Antigua and BarbudaData Protection Act, 2013, information commissioner and enforcement
Data Protection Act, 2013, ss. 21-27 (information commissioner and enforcement)
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Information Commissioner (appointed under the Freedom of Information Act 2004)
- Obligation class
- Governance, Reporting
- Audit expectation
- none
What it requires
- Do not intentionally disclose personal information of another person in contravention of this Act, and do not collect, store or dispose of personal information in a manner that contravenes it, each a criminal offence.NIST Privacy FrameworkCT.PO-P1
- Expect a contravention of this Act for which no penalty is otherwise specified to carry, for an individual, a fine of up to fifty thousand dollars or imprisonment of up to three years on summary conviction, or a fine of up to one hundred thousand dollars or imprisonment of up to five years on indictment, and for a body corporate, a fine of up to two hundred thousand dollars on summary conviction or five hundred thousand dollars on indictment.
- Comply with a requirement the Information Commissioner specifies in an enforcement notice or an information notice, and expect an appeal against that requirement, or against a decision of the Information Commissioner, to lie to the Eastern Caribbean Supreme Court.NIST Privacy FrameworkGV.PO-P5
- Expect the Information Commissioner and anyone acting on the Commissioner's behalf to keep confidential the information that comes to their knowledge in enforcing this Act, and to report annually to Parliament on data protection activities under it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Unlawfully processing sensitive personal data is an offence under s. 18(3) carrying a fine of up to two hundred thousand dollars or imprisonment of up to three years, or both. A contravention for which no other penalty is specified is an offence under the s. 23 general penalty: for an individual, a fine of up to fifty thousand dollars or imprisonment of up to three years on summary conviction, or a fine of up to one hundred thousand dollars or imprisonment of up to five years on indictment; for a body corporate, a fine of up to two hundred thousand dollars on summary conviction or five hundred thousand dollars on indictment.
Penalty structure
Five hundred thousand dollars is the ceiling the Act itself states, for a body corporate convicted on indictment under s. 23(2)(b). An individual's general-penalty ceiling is lower (one hundred thousand dollars on indictment, fifty thousand on summary conviction, under s. 23(1)), and unlawfully processing sensitive personal data carries its own, separate penalty of up to two hundred thousand dollars or three years imprisonment under s. 18(3).
- Rule
- Fixed only
- As of
- Currency
- XCD
- Fixed cap
- 500,000
What it makes you log
Logging duty
Section 21 gives the Information Commissioner the powers, functions and duties the Freedom of Information Act 2004 confers, particularly under its Parts V, VI and VII, for enforcing this Act, and sections 22 and 23 create the offences and the general penalty. Those Parts are not set out in this Act and are not cited by this row, so no power to demand records or to audit is read into it. Sections 24 to 27 deal with appeals, protection from proceedings, confidentiality and the Commissioner's own annual report to Parliament, which is the Commissioner's report and not a record duty on a data user. No clause of these sections requires a data user to make, keep or produce a log or record. The Act has no territorial scope clause, so the hook is empty.
- Kind
- None
- As of
What this law does
Section 21 assigns the Information Commissioner appointed under the Freedom of Information Act 2004 the powers, functions and duties needed to enforce this Act. Section 22 makes it an offence for a person to intentionally disclose another person's personal information in contravention of this Act, or to collect, store or dispose of personal information in a manner that contravenes it.
Section 18(3) separately makes contravening the sensitive personal data conditions in section 18(1) an offence carrying a fine of up to two hundred thousand dollars or imprisonment of up to three years, or both.
Section 23 makes a contravention of this Act for which no other penalty is specified an offence carrying, for an individual, a fine of up to fifty thousand dollars or imprisonment of up to three years on summary conviction, or a fine of up to one hundred thousand dollars or imprisonment of up to five years on conviction on indictment, and for a body corporate, a fine of up to two hundred thousand dollars on summary conviction or five hundred thousand dollars on indictment.
Section 24 gives a right of appeal to the Eastern Caribbean Supreme Court against a requirement in an enforcement notice or an information notice, against a decision of the Information Commissioner on a complaint, or against any decision of the Information Commissioner in the conduct of duties and powers under this Act.
Section 25 bars criminal or civil proceedings against the Information Commissioner, or a person acting on the Commissioner's behalf, for anything done in good faith in exercising a power, duty or function under this Act, and gives absolute privilege to words spoken and reports made in good faith in that exercise.
Section 26 bars the Information Commissioner and anyone acting on the Commissioner's behalf from disclosing information that comes to their knowledge in the conduct of their functions under this Act. Section 27 requires the Information Commissioner to include a report on data protection activities under this Act in the annual report made to Parliament under the Freedom of Information Act 2004. The Act does not arm a data subject with an independent private right of civil action.
The Act states no commencement date of its own. It received the Governor-General's assent on and was published in the Official Gazette (Vol. XXXIII No. 64) on . Under section 5(1) of the Statutes Act, a statute not expressed to come into operation on a particular day comes into operation on the day it is published in the Gazette.
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .