BahamasData Protection Act 2003, data subject rights
Data Protection (Privacy of Personal Information) Act Ch. 324A, Laws of The Bahamas, ss. 8-11 (access, rectification or erasure and direct marketing objection)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://laws.bahamas.gov.bs/cms/images/LEGISLATION/PRINCIPAL/2003/2003-0003/2003-0003.pdfIn force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Tell an individual who makes a written request whether the data you keep include personal data relating to them, supply a copy of the information constituting that data, and explain any terms an average person could not understand without explanation, within the period section 8(1) allows.
- Do not disclose personal data relating to another individual in answering an access request unless that individual has consented, but disclose the data with the identifying particulars omitted where that lets it be disclosed without identifying the other individual.
- If you refuse an access request, notify the individual in writing, give the reasons for the refusal and say that the individual may complain to the Data Protection Commissioner.
- Rectify or, where appropriate, erase personal data within forty days of an individual's written request where you have contravened section 6(1) in keeping it, and notify the individual within the same forty days that you have complied.
- Within forty days of a data subject's written request to stop using data kept for direct marketing, erase the data kept for that purpose or, if it is kept for other purposes too, cease using it for direct marketing, and notify the data subject in writing.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Sections 8 to 11 give an individual rights of access, rectification or erasure and objection to direct marketing, and require the controller to notify the individual of compliance or of a refusal. They state no duty to keep a log, a register or a record, no audit and no retention period, and carry no territorial hook of their own.
- Kind
- None
- As of
What this law does
Section 8 of the Act gives an individual who makes a written request to a data controller a right to be informed whether the data kept include personal data relating to the individual. The individual is also entitled to be supplied with a copy of the information constituting any such data. Where any of the information is not intelligible to the average person without explanation, it must be accompanied by an explanation of those terms.
A refusal of an access request must be notified in writing, with a statement of the reasons for the refusal and an indication that the individual may complain to the Commissioner. On a written request, an individual is entitled to have rectified or, where appropriate, erased any such data in relation to which the controller has contravened section 6(1), and the controller must comply within forty days.
Where a data subject makes a written request for the controller to cease using, for the purpose of direct marketing, any data which was kept for that purpose, the controller must within forty days erase the data kept for that purpose or, if the data are kept for that purpose and other purposes, cease using the data for that purpose, and notify the data subject in writing.
Section 9 provides that the right of access does not apply to personal data kept for preventing, detecting or investigating an offence, or for assessing or collecting tax, in any case in which applying it would be likely to prejudice those matters.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .