BarbadosData Protection Act, 2019, a child's consent and sensitive personal data
Data Protection Act, 2019, ss. 8-9 (child's consent and sensitive personal data)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- Do not process sensitive personal data, including biometric data, unless the data subject consents or a specific statutory ground applies.
- Process a child's personal data only where consent is given or authorised by the child's parent or guardian, a child being a person under the age of 18.
- Make reasonable efforts to verify that the consent to process a child's personal data was given or authorised by a parent or guardian, taking available technology into account.
- Where you rely on the not-for-profit or equality-monitoring grounds in section 9, carry the processing out with appropriate safeguards for the rights and freedoms of data subjects, and do not disclose the data to a third party without the data subject's consent.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 8 makes processing a child's data lawful only with a parent's or guardian's consent and asks the controller to make reasonable efforts to verify it (section 8(2)); section 9 prohibits processing sensitive personal data unless a listed ground applies. Neither asks the controller to make, keep or produce a record. The duty to demonstrate consent is section 7(1), which this row does not cite.
- Kind
- None
- As of
What this law does
Section 8 makes the processing of a child's personal data lawful only where and to the extent that consent is given or authorised by the child's parent or guardian, and requires the data controller to make reasonable efforts to verify in such cases that the consent came from a parent or guardian, taking available technology into account; a child is a person under the age of 18.
Section 9 prohibits the processing of sensitive personal data, which the Act defines to include genetic data and biometric data alongside racial or ethnic origin, political opinions, religious beliefs, membership of a political body or trade union, sexual orientation or sexual life, financial record or position and criminal record, unless one of the grounds it lists applies: the data subject's consent; necessity for a right or obligation imposed on the controller by law in connection with employment; the vital interests of the data subject or another person where consent cannot be given or has been unreasonably withheld; processing by a not-for-profit political, philosophical, religious or trade union body confined to its members and not disclosed onward without consent; data the data subject has deliberately made public; legal proceedings, legal advice or the establishment, exercise or defence of legal rights; the administration of justice; functions of Parliament, of a public authority or conferred by an enactment; medical purposes undertaken by a health care professional or someone under an equivalent duty of confidentiality; and equality monitoring by racial or ethnic origin carried out with appropriate safeguards.
Section 9(2) lets the Minister by order specify further circumstances in which sensitive personal data may be processed. Section 100 leaves commencement to a proclamation. The Official Gazette of carries Statutory Instrument 2021 No. 24, the Proclamation re Data Protection Act, 2019, which is the day these provisions began to bind.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .