Cayman Islands

Section 228A makes it an offence, liable on conviction on indictment to fifteen years' imprisonment, to possess, take, make, distribute or show an indecent photograph or pseudo-photograph of a child.

A pseudo-photograph is defined as an image, whether made or produced by computer-graphics or otherwise, which appears to be a photograph, and is treated as showing a child if the impression it conveys is that the person shown is a child, even where some physical characteristics shown are those of an adult.

Section 228B separately criminalises making, publishing, transmitting, distributing, selling, advertising, importing, exporting, possessing or accessing child pornography, defined to include a realistic image representing a child engaged in sexually explicit conduct, whether or not the image depicts an actual child.

The making, possession or access offence carries fifteen years' imprisonment, and the transmission, distribution, sale, advertising, import or export offence carries twenty-five years. The commencement date of these provisions is not stated in the text read; they are in force as part of the current 2019 Revision.

On a personal data breach, a data controller must, without undue delay and no more than five days after it should reasonably have become aware of the breach, notify both the affected data subject and the Ombudsman, describing the nature and consequences of the breach, the measures taken or proposed to address it, and the measures recommended to the data subject to mitigate adverse effects. Failing to notify is an offence.

The Act binds a data controller established in the Islands, or one processing personal data in the Islands otherwise than in transit, to collect personal data fairly and lawfully, hold it only for specified purposes, keep it accurate, and secure it against unauthorised access.

A data subject may access personal data held about them, require a controller to stop processing or to stop processing for direct marketing, and object to a decision based solely on automated processing of their personal data that significantly affects them. A person who suffers damage from a data controller's contravention of the Act has a statutory cause of action for compensation.

The eighth data protection principle bars transferring personal data to a country or territory that does not ensure an adequate level of protection for the rights and freedoms of data subjects. Schedule 4 lists transfers to which this principle does not apply, including a transfer with the data subject's consent, one necessary to perform a contract with the data subject, one made on terms the Ombudsman approves as ensuring adequate safeguards, and one the Ombudsman has itself authorised.

The Office of the Ombudsman enforces the Act. A judge may grant the Ombudsman a warrant to enter and search premises and inspect or seize equipment and documents where there are reasonable grounds to believe a data controller has contravened the data protection principles or committed an offence.

The Ombudsman may serve a data controller with a monetary penalty order, capped at two hundred and fifty thousand dollars, for a serious contravention likely to cause substantial damage or distress, after a twenty-one day notice-of-intent period. A general offence under the Act is liable, except where the Act otherwise provides, to a fine of ten thousand dollars on summary conviction or twenty thousand dollars on conviction on indictment.

Section 29A of the United Kingdom's Copyright, Designs and Patents Act 1988, inserted in the United Kingdom on 1 June 2014 and not among the provisions the Copyright (Cayman Islands) Order 2015's Schedule excludes or modifies, extends to the Cayman Islands as part of Part 1's general extension.

It permits a person with lawful access to a work to make a copy for the sole purpose of a non-commercial-research computational analysis of anything recorded in the work, with a sufficient acknowledgement, but the copy may not be transferred to anyone else or used for any other purpose without the copyright owner's authorisation, and any subsequent dealing with it is treated as an infringing copy. A contract term purporting to prevent or restrict the making of such a copy is unenforceable.

The Copyright (Cayman Islands) Order 2015 extends Part 1 of the United Kingdom's Copyright, Designs and Patents Act 1988 to the Cayman Islands, subject to exclusions naming sections 44A, 73A, 98, 114B, 144, 144A, 157, 158, 166A to 166D, 172A and 177, paragraphs 13, 21, 34, 36 and 37 of Schedule 1, and Schedule A1, and to the modifications in Part 2 of the Order's Schedule.

Section 3 is not among the excluded or modified provisions, so it extends as in the United Kingdom Act: a database is a protected category of literary work in its own right, alongside a table or compilation other than a database, both eligible for copyright as literary works. The Order does not extend the separate United Kingdom regulations creating a sui generis database right, and no evidence of a separate extension of that right to the Cayman Islands was found.

Section 30 of the United Kingdom's Copyright, Designs and Patents Act 1988 is not among the provisions the Copyright (Cayman Islands) Order 2015's Schedule excludes or modifies, so it extends to the Cayman Islands as part of Part 1's general extension.

Fair dealing with a work for criticism or review, or for reporting current events, does not infringe copyright provided it is accompanied by a sufficient acknowledgement, except that no acknowledgement is required for reporting current events by sound recording, film or broadcast where this would be impracticable.

A separate quotation exception permits using a quotation from a work that has been made available to the public, for criticism, review or otherwise, provided the quotation is no longer than the specific purpose requires and is accompanied by a sufficient acknowledgement.