Saint Kitts and NevisData Protection Act, 2018, processing of sensitive personal data
Data Protection Act, 2018, s. 20 (processing of sensitive personal data)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://lawcommission.gov.kn/wp-content/documents/Annual-Laws/2018/ACTs/Act-5-of-2018-Data-Protection-Act-2018.pdfA sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent
- Audit expectation
- none
What it requires
- Do not process sensitive personal data, meaning information about a data subject's physical or mental health, sexual orientation, political opinions, religious or similar beliefs, or an offence they committed or are alleged to have committed, unless a listed exception applies.
- Process sensitive personal data only with the data subject's explicit consent, for an employment right or obligation, to protect vital interests where consent cannot be given or has been unreasonably withheld, for medical purposes by a healthcare professional or an equivalent confidant, for legal proceedings, advice, or the administration of justice, or where the data subject has deliberately made the information public.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 20 bars the processing of sensitive personal data unless the data subject gave explicit consent or one of the listed grounds applies, and makes a breach an offence. Explicit consent is a condition of the processing and the section does not say it must be recorded or shown, and none of the grounds requires a log, register or record. The section has no scope clause.
- Kind
- None
- As of
What this law does
Section 2 defines sensitive personal data as information about a data subject's physical or mental health or condition, sexual orientation, political opinions, religious or similar beliefs, or the commission or alleged commission of an offence, or any other personal data the Minister determines by order published in the Gazette. Section 20(1) bars a data user from processing sensitive personal data of a data subject except in accordance with the listed conditions.
Section 20(1)(a) permits processing on the data subject's explicit consent, and section 20(1)(b) permits it where necessary for an employment right or obligation, to protect the vital interests of the data subject or another person where consent cannot be given or has been unreasonably withheld, for medical purposes undertaken by a healthcare professional or someone under an equivalent duty of confidentiality, for legal proceedings or advice, for establishing or defending legal rights, for the administration of justice, for a function conferred by law, or for any other purpose the Minister thinks fit.
Section 20(1)(c) also permits processing where the data subject has deliberately made the information public. Section 20(3) makes unlawful processing of sensitive personal data an offence carrying a fine not exceeding two hundred thousand dollars or imprisonment not exceeding two years, or both. No notice appointing the day the Act comes into force has been located.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .