Department of Environmental Health (DEH) Privacy Notice

The Cayman Islands Government Department of Environmental Health (DEH) respects your privacy and, as a joint Data Controller with the Ministry of Health, Environment and Sustainability is committed to protecting your personal data in compliance with the Cayman Islands Data Protection Act (2021 Revision) (the “DPA”).  This Privacy Policy demonstrates our commitment to ensuring that your personal data is handled responsibly.

This Privacy Policy explains the type of personal data we collect when you apply for one of our services, lodge a complaint, or visit our website at: www.gov.ky/deh. It also explains how we use that personal data, including the persons with whom it may be shared, our legal bases for using your data, and how your personal data is protected.

What Personal Data We Collect

DEH collects personal data directly from you and may also collect your personal data indirectly from third party sources. Personal data collected by DEH is limited to what is necessary for our processing activities. Personal Data is information that relates to a living individual who can be identified directly from the information or indirectly when put together with other information. It also includes any expression of opinion or indication of intentions in respect of an individual.

Personal data we collect directly from you

DEH collects the following information directly from you:

a.    Personal data you provide through the DEH page of the gov.ky website, such as:

     i.    Personal data provided when making a complaint or requesting a service from us via the completion of a web form. This includes your name, contact information (telephone number(s) and email address), your location/residence (physical address and mailing address) and any other information you may choose to tell us to help us provide a service to you, another member of the community, or the community as a whole. If you ask questions about our public services and programmes or provide information about your relationship with us, this may also reveal other personal data, e.g. your employment status, health information, or property ownership;

    ii.   Your Internet Protocol (“IP”) address, details of which device or version of web browser you used to access our website content, and other information about how you used our website (see our Cookie Notice for more information https://www.gov.ky/cookies);

b.    Personal data you provide when you visit the DEH offices or other locations operated by DEH, contact DEH customer services by email or telephone, or otherwise access our training programmes and other services, including our online services;

c.    Any additional personal data we may request of you in order to provide one of our services, for example if you have approached us on behalf of a third party, we may need the name and contact information of the person on whose behalf you are acting;

d.    Personal data that you provide when you inquire about, or apply for a job with the DEH (see our Privacy Notice for the processing of personal data relating job applicants and candidates: https://careers.gov.ky/application/custom/English/privacy-statement.html); 

Personal data collected from other sources

DEH will sometimes receive personal data about you indirectly, for example if a third party makes a complaint about a perceived nuisance stemming from your property we may be provided with your name, address and other identifying information. 

Why We Collect It

DEH requires your personal data in order to determine the appropriate actions to take to deliver its remit of protecting the public from environmental health-related hazards and promoting the national environmental health through public education programmes.

How We Use Your Data

The purpose of the Civil Service is to make the lives of those we serve better. We are dedicated to supporting the elected government by delivering caring, modern and customer-centred public services and programmes, which deliver value for money. DEH may use your personal data for the following purposes:

a.    Providing services and programmes to safeguard and promote the national environmental health and the well-being and safety of the public;

b.    Enforcing relevant legal instruments which govern our activities;

c.    Working in collaboration with other government departments/agencies in the prevention or minimisation of factors which impact, or have the potential to impact, negatively on the environmental health of the Cayman Islands;  

d.    Responding to your enquiries;

e.    Communications and public relations activities;

f.     Statistical and other reporting exercises;

g.    Seeking legal advice, and exercising or defending legal rights;

h.    Complying with our legal obligations, including all legislation that applies across the public sector;

i.      Communicating and interacting with job applicants and related third parties (e.g. references) and carrying out recruitment and selection processes; 

How We Share Your Personal Data

DEH may share your personal data as required, including under applicable legislation, with recipients that include joint data controllers, our data processors, and third parties. We will only share your personal data as permitted by the DPA.

Your personal data may be shared with the following recipients that support our public functions and operations:

a.    With other public authorities: Personal data may be shared with other public authorities – here, “public authorities” means Ministries, Portfolios, Offices, Departments, Statutory Authorities, Statutory Bodies and Government Companies – for the purposes set out in this Privacy Notice. More specifically, your personal data may be shared with other government ministries and departments involved in the remediation, resolution, or training activity to which you consented by requesting our services, or in which you applied to participate.

b.    With data processors both internal and external to the CIG: Your data may also be accessed by our technical teams, who act on our behalf, to manage and maintain CIG systems and databases, including the GOV.KY/DEH portal and the EHIS application system. Our technical teams must comply with the requirements of the Data Protection Act (2021 Revision).

c.    With legal advisors and other persons if required by law or in relation to legal proceedings or rights: Personal data may be disclosed as legally required, for the purpose of or in connection with proceedings under the law, if necessary to obtain legal advice, or if the disclosure is otherwise necessary to establish, exercise or defend legal rights. This may include disclosing your personal data for the following purposes:

     i.        Seeking legal advice;

     ii.        Exercising or defending legal rights;

     iii.        Complying with internal and external audits or investigations by competent authorities; and

     iv.        Complying with information security policies or requirements.

We will never rent, sell or share your information with third parties for marketing purposes. 

Our Legal Bases for Processing Your Personal Data

The DEH‘s legal bases or “conditions of processing” for processing your personal information under the DPA include: 

a.    To exercise public functions under the Public Health Act (2021 Revision), the Litter Act (1997 Revision), the Towns and Communities Act (1995 Revision) and the Tobacco Act (2008) , e.g. to mitigate nuisances and collect and dispose of waste/garbage

b.    To perform or enter into a contract with you, e.g. service contract;

c.    In relation to legal proceedings, including obtaining legal advice and otherwise establishing, exercising or defending legal rights;

d.    The fulfilment of any legal obligations to which DEH is subject under the enactments listed at paragraph a. above and to comply with various obligations under the Procurement Act, 2016 and Procurement Regulations (2022 Revision), the Public Management and Finance Act (2020 Revision) and Financial Regulations (2022 Revision), the Public Service Management Act (2018 Revision) and Personnel Regulations (2022 Revision), and the National Archive and Public Records Act (2015 Revision).

Children's Privacy Protection

Unless explicitly stated or implied through the content on this site, our services are not intended for, or intentionally targeted at, children 16 years of age or younger. We do not knowingly collect or maintain data about anyone under the age of 16.

How Long We Keep Your Data

We will only retain your personal data for as long as we need it in order to fulfil the purposes for which we collected your data, and in line with any applicable laws. This includes the National Archive and Public Records Act (2015 Revision), which governs the creation, maintenance and disposal of all public records. Sometimes, we may anonymise your personal data so that it is no longer associated with you.

Where Your Data Is Processed and Stored

• Our applications are hosted by the Cayman Islands Government's Computer Services Department (CSD) and Brac Informatics. All personal data provided in the course of using our applications will be stored securely in CSD's datacentres in the Cayman Islands, and with Brac Informatics datacenter also in the Cayman Islands.
• The data is processed using the software installed through a license purchase agreement on Cayman Islands Government owned infrastructure.

How We Protect Your Data

We are committed to protecting your data. We take appropriate administrative, technical and physical measures to keep your personal data confidential and secure from loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction.

All files are stored securely in accordance with our internal policies and procedures regarding storage of, access to and disclosure of personal data. We may keep your personal data in our electronic systems, in the systems of our Data Processors, or in paper files.

Systems and processes exist to prevent unauthorised access to, or disclosure of, your data. We take all possible steps to protect the information we hold, about you (on paper and electronically) in a secure way, and we will only make them available to those who have a right to see them. Examples of our security include:

• Controlling access to systems and networks - allows us to prevent people not permitted to view your personal information from gaining access to it.
• Staff Training - allows us to make all our staff aware of how to handle information and how to report incidents or issues regarding the use of information.
• Regular testing of our IT systems - ways of working including keeping up to date on the latest security updates and training all our staff on protecting and using information securely.

We ensure that we use service providers that comply with the DPA.

What Are Your Data Protection Rights?

We want to make sure you are fully aware of all of your data protection rights. Every individual whose personal data is processed by the DEH is entitled to the following:

• The right to be informed and to have access - You have the right to know why and how we are processing your personal information and to request copies of your personal data and other information related to our processing.
• The right to rectification - You have the right to request that we correct any information you believe is inaccurate, and to ensure it is complete or up to date.
• The right to erasure - You have the right to request that we erase, block, or destroy any inaccurate personal data DEH maintains on you.
• The right to stop or restrict processing - You have the right to request that we stop or restrict the processing of your personal data, under certain conditions, such as the withdrawal of an application for employment.
• The right to complain - You have the right to complain to us or the Ombudsman if you believe we are processing your personal data in a way that breaches the Data Protection Act.

·         The right to seek compensation: The right to seek compensation in the Court if you suffer damage due to a contravention of the DPA by the DEH.  

How To Contact Us

You can submit any questions about this privacy policy or complaints regarding handling of personal data to us at DEH-PDM@gov.ky. We will ensure that where appropriate any questions or complaints are addressed, or referred to the relevant joint controller.

Information about the Cayman Islands Data Protection Act, including how to complain to the Ombudsman is available at: ombudsman.ky/data-protection.

Changes To This Privacy Policy

The DEH reserves the right to update this Privacy Policy at any time and will publish a new Privacy Policy after any substantial updates.  You may also be notified about the processing of your personal data in other ways, including via email, publications, or public service announcements

Last Update: 21 May 2025