Processes personal data, in Saint Lucia

Act 11 of 2011 (as amended by Act 2 of 2015), Laws of Saint Lucia, ss. 1-4, 32-34 and 39-43, Part 6 (ss. 58-68) and Schedule 2 · Read the law's page

• Before collecting personal data directly from a person, tell them what is being collected, why, who will receive it, whether providing it is mandatory, the consequences of not providing it, and their rights to access, correct, and have it destroyed.
• Collect personal data only for a lawful purpose connected with your function or activity, and only where the collection is necessary for that purpose.
• Obtain a person's express consent before processing their personal data, unless a specific ground applies such as performing a contract with them, complying with a legal obligation, or a legitimate interest that does not override their privacy rights, and let them object to processing done on public interest or legitimate interest grounds and revoke consent at any time.
• Keep personal data only for the specified purpose it was collected for, do not use or disclose it in a way incompatible with that purpose, keep it adequate and relevant and not excessive, and keep it accurate and up to date.
• Take security measures appropriate to the risk of unauthorized access, alteration, or loss of personal data, taking the state of technology and the cost of the measures into account, and make sure staff know and follow them.
• Destroy personal data as soon as reasonably practicable once the purpose for holding it has lapsed.
• Part 4's registration scheme (sections 46 to 51) is enacted and not in force, so a data controller currently has no statutory duty under this Act to register with the Commissioner.

Act 11 of 2011, ss. 35-38 (sensitive personal data) · Read the law's page

• Do not process a special category of sensitive personal data (racial or ethnic origin, political opinion, religious belief, physical or mental health, sexual orientation, or criminal or financial record) unless a listed ground applies, the person has given explicit consent, or the person already published it themselves.
• Where you rely on the vital-interests or right-or-obligation grounds to process sensitive personal data without consent, put appropriate safeguards in place first.
• Process sensitive personal data for health or medical purposes only through a health practitioner or someone bound by professional confidentiality, and only for preventive medicine, public health, medical diagnosis, medical research, or managing health and hospital care services.
• Before processing or disclosing sensitive personal data for research or statistical purposes, confirm identifiable data is genuinely necessary, commit not to use it to recruit research participants, get the responsible officer's approval of security and destruction conditions, and get the recipient's signed agreement to comply with them.

Act 11 of 2011, s. 45 (transfer of personal data) · Read the law's page

• Section 45's restriction on transferring personal data outside Saint Lucia is enacted and not in force, so a data controller currently has no statutory duty under this Act to secure Commissioner authorization or comparable safeguards before an international transfer.
• Once section 45 is in force, transfer personal data outside Saint Lucia only where the receiving country or territory has comparable safeguards and the Commissioner has authorized the transfer, or a listed exception applies, such as the data subject's consent, contractual necessity, national or public security, or Commissioner-approved terms.

Act 11 of 2011, ss. 5-31 and 69-74 (Commissioner, offences and penalties) · Read the law's page

• The Data Protection Commissioner has not been appointed and Part 2's investigation, information-notice and enforcement-notice powers are not in force, so no data controller currently answers to an operating supervisory authority under this Act.
• Part 7's general offence and penalty provision, section 71, is enacted and not in force, so a contravention of a provision that states no penalty of its own currently carries none under this Act.
• The one enforceable penalty is the fine under section 34(5): a data controller who processes personal data without the required consent is liable on summary conviction to a fine not exceeding $25,000, the 2015 Act having removed the alternative of imprisonment.
• Section 44's unlawful-disclosure offence and section 45's transfer restriction are both enacted and, like the rest of the Act outside sections 32 to 43, not in force.

Act 11 of 2011, ss. 52-57A (rights of data subjects) · Read the law's page

• Part 5's data-subject rights (access, rectification, objection to direct marketing, and employee protection, sections 52 to 57A) are enacted and not in force; a data controller currently has no statutory duty under this Part to answer an access, correction, or objection request.
• Once Part 5 is in force, respond to a data subject's written access request by disclosing whether you hold personal data about them, describing it, stating the purposes and source of processing, explaining the logic of any automated processing, naming the recipients, and letting them examine or obtain a copy on payment of the prescribed fee, in an alternative format if they have a sensory disability.
• Once Part 5 is in force, correct inaccurate personal data on request and stop processing a person's personal data for direct marketing on their objection.