Processes personal data, in Antigua and Barbuda

Data Protection Act, 2013 (No. 10 of 2013), ss. 5, 7-10, 17, 19-20 · Read the law's page

• Obtain a data subject's consent before processing their personal data, other than sensitive personal data, arising from a commercial transaction, unless a listed alternative ground such as contract performance, a legal obligation, protecting vital interests or the administration of justice applies.
• Process personal data only for a lawful purpose directly related to your activity, keep the processing necessary for that purpose, and keep the data adequate but not excessive for it.
• Do not disclose personal data for a purpose other than the one notified at collection, or a purpose directly related to it, without the data subject's consent, unless a listed exception applies, such as preventing or detecting crime, complying with a court order, or a public interest determination by the Minister.
• Take practical security steps against loss, misuse, unauthorised or accidental access, disclosure, alteration or destruction of personal data, having regard to its sensitivity, where it is stored, and the reliability of personnel with access, and secure the same guarantees from any data processor you engage.
• Do not keep personal data longer than necessary for the purpose it was collected for, and destroy or permanently delete it once that purpose has lapsed.
• Keep personal data accurate, complete, not misleading and up to date, having regard to the purpose it was collected and further processed for.

Data Protection Act, 2013, s. 18 (sensitive personal data) · Read the law's page

• Do not process sensitive personal data, meaning information about a data subject's physical or mental health, sexual orientation, political opinions, religious or similar beliefs, or the commission or alleged commission of an offence, unless the data subject has given explicit consent to the processing.
• Where consent is not obtained, process sensitive personal data only on a listed ground such as an employment law obligation, protecting the vital interests of the data subject or another person, medical treatment by a healthcare professional, legal proceedings or advice, the administration of justice, or exercising a function conferred by law.
• You may also process sensitive personal data that the data subject has already made public through their own deliberate action.

Data Protection Act, 2013, ss. 21-27 (information commissioner and enforcement) · Read the law's page

• Do not intentionally disclose personal information of another person in contravention of this Act, and do not collect, store or dispose of personal information in a manner that contravenes it, each a criminal offence.
• Expect a contravention of this Act for which no penalty is otherwise specified to carry, for an individual, a fine of up to fifty thousand dollars or imprisonment of up to three years on summary conviction, or a fine of up to one hundred thousand dollars or imprisonment of up to five years on indictment, and for a body corporate, a fine of up to two hundred thousand dollars on summary conviction or five hundred thousand dollars on indictment.
• Comply with a requirement the Information Commissioner specifies in an enforcement notice or an information notice, and expect an appeal against that requirement, or against a decision of the Information Commissioner, to lie to the Eastern Caribbean Supreme Court.
• Expect the Information Commissioner and anyone acting on the Commissioner's behalf to keep confidential the information that comes to their knowledge in enforcing this Act, and to report annually to Parliament on data protection activities under it.

Data Protection Act, 2013, ss. 6, 11-16 (notice and rights of data subjects) · Read the law's page

• Tell a data subject, on request, the purposes of collecting and processing their personal data, its source if known, the classes of third parties it may be disclosed to, whether supplying it is obligatory or voluntary and the consequences of not supplying it, and how to contact you with inquiries or complaints.
• Give a data subject access to their personal data within thirty days of a written and paid request, disclosing the data itself, the purposes of processing, the classes of recipients and the data's source, subject to a permitted extension of up to thirty further days or a longer period to convert the data into an alternative format for a data subject with a sensory disability.
• Where you deny an access request, state the specific statutory ground in the refusal notice, tell the data subject of the right to complain to the Information Commissioner, and treat a failure to respond within the time limits as a deemed refusal.
• Correct personal data on a data subject's written application where it is incomplete, incorrect, misleading, excessive or irrelevant to the purpose it is held for, without obliterating the pre-amendment text of the document, or give written reasons for refusing and tell the data subject of the right to complain to the Information Commissioner within twenty-eight days.