Breach

Workforce Opportunities and Residency Cayman (“WORC”) respects your privacy and takes care in processing your personal data. Pursuant to section 16 of the Data Protection Act (2021 Revision) (“DPA”), we are notifying you that you may have been subject to a personal data breach. A personal data breach means “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or, access to, personal data transmitted, stored or otherwise processed”. In this case, personal data belonging to some of our customers, who are work permit holders, was accidentally disclosed to a third party. The incident was immediately contained and we have no reason to believe that you are at a risk of harm. We want to be transparent about what happened and explain what this notification means, how the breach happened, and what we have done as a result. 

 What is personal data? According to the DPA - “personal data” means data relating to a living individual who can be identified and includes data such as —  (a) the living individual’s location data, online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the living individual;   (b) an expression of opinion about the living individual; or  (c) any indication of the intentions of the data controller or any other person in respect of the living individual;

 What personal data may have been disclosed?

Your work permit details including name, date of birth, occupation and employer. 

 When and how did this personal data breach occur?

The breach occurred on 17^th September 2024 at approximately 9:34am, whereby, in the course of responding to a Freedom of Information request for work permit holder statistics, your name, date of birth, occupation and employer may have inadvertently been included in the statistics that were sent to the FOI applicant. Within minutes of receiving the spreadsheet from us, the applicant called to inform us that additional categories of information were provided that they should not have access to. The applicant assured us that they called us right after they opened the record and that they did not further explore or access the spreadsheet. While on the phone they also confirmed that they had deleted all traces of the record. The applicant has professional obligations of confidence and recognizes the duty of confidence owed to our customers and which prohibit any further use or disclosure of the information that they may recall. This was a procedural error where the individual staff member who would normally run such reports was not available and another staff member assisted to run the report but did not remove the additional categories. It should have been caught and addressed during a secondary screening but was not.  

 What has WORC done to address this data breach?

We have taken the following measures to address the breach:

• We spoke with the applicant who received the record and have confirmation that it was only a small portion of the file that was viewed briefly and was deleted in its entirety. 

• We investigated the cause of the breach and are updating our procedures

• We are scheduling mandatory data protection training for all staff

• Notified the Ombudsman as required under the DPA

 

How does this data breach impact or potentially impact you? What actions can you take to help protect yourself?

We have no reason to believe that there are any possible adverse effects of the breach for you personally.

 On behalf of WORC I apologise that our security measures did not prevent this breach, but as a

Department, we take these matters very seriously and are committed to continually improving our privacy practices through training of staff and improvement of our technical framework. 

 If you have any questions about this personal data breach, please email WorcDataProtection@gov.ky . Please also note that if you believe that our handling of personal data or this personal data breach is not being carried out in accordance with the provisions of the DPA, you can make a complaint to the Office of the Ombudsman by visiting https://ombudsman.ky/data-protection where you will find information to guide you through the complaints process.

 

General Notice to Data Subjects