IDENTIFICATION REGISTER ACT, 2022 (Act 14 of 2022)

CAYMAN ISLANDS IDENTIFICATION REGISTER ACT, 2022 (Act 14 of 2022) Supplement No. 1 published with Legislation Gazette No. 52 dated 29th December, 2022. PUBLISHING DETAILS Page 2 Act 14 of 2022 c Identification Register Act, 2022 Arrangement of Sections CAYMAN ISLANDS IDENTIFICATION REGISTER ACT, 2022 (Act 14 of 2022) Arrangement of Sections Section Page PART 1 - PRELIMINARY 1. Short title and commencement ..................................................................................................5 2. Interpretation .............................................................................................................................5 PART 2 - CAYMAN ISLANDS IDENTIFICATION REGISTER 3. Establishment of the Identification Register................................................................................9 4. Form of register ....................................................................................................................... 10 5. Entry of a person in the register ............................................................................................... 10 6. Accessing a copy of identification information .......................................................................... 11 7. Changes to the register............................................................................................................ 12 8. Duty to notify the Registrar of changes to identification information .......................................... 14 9. Authentication and verification ................................................................................................. 14 10. Assurance of data in register ................................................................................................... 15 11. Delegated authority .................................................................................................................. 15 PART 3 - REGISTRAR OF THE IDENTIFICATION REGISTER 12. Appointment of Registrar of the Identification Register ............................................................. 16 13. Powers of the Registrar ........................................................................................................... 16 14. Duties of the Registrar ............................................................................................................. 17 15. Cabinet to issue general policy directions ................................................................................ 18 16. Accountabilities of the Registrar ............................................................................................... 18 17. Registrar may delegate duties ................................................................................................. 19 c Act 14 of 2022 Page 3 Arrangement of Sections Identification Register Act, 2022 18. Conflict of interest .................................................................................................................... 19 19. Termination of appointment of Registrar .................................................................................. 19 PART 4 - ASSIGNMENT OF IDENTIFICATION CODE 20. Assignment of identification code ............................................................................................. 20 21. Use of identification code ......................................................................................................... 21 22. Enrolment in the Register not conferral of immigration status or right to reside ........................ 21 PART 5 - DUTY OF COOPERATION OF PUBLIC AUTHORITIES 23. Responsibility of public authority to cooperate with the Registrar ............................................. 21 24. Obligations of persons submitting data .................................................................................... 22 25. Ensuring of accuracy of identification information .................................................................... 22 26. Correction of inaccurate data ................................................................................................... 23 PART 6 - ACCESS TO THE REGISTER 27. Right to access identification information in register ................................................................. 23 28. Access to identification information on a registered person ...................................................... 23 29. Access to the register and use of information by public authorities........................................... 24 30. Record of access to information ............................................................................................... 24 PART 7 - CONFIDENTIALITY OF THE REGISTER AND DATA ENTERED IN THE REGISTER 31. Disclosure in certain cases ...................................................................................................... 26 32. Unauthorized disclosure of information .................................................................................... 26 33. Duty of confidentiality ............................................................................................................... 27 34. Registrar to implement security measures ............................................................................... 28 PART 8 - OFFENCES 35. Offences relating to personation .............................................................................................. 29 36. Unlawfully collecting identification information.......................................................................... 29 37. Misleading, impeding or obstructing the Registrar .................................................................... 29 38. Offences relating to the register ............................................................................................... 29 39. Tampering with the register ..................................................................................................... 30 40. Registration offences ............................................................................................................... 30 41. Liability for offences ................................................................................................................. 31 PART 9 - GENERAL 42. Incompatibility of other legislation ............................................................................................ 31 43. No personal liability except for bad faith ................................................................................... 31 44. Appeals from decisions of the Registrar ................................................................................... 31 45. Regulations ............................................................................................................................. 32 Page 4 Act 14 of 2022 c Identification Register Act, 2022 Section 1 (Act 14 of 2022) CAYMAN ISLANDS I Assent, Martyn Roper Governor Date: 29th day of December, 2022 IDENTIFICATION REGISTER ACT, 2022 (Act 14 of 2022) AN ACT TO PROVIDE FOR THE ESTABLISHMENT, MANAGEMENT AND OVERSIGHT OF A REGISTER FOR THE IDENTIFICATION OF PERSONS; AND FOR INCIDENTAL AND CONNECTED PURPOSES ENACTED by the Legislature of the Cayman Islands. PART 1 - PRELIMINARY 1. Short title and commencement 1. (1) This Act may be cited as the Identification Register Act, 2022. (2) This Act comes into force on such date as may be appointed by Order made by the Cabinet and different dates may be appointed for different provisions of this Act and in relation to different matters. 2. Interpretation 2. (1) In this Act — “authentication” means the process by which the identity of a person or a person’s identification information is proved as to its accuracy or inaccuracy; “Caymanian” has the meaning assigned by section 2 of the Immigration (Transition) Act (2022 Revision); c Act 14 of 2022 Page 5 Section 2 Identification Register Act, 2022 “Cayman Islands Identification Card System” has the meaning assigned by section 2 of the Cayman Islands Identification Card Act, 2022; “Chief Officer” means the Chief Officer of the Ministry; “civil partner” has the meaning assigned by section 2 of the Civil Partnership Act, 2020; “civil servant” has the meaning assigned by section 2 of the Public Service Management Act (2018 Revision); “delegate” means a person who has been granted delegated authority under section 11; “delegated authority” means the authorization given to a person by the Registrar under section 11 to access and use the register on behalf of another person; “emergency contact information”, in relation to a person, means the name, residential address, telephone number and email address of the emergency contact nominated by the person; “enrol” means the entering of an individual in the register for the first time and includes the process of collecting identification information, including from a public authority; “entry” means an entry of any particular or information in the register and includes an entry that is made electronically or digitally; “General Registry” means the Registry of Births and Deaths for the Islands established under section 3 of the Births and Deaths Registration Act (2021 Revision); “identification code” means the unique identifier assigned to a person under section 20 for the purposes of identifying that person; “identification information” means identity facts and related facts; “identity facts”, in relation to a person, means — (a) the person’s full name; (b) the date of birth of the person; (c) the nationality of the person; (d) the sex of the person; (e) the current category of the person’s right or permission to reside in the Islands in accordance with the Immigration (Transition) Act (2022 Revision) or any other law and the terms and conditions of that permission; and (f) the identification code of the person; Page 6 Act 14 of 2022 c Identification Register Act, 2022 Section 2 “interoperability” means the electronic communication and sharing of data or information between the Registrar and entities or between entities; “legal and ordinary residence” has the meaning assigned by section 2 of the Immigration (Transition) Act (2022 Revision); “legally and ordinarily resident” means a person who has legal and ordinary residence in the Islands; “Minister” means the Minister with responsibility for the register and “Ministry” shall be construed accordingly; “minor” means a person who is under the age of eighteen years; “permanent resident” has the meaning assigned by section 2 of the Immigration (Transition) Act (2022 Revision); “personal data” has the meaning assigned by section 2 of the Data Protection Act (2021 Revision); “photograph” means an image of a person, generated by a process of reflecting light and capturing light through chemical or electronic process and recreating the image either electronically or physically; “principal contact information”, in relation to a person, means — (a) the principal telephone number of the person; (b) the principal email address of the person; (c) the principal mailing address of the person; and (d) the principal residential address of the person; “private entity” means a natural or legal person that is not a public authority; “public authority” has the meaning assigned by section 2 of the Data Protection Act (2021 Revision); “register” means the Identification Register established under section 3; “registered”, in relation to a person, means to be enrolled in the register; “registered person” means a person who is registered under this Act; “registrable event” means — (a) a birth of a person in the Islands; (b) the birth of a Caymanian outside of the Islands; (c) the granting of a work permit or any other form of the right or permission to reside in the Islands by WORC; or (d) the grant or termination of employment of a person who is not a Caymanian as an employee of the Government; (e) the grant of asylum under the Customs and Border Control Act (2022 Revision); c Act 14 of 2022 Page 7 Section 2 Identification Register Act, 2022 (f) the expiry of a work permit or any other form of the right or permission to reside in the Islands; and (g) the revocation of a work permit or any other form of the right or permission to reside in the Islands; “registerable person” means a person who is eligible for registration in the register under this Act; “Registrar” means the person appointed to the office of the Registrar of the Identification Register established under section 12; “Registrar-General” has the meaning assigned by section 2 of the Births and Deaths Registration Act (2021 Revision); “related facts”, in relation to a person, means — (a) place of birth; (b) delegated authority; (c) the identification code of the person’s parent or parents; (d) external characteristics capable of identifying the individual, limited to height and eye colour; (e) physical signature (signature mark); (f) photograph; (g) principal contact information; (h) emergency contact information; (i) other residential addresses, if applicable; and (j) date of death; “reliable document” means an identification document or source of data used to verify a subject’s identification information and that is generally recognized by public authorities and private entities as reliable; “requesting entity” means a public authority or private entity that requests access to information contained in the register; “to use” includes to access, to collect, to obtain, to record, to process, to hold and to disclose; “verification” means the process by which the accuracy of information received is established through comparison of the information received with reliable documents or other information; “WORC” means the Workforce, Opportunities and Residency Cayman Office as defined under section 2 of the Immigration (Transition) Act (2022 Revision); and Page 8 Act 14 of 2022 c Identification Register Act, 2022 Section 3 “work permit” has the meaning assigned by section 2 of the Immigration (Transition) Act (2022 Revision). (2) For the purposes of this Act, a reference to a “person” means a natural person unless the context otherwise requires. PART 2 - CAYMAN ISLANDS IDENTIFICATION REGISTER 3. Establishment of the Identification Register 3. (1) There is established a register which shall be called the Identification Register (“the register”) and which shall be kept and maintained for the following purposes — (a) enabling the persons referred to in subsection (2) to prove certain facts about themselves; (b) providing a secure and reliable method for the use of identification information for the purposes of the ascertainment, verification and authentication by a requesting entity of identity facts or related facts about the persons referred to in subsection (2), where such is necessary in the public interest; (c) providing any service under any enactment to a person by a public authority; (d) enabling or facilitating interoperability between the Registrar and public authorities for the purpose of efficient public administration or policy development; and (e) enabling or facilitating compliance by a person, public authority or private entity, in respect of such person, public authority or private entity, with any duty that relates to the registration of identification under any enactment. (2) Subject to subsection (5), and upon approval by the Registrar of the application for such entry, the following persons may be enrolled in the register — (a) Caymanians; (b) permanent residents; (c) any other person who is legally and ordinarily resident in the Islands; (d) any person who has participated in a registrable event; or (e) any other person or category of person prescribed by regulations made by the Cabinet. c Act 14 of 2022 Page 9 Section 4 Identification Register Act, 2022 (3) A person who is a parent, civil partner, child, or has delegated authority for a person that qualifies to be enrolled in the register under subsection (2) also may be enrolled in the register. (4) For the purposes of subsection (1)(b), the authentication or verification by a requesting entity of identification information is necessary in the public interest if it is for any of the following purposes — (a) establishing the eligibility, entitlement or categorization of persons for the efficient and effective provision of government services or benefits; (b) establishing a person’s entitlement to vote at an election or in a referendum; (c) the prevention or detection of crime; (d) the enforcement of immigration controls, including the enforcement of prohibitions on unauthorized work or employment; and (e) national security. (5) The Registrar may, at the Registrar’s discretion, exclude any person who is no longer resident in the Islands from being enrolled in the register. 4. Form of register 4. (1) The Registrar shall determine — (a) the form in which information to be provided to or entered in the register shall be submitted; (b) the intervals at which the information referred to in paragraph (a) is to be provided; and (c) the form in which information contained in the register shall be kept. (2) For the purposes of subsection (1)(c), the register may be kept, maintained and operated in an encrypted form, subject to its being capable of being converted into a legible form and being used to make a legible copy or reproduction of an entry in the register. 5. Entry of a person in the register 5. (1) An eligible person may apply to the Registrar, in the prescribed manner, to be entered into the register. (2) Where the Registrar approves an application for entry of the eligible person under subsection (1), the Registrar shall make an entry in the register in respect of that person and the entry shall include the identity facts in relation to that person where such information is known to the Registrar, and the Registrar is satisfied as to its accuracy. Page 10 Act 14 of 2022 c Identification Register Act, 2022 Section 6 (3) Where an entry is made in respect of a person under subsection (2), the Registrar shall assign an identification code to the person in accordance with Part 4. (4) An entry made under subsection (2) may include related facts in relation to the person referred to in that subsection. (5) The Registrar may make an entry under subsection (2) relying on identity facts provided by a public authority, including for the initial enrolment and entry of all registrable persons. (6) Upon the enrolment of a minor, the data in the minor’s birth document shall be entered in the register. (7) Notwithstanding subsection (6), where the representative of the minor proves that a birth document cannot be obtained or is unreasonably difficult to obtain, the Registrar may enter in the register — (a) identity facts; and (b) related facts, that are readily available in relation to the minor. (8) For the purposes of subsection (6), “birth document” means the certificate in respect of the registration of a birth issued by the Registrar-General under section 21 of the Births and Deaths Registration Act (2021 Revision) or such other document recognized by the laws of another jurisdiction as an official document which certifies the registration of a birth. 6. Accessing a copy of identification information 6. (1) A person may apply to the Registrar for a copy of the identification information recorded in the register in respect of that person or any other person so specified in accordance with the regulations. (2) An application made under subsection (1) shall — (a) be in such form as the Registrar may approve; (b) be accompanied by the prescribed fee; and (c) comply with any requirements specified by the Registrar, including those in relation to the submission of any documents ascertaining the identity of the person making the application. (3) Where an application is made in accordance with subsection (2), the Registrar shall provide the person making the application with a copy of the identification information relating to the person in respect of whom the application was made within ten business days after receipt of the application. (4) A person under subsection (1) shall notify the Registrar immediately of any inaccuracy in the identification information of which the person has become c Act 14 of 2022 Page 11 Section 7 Identification Register Act, 2022 aware and shall provide the Registrar with such information or document as the Registrar may require to correct the inaccuracy. (5) The Registrar may, at any time, require a person to provide any documents and information as may be necessary for the purpose of verifying identification information relating to that person. (6) The Registrar shall update the information recorded on the register as soon as reasonably practicable following — (a) the notification of an inaccuracy under subsection (4) or the provision of documents or information under subsection (5); or (b) any change in that information given to the Registrar under this Act or under any enactment. (7) The Cabinet, on the recommendation of the Registrar, may make regulations prescribing any person, or a description or class of person, who may make an application under subsection (1). 7. Changes to the register 7. (1) Where, after enrolment, any information on the register is found to be incorrect, misleading or otherwise in need of updating — (a) the registered person; or (b) where the registered person has a delegate, the delegate of the registered person, shall request that the Registrar correct or update the information. (2) On receipt of a request under subsection (1), the Registrar may — (a) request that the registered person provide evidence or further information to support the request; (b) direct the request to the relevant public authority for consideration; or (c) upon being satisfied of the accuracy of the information so provided, make such alteration as may be required in the register relating to the registered person. (3) The Registrar shall notify the registered person, within ten business days after taking action under paragraph (a) or (b), of — (a) the action taken by the Registrar to update the information; or (b) the Registrar’s refusal to update the information and the reasons for the refusal, in such form and manner as the Registrar may determine. Page 12 Act 14 of 2022 c Identification Register Act, 2022 Section 7 (4) Where the Registrar updates the information in relation to a registered person pursuant to subsection (2)(c), the Registrar may notify — (a) public authorities of the relevant change and provide the updated information; and (b) with the consent of the registered person, private entities of the change and provide the updated information. (5) Where the Registrar is notified by a public authority of the incomplete, incorrect or misleading information in a registered person’s entry in the register, the Registrar may take the appropriate action under this Part to complete, correct or update the information and notify the registered person and the public authority. (6) The Registrar may, at the Registrar’s own instance, update an entry of a registered person in the register and in doing so require the provision of identification information from a public authority where that public authority has primary responsibility under any enactment for the issuance or maintenance of any category of identification information. (7) Where a change in identification information is recorded by a public authority for which that public authority has primary responsibility under any enactment for the issuance or maintenance of the identification information, the Registrar may — (a) require that public authority to provide to the Registrar the particular identification information, where applicable, that are subject to the change in identification information; and (b) notify the registered person of the change to the registered person’s identification information that is recorded — (i) by the public authority; and (ii) in the register by the Registrar in the form and manner prescribed by regulations. (8) The Registrar shall maintain complete and accurate records of applications and changes or updates made under this section, including the particulars of changes made to the registered person’s entry in the register. (9) Records maintained by the Registrar in accordance with subsection (8) may be accessed either by a registered person or in accordance with section 29 and section 31. (10) No information in the register shall be altered except in the manner provided in this Act or the regulations. c Act 14 of 2022 Page 13 Section 8 Identification Register Act, 2022 8. Duty to notify the Registrar of changes to identification information 8. (1) Subject to subsection (2), a registered person shall notify the Registrar of changes to identification information including — (a) a change of principal contact information; (b) a change of name, including a change arising from a deed poll, a marriage, a civil partnership, a divorce or a dissolution of civil partnership — (i) conducted within the Islands; or (ii) conducted outside the Islands; and (c) any other changes to identification information as prescribed by regulations, as soon as practicable after the change or event specified in paragraphs (a) to (c) occurs. (2) The requirement of a registered person to notify the Registrar of the change under subsection (1) does not apply where — (a) a public authority which has primary responsibility under any enactment for the issuance or maintenance of any category of identification information provides an update to the Registrar of the change; or (b) the registered person is no longer required to update the Registrar in respect of changes to identification information in accordance with circumstances prescribed by regulations. (3) A person who becomes aware of an error in the register in respect of that person shall notify the Registrar of that error. (4) The Cabinet may make regulations to prescribe — (a) the information that a person is required to supply as evidence of a change or otherwise to support a change to the information recorded on the register in respect of the person; and (b) the manner and form in which the information referred to in paragraph (a) is to be provided to the Registrar, for the purposes of ensuring that there is a complete and accurate entry about persons in the register. 9. Authentication and verification 9. (1) The Registrar may verify the identification information of a registered person, in order to ensure the accuracy of information in the register about the registered person, whether — (a) at the Registrar’s own instance; or Page 14 Act 14 of 2022 c Identification Register Act, 2022 Section 10 (b) at the request of a requesting entity, subject to such conditions and on the payment of such fees as may be prescribed. (2) Subject to subsection (3), a requesting entity may request access to the register from the Registrar for the purpose of authenticating or verifying the identity of a person, or identification information provided by an entity, and the Registrar may grant the request in accordance with this section. (3) A requesting entity under subsection (2) shall ensure that the identification information of a person that was obtained through its access to the register is only used for — (a) the purpose permitted under subsection (2); or (b) any other purpose required by any other enactment or court order. (4) A requesting entity shall notify the person submitting identification information to that requesting entity for verification of the following details, namely — (a) that the requesting entity may seek to verify the information submitted by the person; and (b) the uses to which the information received through its access to the register may be put by the requesting entity. 10. Assurance of data in register 10. For the purposes of ensuring that there is a complete and accurate entry in respect of persons in the register, the Cabinet may prescribe a system of assurance through which levels of assurance may be assigned to identification information. 11. Delegated authority 11. (1) The Registrar shall grant authorization to a person other than the registered person to access and use the register where — (a) the registered person is a minor and the delegate is a parent or legal guardian of the minor; (b) the registered person has appointed the delegate under power of attorney; (c) the authorization is required under any other enactment; or (d) the authorization is required by order of a court. (2) Where the Registrar grants authorization to a person under subsection (1), the Registrar shall provide written notification of the delegated authority to — (a) the registered person; and (b) the person granted delegated authority, in the form and manner prescribed by the regulations. c Act 14 of 2022 Page 15 Section 12 Identification Register Act, 2022 (3) A person who is granted delegated authority by the Registrar under subsection (1) shall have — (a) permitted access to the identification information of the registered person for whom the delegation has been made; and (b) authority to act on the registered person’s behalf in relation to this Act. (4) Where a person performs any actions permitted under subsection (3), such actions shall be recorded under the identity of the person with delegated authority. (5) Where a parent or guardian has delegated authority for a registered person under subsection (1)(a), the delegated authority shall be revoked upon the registered person having attained the age of eighteen years. (6) The Cabinet may make regulations prescribing the procedure for the application and authorization of delegated authority under this section. PART 3 - REGISTRAR OF THE IDENTIFICATION REGISTER 12. Appointment of Registrar of the Identification Register 12. (1) There is established the office of the Registrar of the Identification Register who is responsible for keeping and maintaining the register and the administration of this Act, and such person shall be a civil servant and hold office in accordance with the Public Service Management Act (2018 Revision). (2) A person shall not be appointed to the office of the Registrar under subsection (1) if the person — (a) is a Member of Parliament or has held such office in the three years preceding the proposed appointment as Registrar; or (b) has been convicted of a violent crime or a crime of dishonesty or theft, for which the person has not been pardoned. 13. Powers of the Registrar 13. (1) The Registrar shall have all powers, direct and incidental, as are necessary to undertake and perform the Registrar’s duties under this Act. (2) The Registrar may obtain from persons and public authorities relevant information and documents pertaining to the carrying out of the Registrar’s duties under this Act. (3) The Registrar may require the provision of information and documents from any public authority as may be necessary to perform the Registrar’s duties under this Act. Page 16 Act 14 of 2022 c Identification Register Act, 2022 Section 14 (4) A public authority shall provide to the Registrar the information and documents required by the Registrar under subsection (3) within such time as the Registrar may specify. 14. Duties of the Registrar 14. (1) The Registrar shall — (a) establish and develop the register by the collection and collation of identification information regarding registrable persons; (b) ensure that the accuracy and processing of data contained in the register are in compliance with all applicable legislation; (c) decide on the grant, withholding or revocation of access to data in the register in accordance with this Act and any other enactment; (d) exercise supervision over compliance with the requirements provided for in this Act, including the accuracy of the register and the processing of data; (e) keep under review the arrangements made by entities for the access to and use of information; (f) resolve inconsistencies in data between cooperating public authorities with regard to the accuracy of the register; (g) adjudicate challenges related to the accuracy of the register and the processing of data in the register or refer such challenges to the appropriate public authority; (h) give instructions of an advisory nature with respect to the application of this Act; (i) establish and maintain an improved and modernized system of registration of registrable persons and keep public records through appropriate means; (j) develop systems, procedures and protocols to facilitate appropriate access to data while also ensuring the protection, security and confidentiality of information in the register; (k) develop policies, procedures and protocols for the use and sharing of information contained in the register; (l) provide information or advice, or make proposals, to the Cabinet on matters relating to the duties of the Registrar and for the better administration of the Act; (m) develop public education programmes, and monitor and promote compliance with this Act; and (n) perform such other duties as may be assigned under this Act and any other enactment. c Act 14 of 2022 Page 17 Section 15 Identification Register Act, 2022 (2) In performing the duties specified in subsection (1), the Registrar may — (a) institute measures for the promotion of compliance with this Act; (b) contract the services of one or more providers of goods or services to establish and maintain the register and to perform any other duties in keeping with the establishment and maintenance of the register and the Cayman Islands Identification Card System; (c) establish, develop, implement and monitor procedures, plans and programmes relating to the administration of the register and the Cayman Islands Identification Card System; (d) work with the relevant entities and personnel to maintain the preservation, protection and security of all information or data collected, obtained, maintained or stored in the register; and (e) perform any act or enter into any arrangement which is necessary to ensure the proper performance of the Registrar’s duties. (3) Where the Registrar reviews any arrangements under subsection (2)(e), such review shall include, in particular, a review of the extent to which the arrangements make appropriate provision for — (a) securing the confidentiality and integrity of information recorded on the register; and (b) dealing with complaints made by persons about the use of information recorded on the register. (4) In the exercise of the Registrar’s duties, the Registrar shall cooperate with other public authorities in the implementation of this Act. 15. Cabinet to issue general policy directions 15. (1) The Cabinet may give general policy directions in writing to the Registrar in the exercise and performance of the Registrar’s duties as appear to the Cabinet to be necessary in the public interest. (2) The Registrar shall give effect to the general policy directions given by the Cabinet under subsection (1). 16. Accountabilities of the Registrar 16. (1) Except as otherwise stated in this Act, the Registrar shall be subject to the Public Service Management Act (2018 Revision). (2) The Registrar shall, as soon as practicable but no later than three months after the end of each year, make available to the public a report on the statistics and trends in relation to the data contained in the register, the activities of the office Page 18 Act 14 of 2022 c Identification Register Act, 2022 Section 17 of the Registrar and any other such information as the Registrar considers fit or as the Cabinet may prescribe. 17. Registrar may delegate duties 17. (1) The Registrar may delegate any of the Registrar’s duties under this Act, either generally or specifically and subject to such conditions or restrictions as the Registrar thinks fit, to another civil servant. (2) Where the Registrar delegates any of the Registrar’s duties to a person under subsection (1), the person shall be subject to the confidentiality requirements under Part 7 and any other obligations under this Act. (3) Every delegation under this section shall be in writing and the instrument of delegation shall be given to the delegate. (4) Where a person appointed by the Registrar under this section performs or is to perform any duty, or exercises or is to exercise any power, of the Registrar under this Act, any reference to the Registrar in this Act in respect of that duty or power includes a reference to that person. 18. Conflict of interest 18. (1) Where the Registrar has any actual or potential personal or pecuniary interest, either directly or indirectly — (a) in a transaction or decision being considered by the Registrar; or (b) which may impact the performance of the Registrar’s duties under this Act or any other law, the Registrar, subject to subsection (2), shall disclose the nature of the interest to the Chief Officer as soon as possible after the relevant circumstances have come to the Registrar’s knowledge. (2) Where a person who has been appointed to the office of the Registrar is the Chief Officer, the Chief Officer shall disclose any actual or potential personal or pecuniary interest referred to under subsection (1) to the Deputy Governor as soon as possible after the relevant circumstances have come to the person’s knowledge. 19. Termination of appointment of Registrar 19. (1) The appointment of the Registrar shall be terminated where the Registrar — (a) becomes of unsound mind or becomes permanently unable to perform the Registrar’s duties by reason of ill health; (b) becomes bankrupt or compounds with or suspends payment to creditors; (c) acts in a manner that brings the office of the Registrar into disrepute; c Act 14 of 2022 Page 19 Section 20 Identification Register Act, 2022 (d) is a candidate for or holds office in a political party or is nominated for election to the Parliament; (e) does not declare a conflict of interest where so required under this Act; or (f) fails to substantially carry out the duties conferred or imposed by this Act. (2) The termination of appointment of the Registrar shall be in accordance with the Public Service Management Act (2018 Revision). PART 4 - ASSIGNMENT OF IDENTIFICATION CODE 20. Assignment of identification code 20. (1) The Registrar shall, on entering a registered person’s information in the register, assign to that person an identification code. (2) The identification code shall be — (a) a unique identifier that is used to identify each registered person in the register; and (b) personal to the individual to whom it has been issued and may not be transferred or vested by operation of law in any person other than that individual. (3) The Registrar shall not issue more than one identification code for each registered person at any given time and therefore shall not cause or permit — (a) the formation of the same identification code for more than one registered person; (b) the formation of more than one identification code for each registered person; and (c) the formation of a previously used identification code for a different registered person. (4) An identification code that is assigned to a person under subsection (1) — (a) shall be assigned permanently to the registered person except where it is required to be changed — (i) as a result of the registered person having been a victim of identity theft; or (ii) pursuant to the requirements of any other enactment; and (b) shall not be assigned or re-assigned to, or re-used by, any other person during the lifetime, or after the death, of the registered person. (5) The identification code shall not contain any personal data or identification information. Page 20 Act 14 of 2022 c Identification Register Act, 2022 Section 21 21. Use of identification code 21. (1) A registered person may use that person’s identification code for the purpose of authenticating that person’s identity, including by electronic means, for the purpose of — (a) accessing goods or services provided by the Government or the private sector; or (b) any other purpose for which the authentication of the individual’s identity is required. (2) The identification code may be used, held or maintained by a private entity or public authority for any of the purposes referred to under section 3(1) and in accordance with this Act. 22. Enrolment in the Register not conferral of immigration status or right to reside 22. The enrolment in the register shall not confer on a registered person any right of having — (a) the immigration status of a Caymanian or any other immigration status; or (b) the right to reside or remain in the Islands. PART 5 - DUTY OF COOPERATION OF PUBLIC AUTHORITIES 23. Responsibility of public authority to cooperate with the Registrar 23. (1) Every public authority shall provide the Registrar with all such information as the Registrar may require for the purpose of carrying out the Registrar’s duties under this Act. (2) A public authority shall provide to the Registrar such assistance as may be necessary to ensure the proper discharge of the duties of the Registrar. (3) The Registrar shall require a public authority to provide the Registrar with information relating to a registered person, where the Registrar considers that the public authority may have information in its possession which could be used for verifying — (a) information already recorded in the register about that person; (b) information provided to the Registrar by the person, including information submitted as part of an application for a Cayman Islands Identification Card; or (c) information otherwise unavailable to the Registrar to be included in the person’s entry in the register, c Act 14 of 2022 Page 21 Section 24 Identification Register Act, 2022 where the information referred to in paragraphs (a) to (c) is required by this Act or any other enactment. 24. Obligations of persons submitting data 24. (1) A person submitting identification information under this Act — (a) shall ensure that the data submitted for entry in the register are in compliance with the identification documents specified in this Act or any other enactment which were required as the basis for entry of data in the register; and (b) upon discovery of a mistake or error in the data submitted to the Registrar, shall immediately enter correct data in the register or in the event that there is no option to do so, notify the Registrar of any such error. (2) A person submitting data under this Act shall — (a) ensure that the data submitted to the Registrar accord with the data entered in the identity document referred to in this Act; (b) notify the Registrar immediately of a mistake discovered in the submitted data and submit the accurate data; (c) respond to inquiries from the Registrar which are related to submitting data to the register within three working days after receipt of the inquiry; (d) notify the Registrar immediately of any hindrance to the submission of data; and (e) comply with the requirements for the protection of personal data under the Data Protection Act (2021 Revision). 25. Ensuring of accuracy of identification information 25. (1) The Registrar shall conduct an inquiry concerning the accuracy of identification information in respect of a registered person submitting data where — (a) the registered person disputes the accuracy of the identification information entered in the register in respect of that registered person; (b) several forms of data are submitted in respect of the same identification information and there exists perceivable inconsistencies between the data submitted in the different forms; (c) the identification information submitted is not objectively related to other identification information; or (d) identification information is obviously inaccurate. (2) Where — (a) the circumstances under subsection (1) arise; or Page 22 Act 14 of 2022 c Identification Register Act, 2022 Section 26 (b) a registered person submitting identification information, or a person, public authority or private entity who has received identification information, gives notice of inaccurate identification information gives notice of inaccurate identification information, the Registrar shall verify the accuracy of identification information and correct inaccurate identification information. 26. Correction of inaccurate data 26. Where data in respect of any identification information provided for in this Act is missing in respect of a registered person, the Registrar may — (a) take measures to obtain the missing data; and (b) submit an inquiry to the registered person to submit the relevant data. PART 6 - ACCESS TO THE REGISTER 27. Right to access identification information in register 27. (1) Subject to section 30 and any other exceptions provided for under this Act, the following persons have the right to access the identification information of a registered person in the register — (a) a registered person, who shall have the right to access identification information entered in the register on — (i) that registered person; (ii) a person in respect of whom the registered person has delegated authority; and (b) a public authority or private entity with a legitimate interest. (2) For the purposes of subsection (1)(b), a public authority or a private entity possesses a legitimate interest where the right to access the register is given to such public authority or private entity by — (a) this Act or any other enactment; (b) a power of attorney; or (c) an order of a court. 28. Access to identification information on a registered person 28. (1) A requesting entity may request, with the consent of a registered person or the registered person’s delegate, identification information about the registered person from the register for the purpose of — c Act 14 of 2022 Page 23 Section 29 Identification Register Act, 2022 (a) accessing, authenticating, or verifying certain facts about a registered person; or (b) providing a service to a registered person as required under any other Act. (2) A requesting entity shall ensure that the identification information of a person that was obtained through its access to the register is only used for the purpose permitted under subsection (1) or by any other enactment. (3) A requesting entity shall clearly communicate in writing to the registered person under subsection (1) the uses to which the information that the requesting entity seeks to access from the register is to be put. 29. Access to the register and use of information by public authorities 29. (1) Subject to subsections (2) to (4), a public authority may use identification information from the register for the purpose of — (a) carrying out any function under any Act; or (b) research or statistical analysis to facilitate public administration or policy development. (2) A public authority shall not use information held in the register — (a) for any purpose other than one authorized under this Act or under any other enactment; and (b) unless the public authority has adequate systems in place for securing the confidentiality and integrity of the information. (3) A public authority using data held in the register shall adhere to the principles laid out in the Data Protection Act (2021 Revision) for the processing of personal data. (4) Where the Registrar facilitates the use of identification information under subsection (1) the Registrar shall do so in compliance with the Registrar’s duties set out under section 14 and any other provision of this Act. (5) A public authority shall not withhold the provision of its services to a person on the basis that the person is not a registered person. 30. Record of access to information 30. (1) The Registrar shall maintain records of the access to identification information in the register in such manner and for such period as may be prescribed.

(2) A registered person shall be entitled to obtain from the Registrar, a record of access to that person’s identification information. (3) A requesting entity shall keep a record of every — Page 24 Act 14 of 2022 c Identification Register Act, 2022 Section 30 (a) request for access to identification information in the register, including the purposes for which the request is made; and (b) access made to identification information in the register. (4) Notwithstanding subsection (2), the Registrar may withhold a record of access — (a) if it relates to the prevention, detection or investigation of crime; (b) if it relates to the apprehension or prosecution of a person who is suspected to have committed an offence anywhere; (c) if it relates to national security; (d) where disclosure of the record of access would be likely to prejudice the proper discharge of a public function in the case of — (i) public safety; (ii) the prevention, investigation, detection or prosecution of criminal offences, or of breaches of ethics for regulated professions; or (iii) a substantial economic or financial interest of the Islands, including — (A) compliance with international tax treaties or international cooperation purposes; (B) any monitoring, inspection or regulatory function exercised by official authorities (including regulation of the financial services industry); or (C) any monetary, budgetary and taxation purposes in the Islands; (e) where such access may impair the conduct of a criminal investigation or criminal proceeding; or (f) where so required by an order of a court. (5) Records of access that are withheld under subsection (4) may be accessed — (a) by an order of a court; or (b) except where access is being withheld subject to an order of the court under subsection (4)(f), by a public authority with responsibility for oversight of the requesting entity. c Act 14 of 2022 Page 25 Section 31 Identification Register Act, 2022 PART 7 - CONFIDENTIALITY OF THE REGISTER AND DATA ENTERED IN THE REGISTER 31. Disclosure in certain cases 31. (1) Subject to subsection (2), information collected under this Act in relation to a person in the register may be disclosed only in accordance with this Act or in such manner as may be prescribed by the regulations. (2) The Registrar shall not disclose identification information stored, collected or obtained under this Act about any person to a third party or any other entity, except where the identification information is disclosed in any of the following cases — (a) pursuant to a request of the person whose information is being disclosed; (b) to facilitate the search for or identification of missing persons or unknown deceased persons; (c) pursuant to an order of a court; (d) where this Act or another enactment expressly authorizes the disclosure; (e) for the prevention, detection or investigation of a crime; (f) to facilitate an investigation under the Proceeds of Crime Act (2020 Revision); (g) in the interest of national security; (h) where there is a disaster as defined by section 2 of the Disaster Preparedness and Hazard Management Act (2019 Revision) or a public health emergency; or (i) for the preservation of the life of a person. (3) The court may, on an application by the Registrar, grant an order for disclosure of the information of a person or groups of persons in the register on the grounds that the disclosure is necessary — (a) for the prevention, detection or investigation of a crime; (b) in the interest of national security; (c) where is a disaster as defined by section 2 of the Disaster Preparedness and Hazard Management Act (2019 Revision) or a public health emergency; or (d) to facilitate an investigation under the Proceeds of Crime Act (2020 Revision). 32. Unauthorized disclosure of information 32. (1) A person who without lawful authority — Page 26 Act 14 of 2022 c Identification Register Act, 2022 Section 33 (a) provides any person with information that the person is required to keep confidential; or (b) otherwise makes a disclosure of any such information, commits an offence. (2) For the purposes of subsection (1) — (a) a person is required to keep information confidential if it is information that is or has become available to that person by reason of holding an office or employment the duties of which relate, in whole or in part, to — (i) the establishment or maintenance of the register; or (ii) the use of identification information; and (b) information is provided or otherwise disclosed with lawful authority if such provision or disclosure is — (i) authorized under this Act or under another enactment; (ii) in pursuance of an order or direction of a court; or (iii) for the purposes of the performance of the duties of an office or employment described in paragraph (a). (3) It is a defence for a person charged with an offence under this section to show that, at the time of the alleged offence, that person believed, on reasonable grounds, that the person had lawful authority to provide the information or to make the disclosure in question. (4) A person who commits an offence under subsection (1) is liable to a fine of twenty thousand dollars or to imprisonment for a term of four years, or to both. 33. Duty of confidentiality 33. (1) A person — (a) having or having had a duty under this Act; or (b) being or having been employed in the administration of this Act, shall regard and deal with as confidential, all documents and information relating to the register and the duties of the Registrar where the disclosure of the information could reasonably be considered to put at risk the confidentiality, accessibility or integrity of the register or Cayman Islands Identification Card System, or the data in the register or Cayman Islands Identification Card System. (2) A person who had an official duty under this Act or was employed in the administration of this Act, after such duty was terminated, shall maintain the confidentiality of all information relating to the duties of the Registrar. c Act 14 of 2022 Page 27 Section 34 Identification Register Act, 2022 (3) A person to whom information is communicated under this Act shall regard and deal with such information as confidential, except to the extent otherwise provided in this Act and any other enactment. (4) A person referred to in subsection (1), (2) or (3) having possession of or control over any information, who at any time communicates or attempts to communicate any such information to any person, otherwise than for the purposes of this Act or to any person, other than an authorized officer or person at the direction of the court, commits an offence. (5) A person who commits an offence under subsection (4) is liable on conviction on indictment to a fine of forty thousand dollars or to imprisonment for a term of eight years, or to both. (6) No obligation as to confidentiality or other restriction upon the disclosure of information imposed by any other law or otherwise shall prevent the disclosure by any person of information to the Registrar for the purpose of assisting the Registrar in the performance of the Registrar’s duties. 34. Registrar to implement security measures 34. (1) The Registrar shall take all necessary measures — (a) to protect the information in the possession or control of the Registrar, including information stored in the register; and (b) to ensure that the information is secured and protected against — (i) use not permitted under this Act; and (ii) accidental or intentional destruction, loss or damage. (2) Without prejudice to subsection (1), the Registrar shall — (a) adopt and implement appropriate technological and manual security measures to safeguard the confidentiality of the register; and (b) require the — (i) entities; (ii) consultants; (iii) advisors; or (iv) other legal or natural persons, appointed to, or engaged by, the Registrar to perform or facilitate any of the Registrar’s duties under this Act, to implement appropriate technical and organisational security and such other measures aimed at safeguarding the confidentiality of the register. Page 28 Act 14 of 2022 c Identification Register Act, 2022 Section 35 PART 8 - OFFENCES 35. Offences relating to personation 35. (1) A person shall not — (a) personate a person, role or function authorized under this Act; or (b) exercise or attempt to exercise authority under this Act where the person has not been so authorized. (2) A person who contravenes subsection (1) commits an offence and is liable on summary conviction to a fine of ten thousand dollars or to imprisonment for a term of two years, or to both. 36. Unlawfully collecting identification information 36. (1) A person shall not collect or attempt to collect identification information unless the person is authorized to do so in accordance with this Act or any other enactment. (2) A person who contravenes subsection (1) commits an offence and is liable on summary conviction to a fine of twenty thousand dollars or to imprisonment for a term of two years, or to both. 37. Misleading, impeding or obstructing the Registrar 37. (1) A person shall not knowingly give false or misleading information to the Registrar. (2) A person shall not wilfully obstruct or impede the Registrar in the exercise of the Registrar’s duties. (3) A person who contravenes subsection (1) or (2) commits an offence and is liable on summary conviction to a fine ten thousand dollars or to imprisonment for a term of two years, or to both. 38. Offences relating to the register 38. (1) A person shall not, without lawful authority, intentionally perform or attempt to perform any of the following actions — (a) access the register; (b) act on behalf of a registered person without the person’s consent; (c) access a registered person’s information without the person’s consent; or (d) use or display information in the register. (2) A person shall not intentionally share information in the register that the person knows to be inaccurate. c Act 14 of 2022 Page 29 Section 39 Identification Register Act, 2022 (3) A person who contravenes subsection (1) commits an offence and is liable on conviction on indictment to a fine of twenty thousand dollars or to imprisonment for a term of four years, or to both. (4) A person who contravenes subsection (2) commits an offence and is liable on summary conviction to a fine of ten thousand dollars or to imprisonment for a term of two years, or to both. 39. Tampering with the register 39. (1) A person shall not attempt to or intentionally — (a) introduce or cause to be introduced, any virus, malware or other computer contaminant in the register or any system that supports the register; (b) cause damage to the register or information in the register; (c) disrupt the proper functioning of the register; (d) cause an unauthorized modification of information to be made to an entry in the register; (e) prevent or delay the access or retrieval of relevant information from a computer used for the purposes of this Act; or (f) otherwise alter, destroy, mutilate, deface, hide or remove information in the register. (2) A person who contravenes subsection (1) commits an offence and is liable on conviction on indictment to a fine of twenty thousand dollars or to imprisonment for a term of four years, or to both. 40. Registration offences 40. (1) A person who, for the purposes of this Act — (a) provides false information or makes a false statement when — (i) providing information for an entry or modification of an entry; (ii) making a modification to an entry; or (iii) making a confirmation of the content of an entry; (b) unduly influences the decision of the Registrar or any officer employed in the office of the Registrar; or (c) registers or attempts to enrol an individual more than once in the register, commits an offence and is liable on summary conviction to a fine of ten thousand dollars or to imprisonment for a term of two years, or to both. (2) For the purpose of subsection (1), a person provides false information if at the time of the provision of the information the person — (a) knew or reasonably ought to have known the information to be false; or Page 30 Act 14 of 2022 c Identification Register Act, 2022 Section 41 (b) was reckless as to the veracity of the information. 41. Liability for offences 41. (1) Where an offence under this Act has been committed by a body corporate and is proved to have been committed with the consent or connivance of, or to be attributable to, any neglect on the part of — (a) a director, secretary or similar officer of the body corporate; or (b) a person who was purporting to act in any such capacity, the director, secretary, similar officer of the body corporate or a person purporting to act in any such capacity, as well as the body corporate, commit that offence and are liable to be proceeded against and punished accordingly. (2) Where the affairs of a body corporate are managed by its members, subsection (1) applies, in relation to the acts and defaults of a member in connection with the member’s functions of management, as if the member were a director of the body corporate. PART 9 - GENERAL 42. Incompatibility of other legislation 42. Except as provided in this Act, no enactment or law prohibiting or restricting the disclosure of information shall preclude a person from furnishing the Registrar with any information required for the discharge of the Registrar’s duties under this Act. 43. No personal liability except for bad faith 43. (1) No civil or criminal action, suit or other proceedings for breach of confidentiality may be brought nor any professional sanction for such breach may be taken against a person who, in good faith, under this Act or any other enactment, provides or transmits to the Registrar information requested by the Registrar or submits a report to the Registrar. (2) No suit or other proceedings may be brought or instituted personally against the Registrar or any officer employed in the office of the Registrar in respect of any act done or omission made in performing the duties under this Act unless it is shown that the act or omission was negligent or in bad faith. 44. Appeals from decisions of the Registrar 44. (1) Subject to subsection (6), a person aggrieved by a decision of the Registrar under this Act may appeal the decision by submitting a written notice of the person’s intention to appeal to the Chief Officer in accordance with subsection (2). c Act 14 of 2022 Page 31 Section 45 Identification Register Act, 2022 (2) The procedure for the submission of an appeal to the Chief Officer shall be prescribed in regulations made by the Cabinet. (3) The Chief Officer shall hear and determine appeals brought under this section in accordance with regulations made by the Cabinet. (4) The Chief Officer, upon hearing an appeal under this section, may — (a) confirm, reverse or modify the decision of the Registrar; or (b) in appropriate circumstances, remit the matter to the Registrar, with or without directions as to how the matter should be considered. (5) The Registrar and any other person to whom an appeal under this section applies shall comply with the decision of the Chief Officer made under this section. (6) An appeal from any decision of the Chief Officer under this section shall lie to the Grand Court. 45. Regulations 45. (1) The Cabinet, in consultation with the Registrar, may make regulations for the better carrying out of the objects and purposes of this Act. (2) Without prejudice to the generality of subsection (1), the Cabinet may make regulations to prescribe — (a) the forms to be used and fees to be charged in connection with any application, notice, certificate or other document under this Act; (b) the procedures and practices to be followed by the Registrar in the collection, verification and authentication of information required for the registration of persons or any class of persons; (c) the procedures and processes for the management and storage of information in the register, and the security protocols and technological safeguards for such information; (d) the procedures for the collection and registration of changes to the information of a registered person and the entry of the changed information into the register; (e) the imposition of fees to be prescribed under this Act and for the reduction, refund or waiver of the fees; (f) the procedures for access to the register; (g) the procedures for the preservation, custody and safekeeping of records and information under this Act, including the archiving of the identification codes of deceased persons and other categories of person in separate parts of the register; Page 32 Act 14 of 2022 c Identification Register Act, 2022 Section 45 (h) the procedures for the settlement of disputes arising from, and appeals against, a decision of the Registrar; (i) the period of time for the doing of any act under this Act; (j) for any thing or matter that is required or permitted to be prescribed under this Act; and (k) generally for giving effect to the provisions and purposes of this Act. (3) Regulations made under this Act may — (a) make different provisions in relation to different cases or circumstances; (b) apply in respect of particular persons or particular cases or particular categories of persons or particular categories of cases and define the categories by reference to any circumstances of any kind; (c) contain such transitional, consequential, incidental or supplementary provisions as appear to the Cabinet to be necessary or expedient for the purposes of this Act; and (d) create an offence punishable on summary conviction by a fine of up to twenty thousand dollars or to imprisonment for a term of two years, or to both. Passed by the Parliament the 14th day of December, 2022. Hon. Katherine Ebanks-Wilks Speaker Zena Merren-Chin Clerk of the Parliament c Act 14 of 2022 Page 33