Antigua and BarbudaData Protection Act, 2013, notice and rights of data subjects
Data Protection Act, 2013, ss. 6, 11-16 (notice and rights of data subjects)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- Tell a data subject, on request, the purposes of collecting and processing their personal data, its source if known, the classes of third parties it may be disclosed to, whether supplying it is obligatory or voluntary and the consequences of not supplying it, and how to contact you with inquiries or complaints.NIST Privacy FrameworkCM.AW-P1
- Give a data subject access to their personal data within thirty days of a written and paid request, disclosing the data itself, the purposes of processing, the classes of recipients and the data's source, subject to a permitted extension of up to thirty further days or a longer period to convert the data into an alternative format for a data subject with a sensory disability.NIST Privacy FrameworkCT.DM-P1
- Where you deny an access request, state the specific statutory ground in the refusal notice, tell the data subject of the right to complain to the Information Commissioner, and treat a failure to respond within the time limits as a deemed refusal.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkGV.MT-P7
- Correct personal data on a data subject's written application where it is incomplete, incorrect, misleading, excessive or irrelevant to the purpose it is held for, without obliterating the pre-amendment text of the document, or give written reasons for refusing and tell the data subject of the right to complain to the Information Commissioner within twenty-eight days.NIST Privacy FrameworkCT.DM-P3NIST Privacy FrameworkGV.MT-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CT.DM-P3Data elements can be accessed for alteration.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 6 and 11 to 16 set out what a data user tells a data subject on request, the right of access with a thirty-day period, the denial notice and the right of rectification. Section 16(3) asks a body amending personal data, so far as practicable, not to obliterate the text of the document as it stood before the amendment; that preserves the earlier wording of the document and does not require a log of the change, so it is not coded as a record duty. No clause of these sections requires a log of requests or a record of consent. The Act has no territorial scope clause, so the hook is empty.
- Kind
- None
- As of
What this law does
Section 6 requires a data user, on a data subject's request, to disclose the purposes for which their personal data is being or will be collected and processed, any information available about its source, the classes of third parties it may be disclosed to, whether supplying the data is obligatory or voluntary and the consequences of not supplying it, and how to contact the data user with inquiries or complaints.
Section 11 gives a data subject the right to access their personal data held by a data user and to have it corrected where it is inaccurate, incomplete, misleading or not up to date, except where access or correction is refused under this Act.
Section 12 requires a public body or private body, on a person's written request and payment of the prescribed fee, to say whether personal data of which that person is the data subject is being processed and, if so, to communicate the data itself, the purposes of processing, the classes of recipients and the source of the data.
Section 13 requires the body to give written notice within thirty days of the request whether access will be granted and, if so, to give access, subject to an extension of up to thirty further days or a longer period needed to convert the data into an alternative format.
Section 14 lets a body deny access where it lacks information to identify the requester or locate the data, where an exemption or duty of confidentiality applies, where a third party identifiable from the data withholds consent, or where the Information Commissioner approves the refusal in writing, and requires the Chief Executive Officer's refusal notice to state the specific statutory ground and the right to complain to the Information Commissioner.
Section 15 requires the body to let the data subject examine the personal data or give them a copy, in an alternative format where the data subject has a sensory disability and that format already exists or converting to it is reasonable.
Section 16 requires the body, on a data subject's written application specifying the claimed defect and the amendment requested, to correct personal data found to be incomplete, incorrect, misleading, excessive or irrelevant without obliterating the pre-amendment text, or to refuse with written reasons and tell the data subject of the right to complain to the Information Commissioner within twenty-eight days. The Act states no commencement date of its own.
It received the Governor-General's assent on and was published in the Official Gazette (Vol. XXXIII No. 64) on . Under section 5(1) of the Statutes Act, a statute not expressed to come into operation on a particular day comes into operation on the day it is published in the Gazette.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .