Saint Kitts and NevisData Protection Act, 2018, rights of data subjects
Data Protection Act, 2018, ss. 13-18 (rights of data subjects)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://lawcommission.gov.kn/wp-content/documents/Annual-Laws/2018/ACTs/Act-5-of-2018-Data-Protection-Act-2018.pdfA data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Access restriction
- Audit expectation
- none
What it requires
- Give a data subject access to their personal data on request and payment of the prescribed fee, describing the data, the purposes of processing, the recipients, and the source of the data.NIST Privacy FrameworkCT.DM-P1
- Give written notice of your access decision within thirty days of a data subject's request, or notify an extension of up to thirty days in the circumstances the Act lists, and tell the data subject of their right to complain to the Information Commissioner.NIST Privacy FrameworkCT.PO-P3
- Refuse an access request only where you lack information to identify the requester or locate the data, compliance would breach an exemption or a duty of confidentiality, another identifiable individual has not consented to disclosure, or the Information Commissioner has not approved the refusal in writing.NIST Privacy FrameworkCT.PO-P3
- Let a data subject examine their personal data or obtain a copy, and provide it in an alternative format where the data subject has a sensory disability and it is practicable to do so.NIST Privacy FrameworkCT.DM-P1
- Correct personal data a data subject claims in writing is incomplete, incorrect, misleading, excessive, or irrelevant once satisfied of the claim, or tell the data subject of your refusal, your reasons, and their right to complain to the Information Commissioner within twenty eight days.NIST Privacy FrameworkCT.DM-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Data lineage
Logging duty
Section 18(3) makes a public or private body that amends personal data on a data subject's application ensure, so far as practicable, that the amendment does not obliterate the text of the document as it existed before the amendment. That keeps the earlier version of the document beside the change, which leaves a trail of each alteration, and the section does not call it a log or a record. It names no period for keeping the earlier text and no one who may ask to see it. Sections 13 to 17 give access, set a 30-day answer, the grounds for denying access and the form of access, and require notices, none of which is a record duty, and section 18(2) lists what the data subject's application contains. The sections have no scope clause.
- Kind
- Implicit
- As of
- Provision
- Section 18(3) (an amendment is made so far as practicable without obliterating the text of the document as it was before)
- Trigger
- personal_data_processing
What this law does
Section 13 gives a data subject the right to be given access to their personal data held by a data user and to have it corrected where inaccurate, incomplete, misleading or out of date, except where an access or correction request is refused under the Act.
Section 14 requires a public body or private body, on a data subject's written request and payment of the prescribed fee, to confirm whether it holds their personal data and, if so, to describe the data, the purposes of processing, the recipients, and the source of the data.
Section 15 requires the body to give written notice of its access decision within thirty days of the request, extendable by up to thirty days in the listed circumstances, and gives the data subject a right to complain to the Information Commissioner about an extension.
Section 16 lets a body refuse an access request only where it lacks information to identify the requester or locate the data, where compliance would breach a Part IV exemption or a duty of confidentiality, where another identifiable individual has not consented to disclosure, or where the Information Commissioner has not approved the refusal in writing, and gives the data subject a right to complain to the Information Commissioner about a refusal.
Section 17 lets the data subject examine the personal data or obtain a copy, and requires an alternative format for a data subject with a sensory disability where practicable.
Section 18 gives a data subject the right to apply in writing for rectification of personal data they claim is incomplete, incorrect, misleading, excessive, or irrelevant, requires the body to amend the data once satisfied of the claim, and gives a right to complain to the Information Commissioner within twenty eight days of a refusal. No notice appointing the day the Act comes into force has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .