GrenadaData Protection Act, No. 1 of 2023, Information Commission, enforcement and offences
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://www.laws.gov.gd/index.php/acts/971-act-no-1-of-2023-data-protection-2023/viewdocument/971An enforcement supervision rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Cooperate with an Information Commission investigation, complaint, information notice or warrant, and furnish the access, documentation and security information it requests.NIST Privacy FrameworkGV.PO-P5
- Comply with an enforcement notice within the time it specifies, and where compliance materially modifies personal data, notify the data subject and anyone the data was disclosed to in the twelve months before the notice.NIST Privacy FrameworkGV.PO-P5NIST Privacy FrameworkCM.AW-P5
- Do not obstruct the Commission or an authorised officer in the conduct of their duties.NIST Privacy FrameworkGV.PO-P5
- Do not dismiss, suspend, demote, discipline, harass or otherwise disadvantage an employee because they reported, or refused to take part in, a contravention of the Act in good faith.NIST Privacy FrameworkGV.MT-P5
- Do not intentionally disclose personal information in contravention of the Act, and do not collect, store or dispose of personal information in a manner that contravenes the Act (s. 39).NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- GV.MT-P5Policies, processes, and procedures are established and in place to receive, analyze, and respond to problematic data actions disclosed to the organization from internal and external sources (e.g., internal discovery, privacy researchers, professional events).
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Intentionally disclosing personal information in contravention of the Act, or collecting, storing or disposing of it in a manner that contravenes the Act, is an offence (s. 39), punishable under the default penalty of s. 42(1) for an individual, or s. 42(2) for a body corporate. Obstructing the Commission or an authorised officer (s. 37) and breaching the whistleblower protection (ss. 38, 40) are separate offences. An officer, director or agent of a corporation who directed, authorised, assented to or participated in an offence is personally liable for it (s. 41).
Penalty structure
Default penalty under s. 42(1) for an individual convicted of an offence carrying no specifically stated penalty, including intentional disclosure of personal information under s. 39: a fine not exceeding fifty thousand dollars or imprisonment not exceeding three years on summary conviction, or a fine not exceeding one hundred thousand dollars or imprisonment not exceeding five years on conviction on indictment. Section 42(2) sets a separate, higher default for a body corporate: a fine not exceeding two hundred and fifty thousand dollars on summary conviction, or five hundred thousand dollars on conviction on indictment. Processing sensitive personal data in breach of s. 21 carries its own higher individual penalty under s. 21(3): a fine not exceeding two hundred thousand dollars or imprisonment not exceeding two years on conviction on indictment. Obstructing the Commission or an authorised officer under s. 37 carries a lesser summary penalty of a fine not exceeding five thousand dollars or imprisonment not exceeding six months. The Act states amounts in dollars; Grenada's currency is the Eastern Caribbean dollar (XCD).
- Rule
- Fixed only
- As of
- Currency
- XCD
- Fixed cap
- 500,000
Who enforces it
Enforcement body
Information Commission
Settledness
- As of
- Open questions
- Has the Minister appointed, by Order in the Gazette under section 1(2), the day on which sections 24 to 47 of the Data Protection Act, 2023 come into operation?
- Does a data subject's civil claim under section 36(1), which "may institute civil proceedings in the High Court", require a prior complaint to the Information Commission?
What it reaches
Obligation class
Governance, Reporting
Applicability criteria
Section 4(1) states the base test and section 4(2) applies the Act to a person who is established in Grenada, or who is not established there but uses equipment or network services in Grenada other than for transit; section 4(4) says who is treated as established in Grenada.
- As of
- Combinator
- All of
- Criteria
- a person who processes or who has control over or authorises the processing of any personal data in respect of commercial transactions in Grenada
- the person is established in Grenada, or the person is not established in Grenada, but uses equipment or network services in Grenada for processing the personal data otherwise than for the purposes of transit through Grenada
What it makes you log
Who may demand the log
Regulator
Logging duty
Sections 24 to 47 set up the Information Commission and its enforcement tools: an information notice (section 32), a warrant to enter and inspect (section 33), an enforcement notice (section 34), an assessment of processing (section 35) and offences. The information notice lets the Commission require access to personal data and documentation of the processing, but no section in the range obliges anyone to create or keep a log or register, so the duty is none and the Commission's power to demand information is the on-request check.
- Kind
- None
- As of
What this law does
Section 24 establishes the Information Commission as a body corporate of three members appointed by the Governor-General on the Prime Minister's recommendation in consultation with the Leader of the Opposition, and section 25 gives it the functions of monitoring and advising public and private bodies, receiving and investigating complaints, education, and research and reporting to the Minister.
Section 29 lets the Commission investigate, on a data subject's complaint or on its own initiative, whether a public or private body has contravened, is contravening or is likely to contravene the Act, and sections 30 to 32 govern the form of a complaint, the notice of investigation served on the Chief Executive Officer, and the information notice by which the Commission may compel a data user to furnish access to personal data and information about its processing and security.
Section 33 lets a Magistrate issue a warrant authorising an authorised officer to enter and search premises, inspect and test equipment, and seize documents where there are reasonable grounds to suspect an offence under the Act.
Section 34 lets the Commission serve an enforcement notice requiring a public or private body to rectify or erase personal data or supplement it with an approved statement, and requires the body, once it complies in a way that materially modifies the data, to notify the data subject and anyone the data was disclosed to in the twelve months before the notice.
Section 35 lets the Commission assess a body's processing for compliance, on its own initiative or on a request from a person affected by it, and report its findings and any direction to comply. Section 36 lets a data subject who suffers damage from a contravention of the Act by a public or private body bring civil proceedings in the High Court, subject to a defence that the body took all care reasonably required to comply.
Section 37 makes it an offence, punishable summarily by a fine not exceeding five thousand dollars or imprisonment not exceeding six months, to obstruct the Commission or an authorised officer, and section 38 bars an employer from retaliating against an employee who in good faith reports or refuses to take part in a contravention of the Act.
Section 39 makes it an offence to intentionally disclose personal information in contravention of the Act, or to collect, store or dispose of it in a way that contravenes the Act, section 40 makes it an offence to breach the whistleblower protection in section 38, and section 41 makes an officer, director or agent of a corporation who directed, authorised, assented to or participated in an offence a party to that offence.
Section 42 sets the default penalty for an offence with no penalty otherwise specified: for an individual, a fine not exceeding fifty thousand dollars or imprisonment not exceeding three years on summary conviction, or a fine not exceeding one hundred thousand dollars or imprisonment not exceeding five years on conviction on indictment, and for a body corporate, a fine not exceeding two hundred and fifty thousand dollars on summary conviction or five hundred thousand dollars on conviction on indictment.
Section 43 gives a right of appeal to the High Court against an enforcement or information notice, a decision on a complaint, or any decision of the Commission on the conduct of its duties, section 46 bars a Commission member or person acting for it from disclosing information obtained in the conduct of their functions except by court order, and section 47 requires the Commission to report annually to Parliament on its activities. No notice appointing the day the Act comes into force has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .