Personal Data Trusts And The Cayman Islands

The core intangible, but not invaluable, contribution we as individuals make to the symbiotic relationship between human and technology is the personal data we generate which, up until recently, has been largely overlooked – except, of course, by astute commercial organisations who seek to exploit such discarded personal data for profit.  

Personal Data Trust Concept  

I have previously written on the topic of personal data trusts[i], and I concluded it is conceivable that a private purpose trust[ii] could be established in a jurisdiction such as the Cayman Islands to hold and monetise personal data for the benefit of the creators of such data (whom I have dubbed ‘data generators’).

It is not widely known that personal data is a valuable commodity and a whole industry has built up around gathering, collating, re-packaging and selling personal data to data consumers. Given the intangible nature of personal data, it is possible to repurpose and repackage such data many times over to tailor it to the needs of the particular data consumer. Thus, personal data represents a virtually inexhaustible resource for those involved. Such personal data is routinely harvested from data generators via their conscious interactions with the internet (e.g. internet search history), consumer activity, and the indirect interaction with the internet via ‘internet of things’[iii]. All such data has inherent commercial value and such data is bought and sold on a regular basis without any benefit accruing to the data generators themselves.  

As it stands, only commercial organisations have been involved in the personal data industry but it is conceivable that a private purpose trust or an appropriate corporate entity (such as a Cayman Islands Foundation Company) could be established for the purposes of gathering, re-packaging, and selling on such personal data for the collective benefit of the data generators, provided such data generators consent. The end result is data generators would ultimately benefit from the personal data they create and share. Such trusts, which I have dubbed ‘personal data trusts’ (PDTs) would operate in a similar fashion to a unit trust, in that the trustee and other fiduciaries[iv] involved would charge an administration fee, but the net profits would be shared amongst the data generators as beneficial objects of the PDT.        

The following is a short exploration of how such PDTs could operate in the Cayman Islands within the confines of our data protection, trust, and company law regimes.

Brief Overview Of The Cayman Islands Data Protection Regime 

Up until recently, it was a crime in the Cayman Islands, punishable by fines and/or imprisonment, for a person in possession of confidential information to make an unauthorised disclosure of such information[v].  In 2016, the relevant legislation was repealed and replaced by a more modern[vi] framework ensuring such confidential information would remain safeguarded while enabling the Cayman Islands to adhere to its international obligations to combat money laundering, tax evasion, terrorist financing, and all other criminal activities[vii]. 

In 2019,[viii] the Data Protection Act (2017) came into force further bolstering the Cayman Islands regime concerned with the protection and sharing of personal data and setting out the duties and obligations of those persons charged with managing personal data. This Act also references a core constitutional Cayman Islands Bill of Rights, Freedoms and Responsibilities which enshrined the key right to privacy, including the right to know and, if appropriate, challenge how their personal data is being managed.   

The framework for data protection in the Cayman Islands remains robust, notwithstanding the various carve-outs required to satisfy our international obligations, as set out above, and in circumstances where an individual is complying with the Cayman Islands court or a Cayman Islands statutory authority, such as the Financial Reporting Authority, or the Royal Cayman Islands Police. It is important to note that the new regime continues to preserve the right to confidentiality of personal information yet it still affords any aggrieved individual the right to seek remedies from the Cayman Islands court for any unauthorised disclosure of confidential information. One important carve-out is the right of any person to share their data by way of express or implied consent[ix]. Therefore, ‘data generators’ who wish to share their personal data with the trustees of a PDT would be free to do so as a matter of Cayman Islands law. This is a key component to ensure such personal data can be held and exploited by the trustees of a PDT within Cayman’s data protection framework.

Cayman Islands Trusts

Cayman Islands trusts are amongst the most popular trusts globally. This stems from Cayman’s stellar reputation as a cutting-edge trust jurisdiction with modern and ever-evolving trust legislation, a solid and respected judiciary, depth of trust jurisprudence, and an abundance of professional advisors and highly reputable fiduciary service providers.    

PDTs, if they ever were to come into existence in the form of a trust, would likely take the form of a private purpose trust, otherwise known in the Cayman Islands by their acronym “STAR Trusts”[x] and would operate on similar principles to a unit trust, in that data generators would be entitled to acquire some defined beneficial interest in the PDT in exchange for access and control over their personal data. The reason STAR trusts are best suited to PDTs lies in the fact that they are capable of performing non-charitable private purposes (so long as they are lawful and not contrary to public policy) as well as tangible benefits to defined beneficial objects. Also, all STAR trusts must have an “Enforcer” who is a person, group of persons, or a legal entity with responsibility for ensuring the purposes of the STAR trust are being carried out correctly. The Enforcer is the only person with standing to call trustees to account before the Cayman court. The main benefit to this arrangement lies in the fact that any data generator can be assured there is someone in the equation with a fiduciary duty to perform, in addition to the trustee, who has their best interests in mind and is duty-bound to safeguard their interests. Also, given there is only one person with enforcement powers, it should deter and eliminate any vexatious or unmerited claims against the trustees by any aggrieved beneficial objects[xi] which might otherwise disrupt the administration of the PDT and require the PDT trustees to expend trust monies on lawyers to defend such claims. As such, the STAR trust represents the ideal type of trust to become a PDT, should PDTs ever become a reality[xii]. 

The Cayman Islands Foundation Company

The Cayman Islands Foundation Company (FCs) was introduced into Cayman law in 2017 to primarily act as a corporate wealth planning vehicle broadly akin to a corporate trust. The FC has certain unique features which distinguish it from a standard Cayman Islands company and make it ideal for wealth and succession planning. These include an ability for an FC to be formed as a limited by guarantee company (hence no shareholders); objects set out in the constitutional documents can be entrenched or only subject to amendment under prescribed circumstances; profits are not payable as dividends to shareholders – instead any net profits are payable to a defined group of beneficial objects (the data generators in this example); and acts of the directors are overseen by a ‘supervisor’ which enhances oversight and ensures compliance with the stated objectives of the FC[xiii].        

As such, there are no conceptual difficulties with an FC carrying out purposes similar to those found in a PDT (i.e. to hold and exploit personal data for the benefit of data generators). Whether an FC is superior to a PDT in this context is open for debate, but in my view, both could do the job effectively so it would likely become a matter of market practice based on which platform establishes itself as the most preferred vehicle.    

Conclusion

Whether or not PDTs will ever become a reality remains a matter of speculation.  Certainly, there is growing awareness amongst the general public about the use and misuse of their personal data which could spawn interesting solutions such as the PDT. If and when the time comes, the Cayman Islands should be at the forefront, thus continuing its long tradition of being ahead of the curve of its competitors on thought leadership products and solutions.

Footnotes:

[i] STEP Journal Issue 4, published on 28 August 2020.

[ii] Such as a Cayman Islands private purpose trust / STAR trust.

[iii] Roughly meaning the multiple ways the devices we use automatically connect to the internet without our direct control. For example, the popular ‘Fitbit’ device.  

[iv] Such as the Enforcer in the context of a STAR trust.

[v] Under The Confidential Relationships (Preservation) Law (repealed).

[vi] The Confidential Relationships (Preservation) Law was originally enacted in 1976.

[vii] For example, as arise under the numerous tax information exchange agreements the Cayman Islands has in place, the Common Reporting Standard, and FATCA regime. An exploration of these regimes are outside of the scope of this article.

[viii] The Data Protection Law 2017, (Commencement) Order, 2019 which brought this law into force on 30 September 2019.

[ix] The Confidential Information Disclosure Law (2016) which repealed the Confidential Relationships (Preservation) Law (2015 Revision).

[x] This acronym stands for the “Special Trusts Alternative Regime” – which appears in Part VIII of the Trusts Act (2020 Revision). 

[xi] Of which there could be many. As a certain level of data volume and data generator would be necessary to make a PDT commercially viable. 

[xii] For the sake of clarity, PDTs do not yet exist anywhere in the world to the knowledge of the author. They are merely a concept as at the date of this article.

[xiii] A detailed exploration of Foundation Companies is outside of the scope of this article. Please see the author’s article entitled “New Options, New Choices” published in the Trust Quarterly Review in June 2018 which compares and contrasts the Foundation Company with the STAR Trust.

Robert Mack
Robert is Head of Private Client & Trusts at HSM Chambers (hsmoffice.com). He specialises in private and commercial trusts, contentious trust & estate matters and advises high-net-worth families and trust companies. Robert is the author of several professional journal articles across STEP Journal, STEP TQR, LexisNexis, IFC Review and more. He has spoken at local and international trusts conferences on a wide variety of topics. Who’s Who Legal Private Client (2020, 2019 and 2018); Chambers & Partners Offshore Trusts HNW Guide (2020, 2019 and 2018).