BarbadosData Protection Act, 2019, rights of a data subject
Data Protection Act, 2019, ss. 10-17, 19-21 (rights of a data subject)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- When collecting personal data, or promptly after obtaining it from another source, give the data subject the required notice, including of any automated decision-making and meaningful information about its logic.NIST Privacy FrameworkCM.AW-P1
- Honour a data subject's rights to access, rectification, erasure, restriction, portability, and objection to direct marketing.NIST Privacy FrameworkCT.PO-P3
- Notify every recipient the personal data was disclosed to of a rectification, erasure or restriction of processing you carry out.NIST Privacy FrameworkCM.AW-P5
- Stop processing personal data for the purposes of direct marketing as soon as the data subject asks you to, with no ground for refusing.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 10 to 17 and 19 to 21 give the rights of access, rectification, erasure, restriction, portability, to prevent processing and to object to direct marketing, and set the controller's information and response duties. They are duties to inform and to act on a request. Section 21 puts on the controller the burden of showing that a request is manifestly unfounded or excessive, which is an evidential point and not a record duty.
- Kind
- None
- As of
What this law does
Section 10 gives a data subject the right to be told by a data controller whether personal data about them is being processed and to obtain a copy of it, section 11 a right to rectification, section 12 a right to erasure, section 13 a right to restriction of processing and section 14 a duty on the controller to notify recipients of a rectification, erasure or restriction.
Section 15 gives a right to data portability, section 16 a right to prevent processing likely to cause damage or distress, and section 17 an unqualified right to prevent processing for the purposes of direct marketing.
Sections 19 and 20 fix the information a controller must give when it collects personal data from the data subject and when it obtains the data elsewhere, and section 21 requires that information and every communication about these rights to be transparent and to be provided in a form that lets the data subject exercise them. Section 100 leaves commencement to a proclamation.
The Official Gazette of carries Statutory Instrument 2021 No. 24, the Proclamation re Data Protection Act, 2019, which is the day these provisions began to bind.
When LexLint raises it
When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .