Music and Dancing (Control) (Amendment) Act, 2022 (Act 16 of 2022)

A BILL FOR AN ACT TO PROVIDE FOR THE ESTABLISHMENT, MANAGEMENT AND OVERSIGHT OF A REGISTER FOR THE IDENTIFICATION OF PERSONS; AND FOR INCIDENTAL AND CONNECTED PURPOSES PUBLISHING DETAILS Sponsoring Ministry/Portfolio: Ministry of Investment, Innovation and Social Development (IISD) Memorandum of OBJECTS AND REASONS This Bill provides for the establishment, management and oversight of a population identification register for the Cayman Islands and for incidental and connected purposes. The Bill is divided into nine Parts and contains forty-five clauses. Part 1 contains clauses 1 and 2 and provides for preliminary matters. Clause 1 provides the short title and commencement of the legislation. Clause 2 contains the definitions of certain terms used in the legislation. Part 2 contains clauses 3 to 11 and provides for the establishment of the Identification Register (“the register”). Clause 3 provides for the establishment, purpose and composition of the register. Clause 4 provides for, among other things, the form in which information contained in the register is to be kept and the form in which that information is to be provided to the Registrar. Clause 5 requires the Registrar of the Identification Register (“the Registrar”) to make an entry on the register in respect of Caymanians, permanent residents, persons who are legally and ordinarily resident in the Islands, persons who have participated in a registrable event and any other prescribed persons. This clause also provides for the contents of the entry. Clause 6 enables a person to apply to the Registrar for a copy of the identification information recorded in the register in respect of that person or any other person so prescribed by regulations. Clause 7 requires a registered person or the person’s delegate to inform the Registrar of any information in respect of a registered person that is found to be incomplete, incorrect, misleading or otherwise in need of updating and to request that the Registrar correct or update the information. Clause 8 requires a person to notify the Registrar of changes to certain identity facts and related facts. Clause 9 enables the Registrar to verify the identification information of a registered person, in order to ensure the accuracy of information in the register about the registered person. This clause also allows a requesting entity to request access to the register from the Registrar for the purpose of authenticating or verifying the identity of a person or information provided by an entity. Clause 10 provides for Cabinet to prescribe a system of assurance through which levels of assurance may be applied to identification information. Clause 11 enables the Registrar to authorize a person other than the registered person to access and use the register under the conditions specified in that provision. Part 3 contains clauses 12 to 19 and provides for the appointment, powers and functions of the Registrar. Clause 12 provides for the appointment of the office of the Registrar of the Identification Register who is responsible for keeping and maintaining the register, and the administration of the Act. The Registrar would be a civil servant and hold office in accordance with the Public Service Management Act (2018 Revision). Clause 13 sets out the powers of the Registrar including the power to obtain from persons and public authorities relevant information and documents pertaining to the carrying out of the Registrar’s functions. Clause 14 sets out the duties of the Registrar, which includes the establishment, development and constant review of the register, deciding on the grant, withholding or revocation of access to identification information in the register, and giving instructions of an advisory nature in relation to the application of this legislation. Clause 15 enables the Cabinet to issue general written policy directions to the Registrar in the exercise and performance of the Registrar’s duties as appear to the Cabinet to be necessary in the public interest. Clause 16 specifies that the Registrar is subject to the Public Service Management Act (2018 Revision). The provision also requires the Registrar to make available to the public a report in relation to the information contained in the register, the activities of the office of the Registrar and any other such information as the Registrar considers fit or as the Cabinet may prescribe. Clause 17 enables the Registrar to delegate certain duties under the legislation. Clause 18 requires the Registrar to disclose any actual or potential personal or pecuniary interest, either directly or indirectly, in a transaction or decision being considered by the Registrar or which may impact the performance of the Registrar’s duties under the Act or any other enactment. Clause 19 sets out the circumstances under which the appointment of the Registrar may be terminated. Part 4 contains clauses 20 to 22 and provides for the assignment of an identification code. Clause 20 requires the Registrar, on entering a person’s information in the register, to assign to that person an identification code. The identification code is a unique identifier that is used to identify each person in the register and is personal to the individual to whom it has been issued. The identification code may not be transferred or vested by operation of law in any person other than that individual. Clause 21 provides for the use of the identification code by a registered person. A registered person may use that person’s identification code to access goods or services provided by the Government or the private sector, or for any other purpose for which the authentication of the person’s identity is required. Clause 22 clarifies that a person’s enrolment in the register does not confer on the registered person any right of having the immigration status of a Caymanian or any other immigration status or the right to remain in the Islands. PART 5 - DUTY OF COOPERATION OF PUBLIC AUTHORITIES Part 5 contains clauses 23 to 26 and imposes a duty on public authorities to cooperate with the Registrar. Clause 23 requires a public authority to provide the Registrar with all such information as the Registrar may require for the purpose of carrying out the Registrar’s functions under the legislation. Clause 24 sets out the obligations of persons submitting data for entry in the register, including the requirement to ensure that data is submitted in accordance with identification documents specified in the legislation or any other enactment and the duty to correct errors or mistakes immediately upon their discovery. Clause 25 provides for how the Registrar must deal with a dispute in relation to the accuracy of identification information in relation to a registered person. Clause 26 empowers the Registrar to take measures and submit inquiries in order to obtain any data which is missing from the register in relation to a registered person. Part 6 contains clauses 27 to 30 and deals with access to the register. Clause 27 provides for the right of a person to obtain information from the Registrar in relation to the data entered in the register on that person. Clause 28 allows a requesting entity to request, with the consent of a registered person or the person’s delegate, identification information about the registered person from the register for the purpose of accessing, authenticating or verifying certain facts about a registered person or providing a service to a registered person as required under any other legislation. Clause 29 provides for the access to the register and use of information by public authorities for specified purposes, namely, the carrying out any function under any Act or for research or statistical analysis to facilitate public administration or policy development. Clause 30 requires the Registrar to maintain records of access to information in the register and entitles a registered person to obtain from the Registrar a record of access to that person’s identification information. PART 7 - CONFIDENTIALITY OF THE REGISTER AND DATA ENTERED IN THE REGISTER Part 7 contains clauses 31 to 34 and provides for confidentiality of the register and the data Clause 31 requires that, except in certain prescribed cases, information collected under the legislation in relation to a person in the register may be disclosed only in accordance with the provisions of the legislation and in such manner as may be prescribed by regulations. Clause 32 creates an offence for the unauthorized disclosure of confidential information. Clause 33 provides for the continuing duty of confidentiality to be maintained by a person who has or had a duty under the legislation or a person who is or was employed in the administration of the legislation. Clause 34 requires the Registrar to implement security measures to safeguard the confidentiality of information in the register in order to ensure that the information is secured and protected against use that is not permitted under the legislation and against accidental or intentional destruction, loss or damage. Part 8 contains clauses 35 to 41 and provides for offences under the legislation. Clause 35 prohibits a person from personating another person or a person’s role or function authorized under the legislation or exercising or attempting to exercise authority under the legislation where the person has not been so authorized. A person who contravenes this provision is liable on summary conviction to a fine of ten thousand dollars or to imprisonment for a term of two years, or to both. Clause 36 creates an offence for collecting or attempting to collect identification information without lawful authorization. Clause 37 creates an offence where a person wilfully provides false information to the Registrar, obstructs or impedes the Registrar in the exercise of the Registrar’s functions. Clause 38 specifies certain offences in relation to the register such as unlawfully accessing the register or a registered person’s information in the register. Clause 39 prohibits the tampering of the register. Clause 40 deals with offences which may occur in the registration process such as registering or attempting to enrol more than once in the register and providing false information or making a false statement when submitting information for an entry or modification of an entry. Clause 41 provides for the liability for offences committed by a body cooperate. Part 9 contains clauses 42 to 45 and provides for general matters. Clause 42 provides that no enactment or law prohibiting or restricting the disclosure of information precludes a person from furnishing the Registrar with any information required for the discharge of the Registrar’s functions under the legislation. Clause 43 provides that the Registrar or any other officer authorized by the Registrar shall be protected from liability for any lawful act done, or omission made, in good faith, under the legislation. Clause 44 enables a person aggrieved by a decision of the Registrar to appeal the decision by submitting a written notice of the person’s intention to appeal to the Chief Officer of the Ministry in accordance with the procedure prescribed by regulations. Clause 45 provides for the power of the Cabinet to make regulations for the better carrying out of objects and purposes of the legislation. Clause PART 5 - DUTY OF COOPERATION OF PUBLIC AUTHORITIES PART 7 - CONFIDENTIALITY OF THE REGISTER AND DATA Clause 1 A BILL FOR AN ACT TO PROVIDE FOR THE ESTABLISHMENT, MANAGEMENT AND OVERSIGHT OF A REGISTER FOR THE IDENTIFICATION OF PERSONS; AND FOR INCIDENTAL AND CONNECTED PURPOSES ENACTED by the Legislature of the Cayman Islands. Short title and commencement (1) This Act may be cited as the Identification Register Act, 2022. (2) This Act comes into force on such date as may be appointed by Order made by the Cabinet and different dates may be appointed for different provisions of this Act and in relation to different matters. Interpretation (1) In this Act — “authentication” means the process by which the identity of a person or a person’s identification information is proved as to its accuracy or inaccuracy; “Caymanian” has the meaning assigned by section 2 of the Immigration (Transition) Act (2022 Revision); “Cayman Islands Identification Card System” has the meaning assigned by section 2 of the Cayman Islands Identification Card Act, 2022; “Chief Officer” means the Chief Officer of the Ministry; “civil partner” has the meaning assigned by section 2 of the Civil Partnership Act, 2020; “civil servant” has the meaning assigned by section 2 of the Public Service Management Act (2018 Revision); “delegate” means a person who has been granted delegated authority under section 11; “delegated authority” means the authorization given to a person by the Registrar under section 11 to access and use the register on behalf of another “enrol” means the entering of an individual in the register for the first time and includes the process of collecting identification information, including from a public authority; “entry” means an entry of any particular or information in the register and includes an entry that is made electronically or digitally; “General Registry” means the Registry of Births and Deaths for the Islands established under section 3 of the Births and Deaths Registration Act (2021 “identification code” means the unique identifier assigned to a person under section 20 for the purposes of identifying that person; “identification information” means identity facts and related facts; “identity facts”, in relation to a person, means — (a) the first name, middle name and surname of the person; (b) the date of birth of the person; the nationality of the person; (d) the sex of the person; (e) the current category of the person’s right or permission to reside in the Islands in accordance with the Immigration (Transition) Act (2022 Revision) or any other law and the terms and conditions of that permission; and (f) the identification code of the person; “interoperability” means the electronic communication and sharing of data or information between the Registrar and entities or between entities; “legal and ordinary residence” has the meaning assigned by section 2 of the Immigration (Transition) Act (2022 Revision); “legally and ordinarily resident” means a person who has legal and ordinary residence in the Islands; “Minister” means the Minister with responsibility for the register and “Ministry” shall be construed accordingly; “minor” means a person who is under the age of eighteen years; “permanent resident” has the meaning assigned by section 2 of the Immigration (Transition) Act (2022 Revision); “personal data” has the meaning assigned by section 2 of the Data Protection Act (2021 Revision); “photograph” means an image of a person, generated by a process of reflecting light and capturing light through chemical or electronic process and recreating the image either electronically or physically; “principal contact information”, in relation to a person, means — (a) the principal telephone number of the person; (b) the principal email address of the person; the principal mailing address of the person; and (d) the principal residential address of the person; “private entity” means a natural or legal person that is not a public authority; “public authority” has the meaning assigned by section 2 of the Data Protection Act (2021 Revision); “register” means the Identification Register established under section 3; “registered”, in relation to a person, means to be enrolled in the register; “registered person” means a person who is registered under this Act; “registrable event” means — (a) a birth of a person in the Islands; (b) the birth of a Caymanian outside of the Islands; the granting of a work permit or any other form of the right or permission to reside in the Islands by WORC; or (d) the grant or termination of employment of a person who is not a Caymanian as an employee of the Government; (e) the grant of asylum under the Customs and Border Control Act (2022 (f) the expiry of a work permit or any other form of the right or permission to reside in the Islands; and (g) the revocation of a work permit or any other form of the right or permission to reside in the Islands; “registerable person” means a person who is eligible for registration in the register under this Act; “Registrar” means the person appointed to the office of the Registrar of the Identification Register established under section 12; “Registrar-General” has the meaning assigned by section 2 of the Births and Deaths Registration Act (2021 Revision); “related facts”, in relation to a person, means — (a) place of birth; (b) delegated authority; the identification code of the person’s parent or parents; (d) external characteristics capable of identifying the individual, limited to height and eye colour; (e) physical signature (signature mark); (f) photograph; (g) principal contact information; (h) emergency contact information; (i) other residential addresses, if applicable; (j) date of death; and (k) such additional categories of information consistent with the purposes of this Act as may be prescribed. “reliable document” means an identification document or source of data used to verify a subject’s identification information and that is generally recognized by public authorities and private entities as reliable; “requesting entity” means a public authority or private entity that requests access to information contained in the register; “to use” includes to access, to collect, to obtain, to record, to process, to hold and to disclose; “verification” means the process by which the accuracy of information received is established through comparison of the information received with reliable documents or other information; “WORC” means the Workforce, Opportunities and Residency Cayman Office as defined under section 2 of the Immigration (Transition) Act (2022 Revision); and “work permit” has the meaning assigned by section 2 of the Immigration (Transition) Act (2022 Revision). Clause 3 (2) For the purposes of this Act, a reference to a “person” means a natural person unless the context otherwise requires. Establishment of the Identification Register (1) There is established a register which shall be called the Identification Register (“the register”) and which shall be kept and maintained for the following purposes — (a) enabling the persons referred to in subsection (2) to prove certain facts about themselves; (b) providing a secure and reliable method for the use of identification information for the purposes of the ascertainment, verification and authentication by a requesting entity of identity facts or related facts about the persons referred to in subsection (2), where such is necessary in the public interest; providing any service under any enactment to a person by a public authority; (d) enabling or facilitating interoperability between the Registrar and public authorities for the purpose of efficient public administration or policy development; and (e) enabling or facilitating compliance by a person, public authority or private entity, in respect of such person, public authority or private entity, with any duty that relates to the registration of identification under any (2) Subject to subsection (5), the following persons shall be enrolled in the register — (a) Caymanians; (b) permanent residents; any other person who is legally and ordinarily resident in the Islands; (d) any person who has participated in a registrable event; or (e) any other person or category of person prescribed by regulations made by the Cabinet. (3) A person who is a parent, civil partner, child, or has delegated authority for a person that qualifies to be enroled in the register under subsection (2) also may be enrolled in the register. Clause 4 (4) For the purposes of subsection (1)(b), the authentication or verification by a requesting entity of identification information is necessary in the public interest if it is for any of the following purposes — (a) establishing the eligibility, entitlement or categorization of persons for the efficient and effective provision of government services or benefits; (b) establishing a person’s entitlement to vote at an election or in a referendum; the prevention or detection of crime; (d) the enforcement of immigration controls, including the enforcement of prohibitions on unauthorized work or employment; (e) national security; and (f) any other purpose prescribed by regulations. (5) The Registrar may, at the Registrar’s discretion, exclude any person who is no longer resident in the Islands from being enrolled in the register. Form of register (1) The Registrar shall determine — (a) the form in which information to be provided to or entered in the register shall be submitted; (b) the intervals at which the information referred to in paragraph (a) is to be provided; and the form in which information contained in the register shall be kept. (2) For the purposes of subsection (1)(c), the register may be kept, maintained and operated in an encrypted form, subject to its being capable of being converted into a legible form and being used to make a legible copy or reproduction of an entry in the register. Entry of a person in the register (1) The Registrar shall make an entry in the register in respect of a person under section 3(2) and the entry shall include the identity facts in relation to the person where such information is known to the Registrar. (2) Where an entry is made in respect of a person under subsection (1), the Registrar shall assign an identification code to the person in accordance with Part 4. (3) An entry made under subsection (1) may include related facts in relation to the person referred to in that subsection. Clause 6 (4) The Registrar may make an entry under subsection (1) relying on identity facts provided by a public authority, including for the initial enrolment and entry of all registrable persons. (5) Upon the enrolment of a minor, the data in the minor’s birth document shall be (6) Notwithstanding subsection (5), where the representative of the minor proves that a birth document cannot be obtained or is unreasonably difficult to obtain, the Registrar may enter in the register — (a) identity facts; and (b) related facts, that are readily available in relation to the minor. (7) For the purposes of subsection (5), “birth document” means the certificate in respect of the registration of a birth issued by the Registrar-General under section 21 of the Births and Deaths Registration Act (2021 Revision) or such other document recognized by the laws of another jurisdiction as an official document which certifies the registration of a birth. Accessing identification information (1) A person may apply to the Registrar for a copy of the identification information recorded in the register in respect of that person or any other person so specified in accordance with the regulations. (2) An application made under subsection (1) shall — (a) be in such form as the Registrar may approve; (b) be accompanied by the prescribed fee; and comply with any requirements specified by the Registrar, including those in relation to the submission of any documents ascertaining the identity of the person making the application. (3) Where an application is made in accordance with subsection (2), the Registrar shall provide the person making the application with a copy of the identification information relating to the person in respect of whom the application was made within ten business days after receipt of the application. (4) A person under subsection (1) shall notify the Registrar immediately of any inaccuracy in the identification information of which the person has become aware and shall provide the Registrar with such information or document as the Registrar may require to correct the inaccuracy. (5) The Registrar may, at any time, require a person to provide any documents and information as may be necessary for the purpose of verifying identification information relating to that person. Clause 7 (6) The Registrar shall update the information recorded on the register as soon as reasonably practicable following — (a) the notification of an inaccuracy under subsection (4) or the provision of documents or information under subsection (5); or (b) any change in that information given to the Registrar under this Act or under any enactment. (7) The Cabinet, on the recommendation of the Registrar, may make regulations prescribing any person, or a description or class of person, who may make an application under subsection (1). Changes to the register (1) Where, after enrolment, any information on the register is found to be incomplete, incorrect, misleading or otherwise in need of updating — (a) the registered person; or (b) where the registered person has a delegate, the delegate of the registered shall request that the Registrar correct or update the information. (2) On receipt of a request under subsection (1), the Registrar may — (a) request that the registered person provide evidence or further information to support the request; (b) direct the request to the relevant public authority for consideration; or upon being satisfied of the accuracy of the information so provided, make such alteration as may be required in the register relating to the registered (3) The Registrar shall notify the registered person, as soon as practicable, of — (a) the action taken by the Registrar to update the information; or (b) the Registrar’s refusal to update the information and the reasons for the refusal, in such form and manner as the Registrar may determine. (4) Where the Registrar updates the information in relation to a registered person pursuant to subsection (2)(c), the Registrar may notify — (a) public authorities of the relevant change and provide the updated information; and (b) with the consent of the registered person, private entities of the change and provide the updated information. Clause 8 (5) Where the Registrar is notified by a public authority of the incomplete, incorrect or misleading information in a registered person’s entry in the register, the Registrar may take the appropriate action under this Part to complete, correct or update the information and notify the registered person and the public authority. (6) The Registrar may, at the Registrar’s own instance, update an entry of a registered person in the register and in doing so require the provision of identification information from a public authority where that public authority has primary responsibility under any enactment for the issuance or maintenance of any category of identification information. (7) Where a change in identification information is recorded by a public authority for which that public authority has primary responsibility under any enactment for the issuance or maintenance of the identification information, the Registrar may — (a) require that public authority to provide to the Registrar the particular identity facts and related facts, where applicable, that are subject to the change in identification information; and (b) notify the registered person of the change to the registered person’s identification facts in the form and manner prescribed by regulations. (8) The Registrar shall maintain complete and accurate records of applications and changes or updates made under this section, including the particulars of changes made to the registered person’s entry in the register. (9) Records maintained by the Registrar in accordance with subsection (8) may be accessed under sections 29 and 31. (10) No information in the register shall be altered except in the manner provided in this Act or the regulations. Duty to notify the Registrar of changes to identification information (1) Subject to subsection (2), a registered person shall notify the Registrar of changes to identification information including — (a) a change of principal contact information; (b) a change of name, including a change arising from a deed poll, a marriage, a civil partnership, a divorce or a dissolution of civil partnership — (i) conducted within the Islands; or (ii) conducted outside the Islands; and any other changes to identification information as prescribed by regulations, as soon as practicable after the change or event specified in paragraphs (a) to (c) occurs. Clause 9 (2) The requirement of a registered person to notify the Registrar of the change under subsection (1) does not apply where — (a) a public authority which has primary responsibility under any enactment for the issuance or maintenance of any category of identification information provides an update to the Registrar of the change; or (b) the registered person is no longer required to update the Registrar in respect of changes to identification information in accordance with circumstances prescribed by regulations. (3) A person who becomes aware of an error in the register in respect of that person shall notify the Registrar of that error. (4) The Cabinet may make regulations to prescribe — (a) the information that a person is required to supply as evidence of a change or otherwise to support a change to the information recorded on the register in respect of the person; and (b) the manner and form in which the information referred to in paragraph (a) is to be provided to the Registrar, for the purposes of ensuring that there is a complete and accurate entry about persons in the register. Authentication and verification (1) The Registrar may verify the identification information of a registered person, in order to ensure the accuracy of information in the register about the registered person, whether — (a) at the Registrar’s own instance; or (b) at the request of a requesting entity, subject to such conditions and on the payment of such fees as may be prescribed. (2) Subject to subsection (3), a requesting entity may request access to the register from the Registrar for the purpose of authenticating or verifying the identity of a person, or identification information provided by an entity, and the Registrar may grant the request in accordance with this section. (3) A requesting entity under subsection (2) shall ensure that the identification information of a person that was obtained through its access to the register is only used for — (a) the purpose permitted under subsection (2); or (b) any other purpose required by any other enactment or court order. (4) A requesting entity shall notify the person submitting identification information to that requesting entity for verification of the following details, namely — Clause 10 (a) that the requesting entity may seek to verify the information submitted by the person; and (b) the uses to which the information received through its access to the register may be put by the requesting entity. Assurance of data in register

For the purposes of ensuring that there is a complete and accurate entry in respect of persons in the register, the Cabinet may prescribe a system of assurance through which levels of assurance may be assigned to identification information. Delegated authority

(1) The Registrar shall grant authorization a person other than the registered person to access and use the register where — (a) the registered person is a minor and the delegate is a parent or legal guardian of the minor; (b) the registered person has appointed the delegate under power of attorney; the authorization is required under any other enactment; or (d) the authorization is required by order of a court. (2) Where the Registrar grants authorization to a person under subsection (1), the Registrar shall provide written notification of the delegated authority to — (a) the registered person; and (b) the person granted delegated authority, in the form and manner prescribed by the regulations. (3) A person who is granted delegated authority by the Registrar under subsection (1) shall have — (a) permitted access to the identification information of the registered person for whom the delegation has been made; and (b) authority to act on the registered person’s behalf in relation to this Act. (4) Where a person performs any actions permitted under subsection (3), such actions shall be recorded under the identity of the person with delegated authority. (5) Where a parent or guardian has delegated authority for a registered person under subsection (1)(a), the delegated authority shall be revoked upon the registered person having attained the age of eighteen years. (6) The Cabinet may make regulations prescribing the procedure for the application and authorization of delegated authority under this section. Clause 12 Appointment of Registrar of the Identification Register

(1) There is established the office of the Registrar of the Identification Register who is responsible for keeping and maintaining the register and the administration of this Act, and such person shall be a civil servant and hold office in accordance with the Public Service Management Act (2018 Revision). (2) A person shall not be appointed to the office of the Registrar under subsection (1) if the person — (a) is a Member of Parliament or has held such office in the three years preceding the proposed appointment as Registrar; or (b) has been convicted of a violent crime or a crime of dishonesty or theft, for which the person has not been pardoned. Powers of the Registrar

(1) The Registrar shall have all powers, direct and incidental, as are necessary to undertake and perform the Registrar’s duties under this Act. (2) The Registrar may obtain from persons and public authorities relevant information and documents pertaining to the carrying out of the Registrar’s duties under this Act. (3) The Registrar may require the provision of information and documents from any public authority as may be necessary to perform the Registrar’s duties under this Act. (4) A public authority shall provide to the Registrar the information and documents required by the Registrar under subsection (3) within such time as the Registrar may specify. Duties of the Registrar

(1) The Registrar shall — (a) establish and develop the register by the collection and collation of identification information regarding registrable persons; (b) ensure that the accuracy and processing of data contained in the register are in compliance with all applicable legislation; decide on the grant, withholding or revocation of access to data in the register in accordance with this Act and any other enactment; (d) exercise supervision over compliance with the requirements provided for in this Act, including the accuracy of the register and the processing of data; Clause 14 (e) keep under review the arrangements made by entities for the access to and use of information; (f) resolve inconsistencies in data between cooperating public authorities with regard to the accuracy of the register; (g) adjudicate challenges related to the accuracy of the register and the processing of data in the register or refer such challenges to the appropriate public authority; (h) facilitate international obligations relating to the register; (i) give instructions of an advisory nature with respect to the application of this Act; (j) establish and maintain an improved and modernized system of registration of registrable persons and keep public records through appropriate means; (k) develop systems, procedures and protocols to facilitate appropriate access to data while also ensuring the protection, security and confidentiality of information in the register; develop policies, procedures and protocols for the use and sharing of information contained in the register; (m) provide information or advice, or make proposals, to the Cabinet on matters relating to the duties of the Registrar and for the better administration of the Act; (n) develop public education programmes, and monitor and promote compliance with this Act; and (o) perform such other duties as may be assigned under this Act and any other (2) In performing the duties specified in subsection (1), the Registrar may — (a) institute measures for the promotion of compliance with this Act; (b) contract the services of one or more providers of goods or services to establish and maintain the register and to perform any other duties in keeping with the establishment and maintenance of the register and the Cayman Islands Identification Card System; establish, develop, implement and monitor procedures, plans and programmes relating to the administration of the register and the Cayman Islands Identification Card System; (d) work with the relevant entities and personnel to maintain the preservation, protection and security of all information or data collected, obtained, maintained or stored in the register; and Clause 15 (e) perform any act or enter into any arrangement which is necessary to ensure the proper performance of the Registrar’s duties. (3) Where the Registrar reviews any arrangements under subsection (2)(e), such review shall include, in particular, a review of the extent to which the arrangements make appropriate provision for — (a) securing the confidentiality and integrity of information recorded on the (b) dealing with complaints made by persons about the use of information recorded on the register. (4) In the exercise of the Registrar’s duties, the Registrar shall cooperate with other public authorities in the implementation of this Act. Cabinet to issue general policy directions

(1) The Cabinet may give general policy directions in writing to the Registrar in the exercise and performance of the Registrar’s duties as appear to the Cabinet to be necessary in the public interest. (2) The Registrar shall give effect to the general policy directions given by the Cabinet under subsection (1). Accountabilities of the Registrar

(1) Except as otherwise stated in this Act, the Registrar shall be subject to the Public Service Management Act (2018 Revision). (2) The Registrar shall, as soon as practicable but no later than three months after the end of each year, make available to the public a report on the statistics and trends in relation to the data contained in the register, the activities of the office of the Registrar and any other such information as the Registrar considers fit or as the Cabinet may prescribe. Registrar may delegate duties

(1) The Registrar may delegate any of the Registrar’s duties under this Act, either generally or specifically and subject to such conditions or restrictions as the Registrar thinks fit, to another civil servant. (2) Where the Registrar delegates any of the Registrar’s duties to a person under subsection (1), the person shall be subject to the confidentiality requirements under Part 7 and any other obligations under this Act. (3) Every delegation under this section shall be in writing and the instrument of delegation shall be given to the delegate. (4) Where a person appointed by the Registrar under this section performs or is to perform any duty, or exercises or is to exercise any power, of the Registrar under Clause 18 this Act, any reference to the Registrar in this Act in respect of that duty or power includes a reference to that person. Conflict of interest

(1) Where the Registrar has any actual or potential personal or pecuniary interest, either directly or indirectly — (a) in a transaction or decision being considered by the Registrar; or (b) which may impact the performance of the Registrar’s duties under this Act or any other law, the Registrar, subject to subsection (2), shall disclose the nature of the interest to the Chief Officer as soon as possible after the relevant circumstances have come to the Registrar’s knowledge. (2) Where a person who has been appointed to the office of the Registrar is the Chief Officer, the Chief Officer shall disclose any actual or potential personal or pecuniary interest referred to under subsection (1) to the Deputy Governor as soon as possible after the relevant circumstances have come to the person’s knowledge. Termination of appointment of Registrar

(1) The appointment of the Registrar shall be terminated where the Registrar — (a) becomes of unsound mind or becomes permanently unable to perform the Registrar’s duties by reason of ill health; (b) becomes bankrupt or compounds with or suspends payment to creditors; acts in a manner that brings the office of the Registrar into disrepute; (d) is a candidate for or holds office in a political party or is nominated for election to the Parliament; (e) does not declare a conflict of interest where so required under this Act; or (f) fails to substantially carry out the duties conferred or imposed by this Act. (2) The termination of appointment of the Registrar shall be in accordance with the Public Service Management Act (2018 Revision). Assignment of identification code

(1) The Registrar shall, on entering a registered person’s information in the register, assign to that person an identification code. (2) The identification code shall be — Clause 21 (a) a unique identifier that is used to identify each registered person in the (b) personal to the individual to whom it has been issued and may not be transferred or vested by operation of law in any person other than that individual. (3) The Registrar shall not issue more than one identification code for each registered person at any given time and therefore shall not cause or permit — (a) the formation of the same identification code for more than one registered (b) the formation of more than one identification code for each registered person; and the formation of a previously used identification code for a different registered person. (4) An identification code that is assigned to a person under subsection (1) — (a) shall be assigned permanently to the registered person except where it is required to be changed — (i) as a result of the registered person having been a victim of identity theft; or (ii) pursuant to the requirements of any other enactment; and (b) shall not be assigned or re-assigned to, or re-used by, any other person during the lifetime, or after the death, of the registered person. (5) The identification code shall not contain any personal data or identification information. Use of identification code

(1) A registered person may use that person’s identification code for the purpose of authenticating that person’s identity, including by electronic means, for the purpose of — (a) accessing goods or services provided by the Government or the private sector; or (b) any other purpose for which the authentication of the individual’s identity is required. (2) The identification code may be used, held or maintained by a private entity or public authority for any of the purposes referred to under section 3(1) and in accordance with this Act. Clause 22 Enrolment in the Register not conferral of immigration status or right to reside

The enrolment in the register shall not — (a) confer on a registered person any right of having — (i) the immigration status of a Caymanian or any other immigration status; or (ii) the right to reside or remain in the Islands; or (b) by itself be proof of the immigration status or right to reside of a registered PART 5 - DUTY OF COOPERATION OF PUBLIC AUTHORITIES Responsibility of public authority to cooperate with the Registrar

(1) Every public authority shall provide the Registrar with all such information as the Registrar may require for the purpose of carrying out the Registrar’s duties under this Act. (2) A public authority shall provide to the Registrar such assistance as may be necessary to ensure the proper discharge of the duties of the Registrar. (3) The Registrar shall require a public authority to provide the Registrar with information relating to a registered person, where the Registrar considers that the public authority may have information in its possession which could be used for verifying — (a) information already recorded in the register about that person; (b) information provided to the Registrar by the person, including information submitted as part of an application for a Cayman Islands Identification Card; or information otherwise unavailable to the Registrar to be included in the person’s entry in the register, where the information referred to in paragraphs (a) to (c) is required by this Act or any other enactment. Obligations of persons submitting data

(1) A person submitting identification information under this Act — (a) shall ensure that the data submitted for entry in the register are in compliance with the identification documents specified in this Act or any other enactment which were required as the basis for entry of data in the Clause 25 (b) upon discovery of a mistake or error in the data submitted to the Registrar, shall immediately enter correct data in the register or in the event that there is no option to do so, notify the Registrar of any such error. (2) A person submitting data under this Act shall — (a) ensure that the data submitted to the Registrar accord with the data entered in the identity document referred to in this Act; (b) notify the Registrar immediately of a mistake discovered in the submitted data and submit the accurate data; respond to inquiries from the Registrar which are related to submitting data to the register within three working days after receipt of the inquiry; (d) notify the Registrar immediately of any hindrance to the submission of data; and (e) comply with the requirements for the protection of personal data under the Data Protection Act (2021 Revision). Ensuring of accuracy of identification information

(1) The Registrar shall conduct an inquiry concerning the accuracy of identification information in respect of a registered person submitting data where — (a) the registered person disputes the accuracy of the identification information entered in the register in respect of that registered person; (b) several forms of data are submitted in respect of the same identification information and there exists perceivable inconsistencies between the data submitted in the different forms; the identification information submitted is not objectively related to other identification information; or (d) identification information is obviously inaccurate. (2) Where — (a) the circumstances under subsection (1) arise; or (b) a registered person submitting identification information, or a person, public authority or private entity who has received identification information, gives notice of inaccurate identification information gives notice of inaccurate identification information, the Registrar shall verify the accuracy of identification information and correct inaccurate identification information. Correction of inaccurate data

Where data in respect of any identification information provided for in this Act is missing in respect of a registered person, the Registrar may — Clause 27 (a) take measures to obtain the missing data; and (b) submit an inquiry to the registered person to submit the relevant data. Right to access identification information in register

(1) Subject to section 30 and any other exceptions provided for under this Act, the following persons have the right to access the identification information of a registered person in the register — (a) a registered person, who shall have the right to access identification information entered in the register on — (i) that registered person; (ii) a person in respect of whom the registered person has delegated authority; and (b) a public authority or private entity with a legitimate interest. (2) For the purposes of subsection (1)(b), a public authority or a private entity possesses a legitimate interest where the right to access the register is given to such public authority or private entity by — (a) this Act or any other enactment; (b) a power of attorney; or an order of a court. Access to identification information on a registered person

(1) A requesting entity may request, with the consent of a registered person or the registered person’s delegate, identification information about the registered person from the register for the purpose of — (a) accessing, authenticating, or verifying certain facts about a registered person; or (b) providing a service to a registered person as required under any other Act. (2) A requesting entity shall ensure that the identification information of a person that was obtained through its access to the register is only used for the purpose permitted under subsection (1) or by any other enactment. (3) A requesting entity shall clearly communicate in writing to the registered person under subsection (1) the uses to which the information that the requesting entity seeks to access from the register is to be put. Clause 29 Access to the register and use of information by public authorities

(1) Subject to subsections (2) to (4), a public authority may use identification information from the register for the purpose of — (a) carrying out any function under any Act; or (b) research or statistical analysis to facilitate public administration or policy development. (2) A public authority shall not use information held in the register — (a) for any purpose other than one authorized under this Act or under any other enactment; and (b) unless the public authority has adequate systems in place for securing the confidentiality and integrity of the information. (3) A public authority using data held in the register shall adhere to the principles laid out in the Data Protection Act (2021 Revision) for the processing of personal data. (4) Where the Registrar facilitates the use of identification information under subsection (1) the Registrar shall do so in compliance with the Registrar’s duties set out under section 14 and any other provision of this Act. Record of access to information

(1) The Registrar shall maintain records of the access to identification information in the register in such manner and for such period as may be prescribed. (2) A registered person shall be entitled to obtain from the Registrar, a record of access to that person’s identification information. (3) A requesting entity shall keep a record of every — (a) request for access to identification information in the register, including the purposes for which the request is made; and (b) access made to identification information in the register. (4) Notwithstanding subsection (2), the Registrar may withhold a record of access — (a) if it relates to the prevention, detection or investigation of crime; (b) if it relates to the apprehension or prosecution of a person who is suspected to have committed an offence anywhere; if it relates to national security; (d) where disclosure of the record of access would be likely to prejudice the proper discharge of a public function in the case of — (i) public safety; Clause 31 (ii) the prevention, investigation, detection or prosecution of criminal offences, or of breaches of ethics for regulated professions; or (iii) a substantial economic or financial interest of the Islands, including — (A) compliance with international tax treaties or international cooperation purposes; (B) any monitoring, inspection or regulatory function exercised by official authorities (including regulation of the financial services industry); or (C) any monetary, budgetary and taxation purposes in the Islands; (d) where such access may impair the conduct of a criminal investigation or criminal proceeding; or (e) where so required by an order of a court. (5) Records of access that are withheld under subsection (4) may be accessed — (a) by an order of a court; or (b) except where access is being withheld subject to an order of the court under subsection (4)(e), by a public authority with responsibility for oversight of the requesting entity. PART 7 - CONFIDENTIALITY OF THE REGISTER AND DATA Disclosure in certain cases

(1) Subject to subsection (2), information collected under this Act in relation to a person in the register may be disclosed only in accordance with this Act or in such manner as may be prescribed by the regulations. (2) The Registrar shall not disclose identification information stored, collected or obtained under this Act about any person to a third party or any other entity, except where the identification information is disclosed in any of the following cases — (a) pursuant to a request of the person whose information is being disclosed; (b) to facilitate the search for or identification of missing persons or unknown deceased persons; pursuant to an order of a court; (d) where this Act or another enactment expressly authorizes the disclosure; (e) for the prevention, detection or investigation of a crime; Clause 32 (f) to facilitate an investigation under the Proceeds of Crime Act (2020 (g) in the interest of national security; (h) where there is a disaster as defined by section 2 of the Disaster Preparedness and Hazard Management Act (2019 Revision) or a public health emergency; or (i) for the preservation of the life of a person. (3) The court may, on an application by the Registrar, grant an order for disclosure of the information of a person or groups of persons in the register on the grounds that the disclosure is necessary — (a) for the prevention, detection or investigation of a crime; (b) in the interest of national security; where is a disaster as defined by section 2 of the Disaster Preparedness and Hazard Management Act (2019 Revision) or a public health emergency; or (d) to facilitate an investigation under the Proceeds of Crime Act (2020 Unauthorized disclosure of information

(1) A person who without lawful authority — (a) provides any person with information that the person is required to keep confidential; or (b) otherwise makes a disclosure of any such information, commits an offence. (2) For the purposes of subsection (1) — (a) a person is required to keep information confidential if it is information that is or has become available to that person by reason of holding an office or employment the duties of which relate, in whole or in part, to — (i) the establishment or maintenance of the register; or (ii) the use of identification information; and (b) information is provided or otherwise disclosed with lawful authority if such provision or disclosure is — (i) authorized under this Act or under another enactment; (ii) in pursuance of an order or direction of a court; or (iii) for the purposes of the performance of the duties of an office or employment described in paragraph (a). Clause 33 (3) It is a defence for a person charged with an offence under this section to show that, at the time of the alleged offence, that person believed, on reasonable grounds, that the person had lawful authority to provide the information or to make the disclosure in question. (4) A person who commits an offence under subsection (1) is liable to a fine of twenty thousand dollars or to imprisonment for a term of four years, or to both. Duty of confidentiality

(1) A person — (a) having or having had a duty under this Act; or (b) being or having been employed in the administration of this Act, shall regard and deal with as confidential, all documents and information relating to the register and the duties of the Registrar where the disclosure of the information could reasonably be considered to put at risk the confidentiality, accessibility or integrity of the register or Cayman Islands Identification Card System, or the data in the register or Cayman Islands Identification Card System. (2) A person who had an official duty under this Act or was employed in the administration of this Act, after such duty was terminated, shall maintain the confidentiality of all information relating to the duties of the Registrar. (3) A person to whom information is communicated under this Act shall regard and deal with such information as confidential, except to the extent otherwise provided in this Act and any other enactment. (4) A person referred to in subsection (1), (2) or (3) having possession of or control over any information, who at any time communicates or attempts to communicate any such information to any person, otherwise than for the purposes of this Act or to any person, other than an authorized officer or person at the direction of the court, commits an offence. (5) A person who commits an offence under subsection (4) is liable on conviction on indictment to a fine of forty thousand dollars or to imprisonment for a term of eight years, or to both. (6) No obligation as to confidentiality or other restriction upon the disclosure of information imposed by any other law or otherwise shall prevent the disclosure by any person of information to the Registrar for the purpose of assisting the Registrar in the performance of the Registrar’s duties. Registrar to implement security measures

(1) The Registrar shall take all necessary measures — Clause 35 (a) to protect the information in the possession or control of the Registrar, including information stored in the register; and (b) to ensure that the information is secured and protected against — (i) use not permitted under this Act; and (ii) accidental or intentional destruction, loss or damage. (2) Without prejudice to subsection (1), the Registrar shall — (a) adopt and implement appropriate technological and manual security measures to safeguard the confidentiality of the register; and (b) require the — (i) entities; (ii) consultants; (iii) advisors; or (iv) other legal or natural persons, appointed to, or engaged by, the Registrar to perform or facilitate any of the Registrar’s duties under this Act, to implement appropriate technical and organisational security and such other measures aimed at safeguarding the confidentiality of the register. Offences relating to personation

(1) A person shall not — (a) personate a person, role or function authorized under this Act; or (b) exercise or attempt to exercise authority under this Act where the person has not been so authorized. summary conviction to a fine of ten thousand dollars or to imprisonment for a Unlawfully collecting identification information

(1) A person shall not collect or attempt to collect identification information unless the person is authorized to do so in accordance with this Act or any other summary conviction to a fine of twenty thousand dollars or to imprisonment for a term of two years, or to both. Clause 37 Misleading, impeding or obstructing the Registrar

(1) A person shall not knowingly give false or misleading information to the Registrar. (2) A person shall not wilfully obstruct or impede the Registrar in the exercise of the Registrar’s duties. (3) A person who contravenes subsection (1) or (2) commits an offence and is liable on summary conviction to a fine ten thousand dollars or to imprisonment for a Offences relating to the register

(1) A person shall not, without lawful authority, intentionally perform or attempt to perform any of the following actions — (a) access the register; (b) act on behalf of a registered person without the person’s consent; access a registered person’s information without the person’s consent; or (d) use or display information in the register. (2) A person shall not intentionally share information in the register that the person knows to be inaccurate. (3) A person who contravenes subsection (1) commits an offence and is liable on conviction on indictment to a fine of twenty thousand dollars or to imprisonment for a term of four years, or to both. (4) A person who contravenes subsection (2) commits an offence and is liable on summary conviction to a fine of ten thousand dollars or to imprisonment for a Tampering with the register

(1) A person shall not attempt to or intentionally — (a) introduce or cause to be introduced, any virus, malware or other computer contaminant in the register or any system that supports the register; (b) cause damage to the register or information in the register; disrupt the proper functioning of the register; (d) cause an unauthorized modification of information to be made to an entry in the register; (e) prevent or delay the access or retrieval of relevant information from a computer used for the purposes of this Act; or (f) otherwise alter, destroy, mutilate, deface, hide or remove information in the register. Clause 40 conviction on indictment to a fine of twenty thousand dollars or to imprisonment for a term of four years, or to both. Registration offences

(1) A person who, for the purposes of this Act — (a) provides false information or makes a false statement when — (i) providing information for an entry or modification of an entry; (ii) making a modification to an entry; or (iii) making a confirmation of the content of an entry; (b) unduly influences the decision of the Registrar or any officer employed in the office of the Registrar; or registers or attempts to enrol an individual more than once in the register, commits an offence and is liable on summary conviction to a fine of ten thousand dollars or to imprisonment for a term of two years, or to both. (2) For the purpose of subsection (1), a person provides false information if at the time of the provision of the information the person — (a) knew or reasonably ought to have known the information to be false; or (b) was reckless as to the veracity of the information. Liability for offences

(1) Where an offence under this Act has been committed by a body corporate and is proved to have been committed with the consent or connivance of, or to be attributable to, any neglect on the part of — (a) a director, secretary or similar officer of the body corporate; or (b) a person who was purporting to act in any such capacity, the director, secretary, similar officer of the body corporate or a person purporting to act in any such capacity, as well as the body corporate, commit that offence and are liable to be proceeded against and punished accordingly. (2) Where the affairs of a body corporate are managed by its members, subsection (1) applies, in relation to the acts and defaults of a member in connection with the member’s functions of management, as if the member were a director of the body corporate. Clause 42 Incompatibility of other legislation

Except as provided in this Act, no enactment or law prohibiting or restricting the disclosure of information shall preclude a person from furnishing the Registrar with any information required for the discharge of the Registrar’s duties under this Act. No personal liability except for bad faith

(1) No civil or criminal action, suit or other proceedings for breach of confidentiality may be brought nor any professional sanction for such breach may be taken against a person who, in good faith, under this Act or any other enactment, provides or transmits to the Registrar information requested by the Registrar or submits a report to the Registrar. (2) No suit or other proceedings may be brought or instituted personally against the Registrar or any officer employed in the office of the Registrar in respect of any act done or omission made in performing the duties under this Act unless it is shown that the act or omission was negligent or in bad faith. Appeals from decisions of the Registrar

(1) Subject to subsection (6), a person aggrieved by a decision of the Registrar under this Act may appeal the decision by submitting a written notice of the person’s intention to appeal to the Chief Officer in accordance with subsection (2). (2) The procedure for the submission of an appeal to the Chief Officer shall be prescribed in regulations made by the Cabinet. (3) The Chief Officer shall hear and determine appeals brought under this section in accordance with regulations made by the Cabinet. (4) The Chief Officer, upon hearing an appeal under this section, may — (a) confirm, reverse or modify the decision of the Registrar; or (b) in appropriate circumstances, remit the matter to the Registrar, with or without directions as to how the matter should be considered. (5) The Registrar and any other person to whom an appeal under this section applies shall comply with the decision of the Chief Officer made under this section. (6) An appeal from any decision of the Chief Officer under this section shall lie to the Grand Court. Regulations

(1) The Cabinet, in consultation with the Registrar, may make regulations for the better carrying out of the objects and purposes of this Act. Clause 45 (2) Without prejudice to the generality of subsection (1), the Cabinet may make regulations to prescribe — (a) the forms to be used and fees to be charged in connection with any application, notice, certificate or other document under this Act; (b) the procedures and practices to be followed by the Registrar in the collection, verification and authentication of information required for the registration of persons or any class of persons; the procedures and processes for the management and storage of information in the register, and the security protocols and technological safeguards for such information; (d) the procedures for the collection and registration of changes to the information of a registered person and the entry of the changed information into the register; (e) the imposition of fees to be prescribed under this Act and for the reduction, refund or waiver of the fees; (f) the procedures for access to the register; (g) the procedures for the preservation, custody and safekeeping of records and information under this Act, including the archiving of the identification codes of deceased persons and other categories of person in separate parts of the register; (h) the procedures for the settlement of disputes arising from, and appeals against, a decision of the Registrar; (i) the period of time for the doing of any act under this Act; (j) for any thing or matter that is required or permitted to be prescribed under this Act; and (k) generally for giving effect to the provisions and purposes of this Act. Clause 45 (3) Regulations made under this Act may — (a) make different provisions in relation to different cases or circumstances; (b) apply in respect of particular persons or particular cases or particular categories of persons or particular categories of cases and define the categories by reference to any circumstances of any kind; contain such transitional, consequential, incidental or supplementary provisions as appear to the Cabinet to be necessary or expedient for the purposes of this Act; and (d) create an offence punishable on summary conviction by a fine of up to twenty thousand dollars or to imprisonment for a term of two years, or to both. Passed by the Parliament the day of , 2022. Speaker Clerk of the Parliament