BarbadosData Protection Act, 2019, reach over scraped personal data
Data Protection Act, 2019 (Act 2019-29)
In force since .
A personal data rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- none
What it requires
- Establish a lawful basis before collecting or processing personal data scraped from a public Barbadian website; public availability is not itself an exemption.NIST AI RMFMEASURE 2.10
- Do not scrape or otherwise process a biometric identifier unless the data subject consents or a specific statutory ground applies.NIST AI RMFMEASURE 2.10
- Before moving scraped personal data outside Barbados, confirm an adequate level of protection or an appropriate safeguard.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
This row covers the lawful-basis rule for processing, the rule on sensitive and biometric data, and the transfer rule that apply to scraped personal data. Those provisions impose no duty to create, keep, produce or review a log or record. Other provisions of the Act do: the records of processing activities (the section headed Records of processing activities), the notification of a personal data breach, and the data controller's duty to demonstrate consent. They are not cited by this row, so none is borrowed here.
- Kind
- None
- As of
What this law does
The Act applies to processing personal data by a controller or processor established in Barbados, or targeting data subjects in Barbados, and carries no general exemption for personal data that is already publicly accessible; the only public-data exemption is narrow, covering information a controller is itself obliged by another enactment to publish.
A scraper collecting personal data, including a face or other biometric identifier, from a public Barbadian website remains subject to the Act's lawful-basis and purpose-limitation duties, and biometric data is sensitive personal data whose processing is prohibited unless a specific ground applies. Moving scraped personal data outside Barbados requires an adequate level of protection in the destination country or an appropriate safeguard.
When LexLint raises it
When your app profile says your app crawls the web, processes biometric data or trains models.
Back to the example · Lint your app
Page updated .