Customs and Border Control External Privacy Notice

1. Scope

The Cayman Islands Customs and Border Control Service, (“CBC”), respects your privacy and takes care in protecting your personal data. As a data controller, we comply with the Cayman Islands Data Protection Act (2021 Revision) (the “Cayman Islands DPA” or “DPA”). This privacy notice (“Privacy Notice”) demonstrates our ongoing commitment to ensuring your personal data is handled responsibly as it applies to CBC.

2. What Personal Data We Collect

CBC collects personal data, including sensitive personal data, directly from you and may also collect your personal data indirectly from third party sources. Personal data collected by CBC is limited to what is necessary for our processing activities. In this Privacy Notice, personal data includes any data relating to an identified or identifiable living individual and includes:

• Your Flight Arrival Details;
• Your passport country of issue, number, and dates of issue/expiry;
• Money Declarations or Disclosures;
• Particulars of Traders;
• Particulars of Import and Export Activity and;
• Particulars supplied or collected for purposes of making an application for other CBC Services and products.

Personal data we collect directly from you

CBC collects the following information directly from you:

• Personal data you provide through the CBC website when using online systems provided by CBC. These systems include Customs Online System, Extension Online and Visa Online;
• Personal data that you provide during travel if using an Automated Border Control Kiosk such as your real-time photo; your address while in the Cayman Islands and your home address;
• Personal data that you provide when you contact us by email, online form or telephone;
• Personal data that is provided on application documents or images, such as your photo, sent to us by email, or uploaded to our servers;
• Personal data provided within comments and questions, including your name and/or email address if you provide these details in our web forms. If you ask questions about our public services or provide information about your relationship with us, this may also reveal other personal data, e.g. your employment status, previous encounters with law enforcement, or commercial ownership;
• Personal data you provide when you visit CBC offices and other locations, contact us by email or telephone, or access our services, including our online services;

Personal data that you provide when you inquire about employment with CBC;

• Personal data collected via CCTV at CBC premises, including images via cameras at each location open to the public and; images with audio via cameras at CBC locations used for the collection of Government revenue, processing passengers; and through any other lawful and appropriate security and monitoring systems such as, for the welfare and safety of persons being detained.
• Any information you choose to provide when interacting with CBC on social media platforms, including Facebook at https://www.facebook.com/CICBCService/?locale=en_GB

Personal data collected from other sources
CBC collects the following personal data from other sources:

• Personal data collected from Other Law Enforcement Agencies to Secure our Borders;
• Personal data collected from Industry Partners such as Airlines and Cruise Ships for the detection and prevention of crime;
• Personal data collected from other local Government Authorities to assist with deciding on an application you submitted, or other matters in the interest of the public good;
• Personal data collected via CCTV at CBC premises, CCTV data disclosed to CBC by the relevant Authority e.g. Airports Authority or Port Authority, as the initial Data Controller that collected the footage at the premises and;
• Any other personal data where the collection is necessary to achieve our lawful purpose(s).

3. How We Use Your Personal Data

The purpose of the Civil Service is to make the lives of those we serve better. We are dedicated to supporting the elected government by delivering caring, modern and customer-centred public services and programmes, which deliver value for money. CBC may use your personal data for the following purposes:

• Implementing policies, providing services, and managing your relationship with us;
• Responding to your inquiries;
• Verifying your identity;
• Communications and public relations activities;
• Managing accounts payable and receivable, preventing fraud, and protecting public funds;
• Statistical and other reporting, both internally and externally;
• Seeking legal advice, and exercising or defending legal rights;
• Complying with our legal obligations, including all legislation that applies across the public sector and;
• Communicating and interacting with job applicants and related third parties (e.g. references) and carrying out recruitment and selection processes.

4. How We Share Your Personal Data

CBC may share your personal data as required, including under applicable legislation, with recipients that include joint data controllers, our data processors, and third parties. We will only share your personal data as permitted by the Cayman Islands DPA.

Your personal data may be shared with the following recipients that support our public functions and operations:

a. With other public authorities: Personal data may be shared with other public authorities – here, “public authorities” means Ministries, Portfolios, Offices, Departments, Statutory Authorities, Statutory Bodies and Government Companies – for the purposes set out in this Privacy Notice.

b. With data processors external to the CIG: Personal data may be shared with persons providing services to CBC as a data processor in compliance with the Cayman Islands DPA. When they are acting as data processors, these service providers are only able to use personal data under our instructions and may include: International Law Enforcement Entities to conduct background checks for the prevention of crime, or to apprehend persons who are suspected of committing a crime.

c. With legal advisors and other persons if required by law or in relation to legal proceedings or rights: Personal data may be disclosed as legally required, for the purpose of or in connection with proceedings under the law, if necessary to obtain legal advice, or if the disclosure is otherwise necessary to establish, exercise or defend legal rights. This may include disclosing your personal data for the following purposes:

i. Seeking legal advice;
ii. Exercising or defending legal rights;
iii. Complying with internal and external audits or investigations by competent authorities and;
iv. Complying with information security policies or requirements.

d. With other third parties: Personal data may be disclosed to other third-party recipients for the purposes set out in this Privacy Notice and in accordance with the DPA.

5. Our Legal Bases for Processing Your Personal Data

Depending on applicable laws and other circumstances, CBC will rely on specific legal bases, or “conditions of processing”, under the Cayman Islands DPA to process your personal data. These may include:

• A legal obligation to which CBC is subject, and to comply with various obligations under the:

a. Advance Passenger Information Act (2018 Revision),

b. Animals Act (2015 Revision),

c. Anti-Money Laundering (Amendment) Regulations (2020 Revision),

d. Anti-Money Laundering Regulations (2018 Revision),

e. APIS Amendment Act (2018 Revision),

f. Customs and Border Control Act (2024 Revision),

g. Customs and Border Control (Money Declarations and Disclosures) Regulations (2019 Revision),

h. Customs and Border Control (Prohibited Goods) Order 2024,

i. Customs and Border Control (Visas, Entry and Landing) Regulations (2019 Revision),

j. Customs (Bonded Warehouses) (Amendment) Regulations (2020 Revision),

k. Customs (Bonded Duty-Free Shop) Regulations (2020 Revision),

l. Customs Regulations (2011 Revision),

m. Customs Tariff Act (2023 Revision),

n. Customs Tariff (Amendment of Schedule 2) Order 2024,

o. Education Act (2024 Revision),

p. Endangered Species (Trade and Transport) Act (2017 Revision),

q. Financial Regulations (2022 Revision),

r. Fire Arms (Amendment) Act (2024 Revision),

s. Health Practice Act (2021 Revision),

t. Misuse of Drugs Act (2017 Revision),

u. National Archive and Public Records Act (2015 Revision),

v. Pharmacy (Poisons and Restricted Pharmaceuticals) Regulations (2017 Revision),

w. Proceeds of Crime Act (2020 Revision),

x. Procurement Act, 2016 and Procurement Regulations (2022 Revision),

y. Proliferation Financing (Prohibition) Act (2017 Revision),

z. Public Management and Finance Act (2020 Revision),

aa. Public Service Management Act (2018 Revision) and Personnel Regulations (2022 Revision) and;

bb. Terrorism Act (2018 Revision).

• To exercise public functions, including the functions of CBC to Secure Borders, Collect Government’s Revenue and Trade Facilitation;
• For the purposes of legitimate interests pursued by CBC or by a third party or parties to whom the personal data may be disclosed, e.g. when disclosing records containing third party personal data in response to a request submitted under the Freedom of Information Act (2021 Revision).

Where we process your sensitive personal data, we will also meet a second legal basis. These may include:

a. To exercise our public functions;

b. In relation to legal proceedings, including obtaining legal advice and otherwise establishing, exercising or defending legal rights; and

6. Children’s Personal Data

CBC collects personal data relating to children under the age of 18 to enable us to deliver public services and carry out our functions. We may collect children’s personal data for any of the purposes set out in section 3 of this Privacy Notice.

7. Security and International Transfers

CBC has put in place appropriate technical, physical and organisational measures in order to keep your personal data secure. These safeguards to maintain the confidentiality, integrity and availability of your personal data may include data processing agreements, documented data transfer and approved transfer mechanisms.

CBC will not transfer personal data to countries or territories that do not ensure an adequate level of protection for personal data. We may transfer your personal data outside of the Cayman Islands to:

a. Barbados, where millions of records relating to air and sea passengers are screened by the CARICOM IMPACS Joint Regional Communications Centre.

b. France, where personal information relating to persons arriving to the islands may be screened against criminal databases maintained by the International Criminal Police Organization (INTERPOL).

We will only transfer your personal data to a country or territory that ensures an adequate level of protection for your rights and freedoms in relation to the processing of your personal data, unless there is a relevant exemption or exception under the Cayman Islands DPA. Exceptions may include your consent or appropriate safeguards.

8. How Long We Keep Your Personal Data

CBC may store your personal data for as long as we need it in order to fulfil the purpose(s) for which we collected your personal data, and in line with any applicable laws. This includes the National Archive and Public Records Act (2015 Revision), which governs the creation, maintenance and disposal of all public records. Sometimes, we may anonymise your personal data so that it is no longer associated with you.

9. Your Rights

CBC will respect and honour your rights in relation to your personal data and implement measures that allow you to exercise your rights under the DPA and other applicable legislation.

In accordance with the DPA, your rights in relation to your own personal data include:

a. The right to be informed and the right of access: The right to request access to all personal data CBC maintains about you as well as supplementary information about why and how we are processing your personal data. This is commonly known as a Subject Access Request and certain supplementary information about our processing is contained within this Privacy Notice.

b. Rights in relation to inaccurate data: The right to request the rectification, blocking, erasure or destruction of any inaccurate personal data CBC maintains on you. We will ensure, through all reasonable measures, that your personal data is accurate, complete and, where necessary, up‑to‑date, especially if it is to be used in a decision-making process.

c. The right to stop or restrict Processing: The right to restrict or stop how CBC uses your personal data in certain circumstances.

d. The right to stop direct marketing: The right to cease the use of your personal data by CBC for direct marketing purposes. CBC does not currently carry out any direct marketing activities. However, we will update this Privacy Notice and we will also notify you in writing as required if this position changes.

e. Rights in relation to automated decision making: The right to obtain information about and object to the use of automated decision making by CBC using your personal data. CBC does not currently use automated means to make decisions about you. However, we will update this Privacy Notice and we will also notify you in writing as required if this position changes.

f. The right to complain: The right to complain to the Ombudsman about any perceived violation of the DPA by CBC.

g. The right to seek compensation: The right to seek compensation in the Court if you suffer damage due to a contravention of the DPA by CBC.

You may contact CBC, using the contact details listed below, to access and review your personal data or to exercise any other rights provided to you under the DPA. CBC will take into consideration circumstances where, under the DPA or other applicable legislation, your rights may be limited or subject to conditions, exemptions or exceptions.

Upon contacting CBC, we may need to verify your identity prior to fulfilling a request and may request additional information as required. In accordance with the DPA, CBC may also charge a reasonable fee in relation to your request if it is unfounded or excessive in nature, or CBC may reserve the right not to comply with the request at all.

To learn more about your rights, visit www.ombudsman.ky.

10. Data Protection Principles

When processing your personal data, CBC will comply with the eight Data Protection Principles defined within the Cayman Islands DPA:

a. Fair and lawful processing: Personal data shall be processed fairly. In addition, personal data may be processed only if certain conditions are met, for example the data controller is subject to a legal obligation that requires the processing or the processing is necessary for exercise of public functions.

b. Purpose limitation: Personal data shall be obtained only for one or more specified, explicit and legitimate purposes, and not processed further in any manner incompatible with that purpose or those purposes.

c. Data minimisation: Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are collected or processed.

d. Data accuracy: Personal data shall be accurate and, where necessary, kept up-to-date.

e. Storage limitation: Personal data processed for any purpose shall not be kept for longer than is necessary for that purpose.

f. Respect for the individual’s rights: Personal data shall be processed in accordance with the rights of data subjects under the DPA, including subject access.

g. Security – confidentiality, integrity and availability: Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

h. International transfers: Personal data shall not be transferred to a country or territory unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

11. How to Contact Us

CBC has appointed a Data Protection Leader. If you have any questions about this Privacy Notice or how your personal data is handled, or if you wish to make a complaint, please contact:

Name: Tamara Reid-Vernon, Assistant Director
Telephone number: 345-949-4579
Email Address: FOI.CBC@gov.ky
Address: 42 Owen Roberts Drive, George Town, Grand Cayman or P.O. Box 898, Cayman Islands, KY1-1103

CBC aims to resolve inquiries and complaints in a respectful and timely manner.

12. Changes to this Privacy Notice

CBC reserves the right to update this Privacy Notice at any time and will publish a new Privacy Notice when we make any substantial updates. From time to time, CBC may also notify you about the processing of your personal data in other ways, including by email or through our publications.