BarbadosData Protection Act, 2019, the Commissioner, enforcement and penalties
Data Protection Act, 2019, ss. 70-95 (Commissioner, enforcement, tribunal and penalties)
In force since .
An enforcement supervision rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Comply with an enforcement notice the Commissioner serves within the time it specifies, including any requirement to stop processing personal data or a description of personal data, because failing to comply with a notice is itself an offence.
- Answer an information notice or a special information notice from the Commissioner, and do not obstruct the execution of a warrant issued under the Act.
- Expect an individual who suffers damage or distress from a contravention to be able to claim compensation from you, and expect to have to prove you took all the measures reasonably required to comply in order to defend the claim.
- Expect the Commissioner to be able to order an administrative penalty of up to $50,000 after a hearing for contravening the registration-change, records, cooperation, security, breach-notification, impact-assessment, prior-consultation or data-privacy-officer duties, on top of the Act's criminal fines.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
A person who contravenes the data-processing principles in section 4 is guilty of an offence and is liable on summary conviction to a fine of $500,000 or to imprisonment for three years, or to both; the same fine and term apply to a contravention of the cross-border-transfer duties in sections 22 to 24.
Penalty structure
Fine for contravening the data-processing principles (s. 4) or the cross-border-transfer duties (ss. 22-24); the Act sets separate, lower fixed fines for narrower failures such as operating as an unregistered data controller or processor, ranging from $10,000 to $100,000, each with an alternative or concurrent prison term.
- Rule
- Fixed only
- As of
- Currency
- BBD
- Fixed cap
- 500,000
Who enforces it
Enforcement body
Data Protection Commissioner
Settledness
- As of
- Open questions
- Does "and" in section 95(1) require a person to have contravened section 52(1), section 57(1) and sections 60 to 67 together before the Commissioner may order a penalty, or is a contravention of any one of them enough?
- What makes an order "in the public interest" under section 95(1), given that section 95(2) lists factors the Commissioner must also weigh?
What it reaches
Obligation class
Governance, Reporting
Applicability criteria
- As of
- Combinator
- Any of
- Criteria
- the processing of personal data in the context of the activities of a data controller or a data processor established in Barbados
- the processing of personal data of data subjects in Barbados by a data controller or a data processor not established in Barbados, where the processing activities are related to the offering of goods or services to data subjects in Barbados
What it makes you log
Who may demand the log
Regulator
Logging duty
Sections 70 to 95 set up the Commissioner and the Tribunal, and give the Commissioner an audit function (section 71), enforcement and information notices (sections 76, 79 and 80), requests for assessment (section 78) and warrants to inspect and seize documents (section 85). They impose no duty on a controller or processor to make or keep a record. The only record named is the Commissioner's own internal record of contraventions and the measures taken (section 71).
- Kind
- None
- As of
What this law does
Sections 70 to 75 establish the Data Protection Commissioner and set the Commissioner's functions, staff, duties of confidence, indemnity and reporting.
Section 76 lets the Commissioner, on being satisfied that a data controller or data processor has contravened or is contravening the Act, serve an enforcement notice requiring steps to be taken or refrained from within a specified time, or requiring processing to stop, having considered whether the contravention has caused or is likely to cause damage or distress; sections 77 to 82 govern cancellation of a notice, requests for assessment, information notices, special information notices and the journalism restriction.
Section 83 makes failure to comply with a notice an offence, and sections 84 to 89 govern service, warrants, their execution and return, matters exempt from inspection and seizure, and obstruction. Sections 90 to 92 establish the Data Protection Tribunal and the right of appeal against the Commissioner's notices and its determination.
Section 93 entitles an individual who suffers damage or distress from any contravention of the Act to compensation from the data controller or data processor, subject to the defence of having taken all measures reasonably required to comply.
Section 94 makes it an offence to obtain, disclose or procure the disclosure of personal data knowingly or recklessly without the data controller's consent, carrying a fine of $10,000 or six months' imprisonment or both, rising to $100,000 or three years where the personal data so obtained is sold or offered for sale.
Section 95 lets the Commissioner, after a hearing and where the public interest calls for it, order a person who has contravened section 52(1), section 57(1) or sections 60 to 67 to pay the Crown a penalty of up to $50,000. Section 100 leaves commencement to a proclamation. The Official Gazette of carries Statutory Instrument 2021 No. 24, the Proclamation re Data Protection Act, 2019, which is the day these provisions began to bind.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .