Antigua and BarbudaData Protection Act, 2013, sensitive personal data
Data Protection Act, 2013, s. 18 (sensitive personal data)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent
- Audit expectation
- none
What it requires
- Do not process sensitive personal data, meaning information about a data subject's physical or mental health, sexual orientation, political opinions, religious or similar beliefs, or the commission or alleged commission of an offence, unless the data subject has given explicit consent to the processing.
- Where consent is not obtained, process sensitive personal data only on a listed ground such as an employment law obligation, protecting the vital interests of the data subject or another person, medical treatment by a healthcare professional, legal proceedings or advice, the administration of justice, or exercising a function conferred by law.
- You may also process sensitive personal data that the data subject has already made public through their own deliberate action.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 18 bars processing sensitive personal data except on the listed conditions, led by the data subject's explicit consent, and makes a contravention an offence with a fine and imprisonment (section 18(3)). It does not require a person to keep or produce a record of the consent or of the processing, and no clause of the section names a log. The Act has no territorial scope clause, so the hook is empty.
- Kind
- None
- As of
What this law does
Section 18(1) bars a data user from processing sensitive personal data, meaning information about a data subject's physical or mental health or condition, sexual orientation, political opinions, religious or similar beliefs, or the commission or alleged commission of an offence, except where the data subject has given explicit consent to the processing.
Section 18(1)(b) lists the alternative grounds on which sensitive personal data may be processed without consent, including exercising or performing an employment law right or obligation, protecting the vital interests of the data subject or another person where consent cannot be given or reasonably obtained, medical treatment by a healthcare professional or a person under an equivalent duty of confidentiality, legal proceedings or obtaining legal advice, establishing, exercising or defending legal rights, the administration of justice, or exercising a function conferred by written law.
Section 18(1)(c) also permits processing sensitive personal data that the data subject has already made public through their own deliberate action. Section 18(2) lets the Minister, by Order published in the Gazette, exclude some of those grounds in specified cases or make them subject to further conditions. The Act states no commencement date of its own. It received the Governor-General's assent on and was published in the Official Gazette (Vol. XXXIII No. 64) on .
Under section 5(1) of the Statutes Act, a statute not expressed to come into operation on a particular day comes into operation on the day it is published in the Gazette.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .