GrenadaData Protection Act, No. 1 of 2023, application to processing of personal data
Data Protection Act, No. 1 of 2023, ss. 4, 7 (Application of Act; General Principle)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://www.laws.gov.gd/index.php/acts/971-act-no-1-of-2023-data-protection-2023/viewdocument/971A personal data rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Establish a lawful basis, ordinarily the data subject's consent, before collecting or processing personal data from Grenada, including through crawling or scraping.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Intentionally disclosing personal information in contravention of the Act, or collecting, storing or disposing of it in a manner that contravenes the Act, is an offence (s. 39), punishable under the default penalty of s. 42(1): a fine not exceeding one hundred thousand dollars or imprisonment not exceeding five years on conviction on indictment, or a lesser fine or term on summary conviction.
Penalty structure
Section 42(2)(b): a body corporate that commits an offence under the Act for which no penalty is specifically provided is liable on conviction on indictment to a fine not exceeding five hundred thousand dollars, and on summary conviction to a fine not exceeding two hundred and fifty thousand dollars. Section 42(1)(b): any person is liable on conviction on indictment to a fine not exceeding one hundred thousand dollars or to imprisonment for a term not exceeding five years or to both. The Act states these amounts in dollars without naming a currency.
- Rule
- Fixed only
- As of
- Currency
- XCD
- Fixed cap
- 500,000
Who enforces it
Enforcement body
The Information Commission, which monitors compliance by public bodies and private bodies with the Act, including issuing notices (s. 25(1)(a)).
Settledness
Section 1(2) provides that the Act comes into operation on a day to be appointed by the Minister by Order in the Gazette.
- As of
- Open questions
- Does section 7(1)(a) require the data subject's consent to collect personal data that the data subject has published openly, given that section 21(1)(c) lifts the bar only for sensitive personal data 'made public as a result of steps taken by the data subject' and no ground listed in section 7(2) does so for other personal data?
- Does 'in respect of commercial transactions in Grenada' in section 4(1) reach a scraper outside Grenada that collects personal data about people in Grenada, when section 4(2)(b) reaches a person not established in Grenada only if it 'uses equipment or network services in Grenada'?
What it reaches
How the hook was established
express
What makes it apply
Operator establishment
Obligation class
Consent
Applicability criteria
- As of
- Combinator
- All of
- Criteria
- is established in Grenada, or is not established in Grenada but uses equipment or network services in Grenada for processing the personal data otherwise than for the purposes of transit through Grenada
What it makes you log
Logging duty
Section 7 is the general principle: a data user shall not process personal data without the data subject's consent, with the exceptions in subsection (2), and section 4 sets the Act's reach. Neither section states a duty to make, keep, produce or review a log or record of consent or of processing. Sections 11 (Retention Principle) and 14 (procedures for compliance, with a periodic self-assessment) lie outside the sections this row cites and are not read into it. Section 4(2) applies the Act to a person established in Grenada, and also to a person not established there who uses equipment or network services in Grenada; the equipment limb turns on where equipment sits and has no hook value.
- Kind
- None
- As of
What this law does
The Data Protection Act, No. 1 of 2023 applies to a person who processes, controls or authorises the processing of any personal data in respect of commercial transactions in Grenada, including a person established outside Grenada who uses equipment or network services in Grenada for that processing.
The definition of personal data and the general processing grounds carry no publicly-available carve-out for personal data generally; the only publicly-made ground is scoped to sensitive personal data specifically, where section 21(1)(c) permits processing sensitive personal data that has been made public as a result of steps taken by the data subject.
So the general principle in section 7, which bars processing personal data without the data subject's consent unless another listed ground applies, reaches a scraper collecting ordinary personal data from Grenada, including for training a model. Section 1(2) provides that the Act comes into operation on a day to be appointed by the Minister by Order in the Gazette, and that the Minister may appoint different dates for different provisions.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .