Processes personal data, in Trinidad and Tobago

Act 13 of 2011, ss. 6(h), 40 and 76 (sensitive personal information) · Read the law's page

• Section 6(h)'s general principle already binds everyone who handles, stores or processes personal information: do not process sensitive personal information (racial or ethnic origin, political affiliation or trade union membership, religious belief, physical or mental health, sexual orientation, or criminal or financial record) unless a written law otherwise provides for it.
• Once Part III is in force, a public body may process sensitive personal information only with the person's consent, or where a listed exception applies, such as health care treatment by a health care professional, information the person already made public, research under section 43, law enforcement or national security, or determining access to social services.when it serves a public body
• Once Part IV is in force, a corporation may process sensitive personal information in its possession only with the person's consent, or where a listed exception applies, such as health care treatment, information already made public, research under section 43, or where written law requires it.

Act 13 of 2011, ss. 6(l), 46 and 72 (cross border disclosure) · Read the law's page

• Section 6(l)'s general principle already binds everyone who handles personal information: before disclosing personal information outside Trinidad and Tobago, make sure the disclosure is regulated and that comparable safeguards to those under this Act exist in the receiving jurisdiction.
• Once Part III is in force, before a public body discloses personal information to a party in another jurisdiction, tell the individual the purpose of the disclosure and the identity of the requester and the receiving jurisdiction's data protection body, and obtain the individual's consent.when it serves a public body
• Once Part IV is in force, follow the same disclosure, consent and Commissioner-referral process before an organisation covered by a mandatory code of conduct discloses personal information to another jurisdiction.

Act 13 of 2011, ss. 7-28 and 87-96 (Commissioner, contravention and enforcement) · Read the law's page

• The Office of the Information Commissioner is established and operating, with powers to audit and investigate compliance, order a body to stop a contravening practice, authorise data matching, and publish compliance guidelines; the Commissioner's power to audit or enquire specifically under Part III or Part IV (sections 20 and 21) is outside the provisions that section 1(2) brought into operation on 6 January 2012.
• The Commissioner and anyone acting under the Commissioner's direction must not disclose information obtained in performing their duties under the Act.

Act No. 13 of 2011 (Data Protection Act), Chap. 22:04, ss. 1-6, excluding paragraphs (h) and (l) of section 6 · Read the law's page

• Part I of the Act, including the General Privacy Principles in section 6, and sections 7 to 18, 22, 23, 25(1), 26 and 28 of Part II, are in force; Part III (public-body duties), Part IV (private-sector duties) and Part V (offences and penalties) are enacted but have not been proclaimed.
• Whether or not Part III or Part IV binds you yet, be responsible for the personal information under your control, identify the purpose of collection before or at the time of collection, and get the individual's knowledge and consent for its collection, use or disclosure.
• Limit collection of personal information to what is legally undertaken and necessary for the identified purpose, retain it only as long as necessary for that purpose, and do not disclose it for another purpose without the individual's prior consent.
• Keep personal information accurate, complete and up to date as necessary for the purpose of collection, and protect it with safeguards appropriate to its sensitivity.
• Make available to individuals your policies and practices for managing personal information, and give an individual the ability to challenge your compliance with these Principles and a timely, appropriate response.

Act 13 of 2011, ss. 52-59 and 75-85 (rights of access and correction) · Read the law's page

• Once Part III is in force, respond to an individual's access request within thirty days, either giving the personal information, or a written refusal stating the specific ground and the right of appeal to the Commissioner.when it serves a public body
• Once Part III is in force, on a correction request either correct the personal information or annotate it with the requested correction, and notify any other public body or third party the information was disclosed to in the year before the request.when it serves a public body
• Once Part IV is in force, respond to an individual's access request against your organisation the same way a public body must under Part III, and follow whatever access, correction, and complaint procedure your mandatory code of conduct states.
• Part III's and Part IV's access and correction rights (sections 52 to 59 and 75 to 85) are enacted but have not been proclaimed; a public body or an organisation currently owes no statutory duty under this Act to answer an access or correction request.