BahamasData Protection Act 2003, Commissioner, enforcement and penalties
Data Protection (Privacy of Personal Information) Act Ch. 324A, Laws of The Bahamas, ss. 14-16, 18-29 (the Data Protection Commissioner, enforcement notices and offences)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://laws.bahamas.gov.bs/cms/images/LEGISLATION/PRINCIPAL/2003/2003-0003/2003-0003.pdfIn force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Data Protection Commissioner
- Obligation class
- Disclosure, Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Do not disclose personal data processed on behalf of a data controller without that controller's prior authority.NIST Privacy FrameworkCT.PO-P1
- Do not obtain access to, or disclose, personal data without the authority of the data controller or data processor who holds it.NIST Privacy FrameworkCT.PO-P1
- Comply with an enforcement notice the Data Protection Commissioner serves requiring rectification, erasure or another specified step.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Unauthorised disclosure by a data processor (section 22(2)) and obtaining or disclosing personal data without authority (section 23(1)) are each an offence. Every offence under the Act, including these and failing to comply with an enforcement or information notice, is liable on summary conviction to a fine not exceeding two thousand dollars, or on conviction on information to a fine not exceeding one hundred thousand dollars (section 29(1)); no term of imprisonment is specified.
Penalty structure
Section 29(1) caps every offence under the Act at a fine not exceeding two thousand dollars on summary conviction, or one hundred thousand dollars on conviction on information; no imprisonment term is stated for any offence under this Act.
- Rule
- Fixed only
- As of
- Currency
- BSD
- Fixed cap
- 100,000
What it makes you log
Logging duty
The Commissioner may serve an information notice requiring a person to furnish information needed for the Commissioner's functions (section 18), and an authorised officer acting under a magistrate's warrant may inspect premises and data, require data and material to be produced and require information about the procedures used to comply with the Act, the sources of the data, the purposes for which it is kept and the persons to whom it is disclosed (section 19). These are powers to demand what is held, not a duty to create or keep a log or record, and no section among those cited sets a retention period. The sections state no territorial hook of their own.
- Kind
- None
- As of
What this law does
The Data Protection Commissioner, a corporation sole, investigates complaints and may serve an enforcement notice requiring a data controller or processor to rectify or erase data or otherwise comply with the Act. A data processor who discloses personal data without the controller's prior authority, and a person who obtains or discloses personal data without authority, each commit an offence.
A person guilty of any offence under the Act is liable on summary conviction to a fine not exceeding two thousand dollars, or on conviction on information to a fine not exceeding one hundred thousand dollars; the Act specifies no term of imprisonment for any offence.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .