BelizeData Protection Act 2021, personal data scraped from public sources
Data Protection Act, 2021 (Act No. 45 of 2021), ss. 2-10
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://www.nationalassembly.gov.bz/wp-content/uploads/2021/12/Act-No-45-of-2021-Data-Protection-Act.pdfA personal data rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Obligation class
- Consent, Biometric
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Scraping personal data of a person in Belize from a public website does not by itself place that data outside the Act's lawful-basis and purpose-limitation duties.
- A narrower exception lets sensitive personal data, including biometric data, be processed without the ordinary conditions where the data subject deliberately made the information public.
These lines are LexLint's reading of the law's text.
What it makes you log
Who may demand the log
Regulator
Logging duty
No clause names a log or a register. The duty to demonstrate compliance on the Commissioner's request cannot be met without records of how personal data was obtained, used and secured, and section 4(1)(f) requires appropriate security of processing. Section 4(1)(e) limits how long personal data is kept in identifiable form and is not a log retention rule. The Act's later Parts (including any controller register or breach record) are outside the sections this row cites and are not read into it. The Act has not been brought into force.
- Kind
- Implicit
- As of
- Provision
- Data Protection Act, 2021, s. 5(1): a data controller must comply with the s. 4 principles and, where requested by the Commissioner, demonstrate compliance with them
- Trigger
- personal_data_processing
What this law does
The Data Protection Act, 2021 defines personal data without excluding information that is otherwise publicly accessible, and applies to a data controller or processor established in Belize or offering goods or services to data subjects there, so scraping personal data from a public Belizean website would remain subject to the Act's lawful-basis, purpose-limitation, and cross-border-transfer duties once the Act is in force.
A narrower condition lets sensitive personal data, which includes biometric data, be processed where the data subject has deliberately made the information public, but this does not extend to ordinary personal data generally. No notice appointing the day the Act comes into force has been located.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .