Saint Kitts and NevisData Protection Act, 2018, Information Commissioner, enforcement and offences
Data Protection Act, 2018, ss. 23-38 (Information Commissioner, enforcement and offences)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://lawcommission.gov.kn/wp-content/documents/Annual-Laws/2018/ACTs/Act-5-of-2018-Data-Protection-Act-2018.pdfAn enforcement supervision rule binding public and private bodies.
- Enforcement body
- Information Commissioner
- Obligation class
- Governance, Reporting, Prohibition
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Furnish the Information Commissioner with access to personal data, documentation of its processing, or information about its security, in writing within the time an information notice specifies.NIST Privacy FrameworkGV.PO-P5
- Comply with an enforcement notice the Information Commissioner serves within the time it states, and notify the data subject and anyone the data was disclosed to in the twelve months before the notice, within thirty days of complying, if compliance materially modifies the data.NIST Privacy FrameworkGV.PO-P5NIST Privacy FrameworkCM.AW-P5
- Do not obstruct the Information Commissioner or an authorised officer in the conduct of their duties.NIST Privacy FrameworkGV.PO-P5
- Do not dismiss, suspend, demote, discipline, harass, or otherwise disadvantage an employee for reporting or refusing to participate in a contravention of the Act in good faith.NIST Privacy FrameworkGV.MT-P5
- Do not wilfully disclose personal information in contravention of the Act, or collect, store, or dispose of personal information in a manner that contravenes the Act.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- GV.MT-P5Policies, processes, and procedures are established and in place to receive, analyze, and respond to problematic data actions disclosed to the organization from internal and external sources (e.g., internal discovery, privacy researchers, professional events).
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Unlawful processing of sensitive personal data without a permitted ground carries a fine not exceeding two hundred thousand dollars or imprisonment not exceeding two years, or both (s. 20(3)). Wilfully disclosing personal information in contravention of the Act, collecting, storing or disposing of personal information in a manner that contravenes the Act, or breaching the whistleblower confidentiality obligation, is an offence (ss. 35, 36). Obstructing the Information Commissioner or an authorised officer carries a fine not exceeding five thousand dollars or imprisonment not exceeding six months (s. 33(2)). Where a corporation commits an offence under the Act, an officer, director, or agent who directed, authorised, assented to, or participated in it is also liable (s. 37). Any other offence under the Act for which no specific penalty is provided carries, for an individual, a fine not exceeding fifty thousand dollars or imprisonment not exceeding three years on summary conviction, or a fine not exceeding one hundred thousand dollars or imprisonment not exceeding five years on conviction on indictment, and for a body corporate a fine of two hundred and fifty thousand dollars on summary conviction or five hundred thousand dollars on conviction on indictment (s. 38).
Penalty structure
Residual penalty (s. 38) for an offence with no specific penalty: individual, up to XCD 50,000 or 3 years on summary conviction, up to XCD 100,000 or 5 years on indictment; body corporate, XCD 250,000 on summary conviction or XCD 500,000 (the figure recorded here) on indictment. A separate, lower specific penalty attaches to unlawfully processing sensitive personal data (s. 20(3)): a fine not exceeding XCD 200,000 or imprisonment not exceeding 2 years, or both, and to obstruction (s. 33(2)): a fine not exceeding XCD 5,000 or imprisonment not exceeding 6 months.
- Rule
- Fixed only
- As of
- Currency
- XCD
- Fixed cap
- 500,000
What it makes you log
Who may demand the log
Regulator
Logging duty
Sections 23 to 38 set up the Information Commissioner and the enforcement scheme. Section 28 lets the Commissioner serve an information notice requiring access to personal data, information about and documentation of the processing, and security information, section 31 lets the Commissioner assess a body's processing, and section 29 allows entry and search under a magistrate's warrant. That is a power to demand documents and inspect, and none of the sections requires a person to make or keep a log or record. The report under section 31(3) is the Commissioner's report to the body, not a record the body keeps. The sections have no scope clause.
- Kind
- None
- As of
What this law does
Sections 23 and 24 make the Information Commissioner the officer appointed under section 35 of the Freedom of Information Act, and give the Information Commissioner functions including monitoring compliance, advising public and private bodies, receiving and investigating complaints, and conducting research and education.
Section 25 lets the Information Commissioner investigate, on a data subject's complaint or on the Commissioner's own initiative, whether a public body or private body has contravened the Act, and requires the Commissioner to notify the data subject of the decision and their right of appeal to the Court. Section 28 lets the Information Commissioner serve an information notice requiring a person to furnish access to personal data, documentation of its processing, or information about its security.
Section 30 lets the Information Commissioner serve an enforcement notice on a body that has contravened or is contravening a provision of the Act whose contravention is an offence, specifying the steps required and the time to take them, including rectifying or erasing personal data, and requires the body to notify the data subject and, where reasonably practicable, anyone the data was disclosed to in the twelve months before the notice, within thirty days of complying if compliance materially modifies the data.
Section 31 lets the Information Commissioner assess a body's processing on request or at the Commissioner's own discretion, and report non-compliance to the body with recommendations. Section 32 lets a data subject who suffers damage from a body's contravention of the Act bring civil proceedings in the Court, subject to a defence that the body took reasonable care to comply.
Section 33 makes it an offence, carrying a fine not exceeding five thousand dollars or imprisonment not exceeding six months, to obstruct the Information Commissioner or an authorised officer. Section 34 bars an employer from dismissing, suspending, demoting, disciplining, harassing, disadvantaging, or denying a benefit to an employee for reporting or refusing to participate in a contravention of the Act in good faith.
Section 35 makes it an offence to wilfully disclose personal information in contravention of the Act, or to collect, store, or dispose of personal information in a manner that contravenes the Act, and section 36 makes it an offence to breach the whistleblower confidentiality obligation section 34 establishes. Section 37 makes an officer, director, or agent of a corporation who directed, authorised, assented to, or participated in an offence the corporation committed a party to that offence.
Section 38 sets the residual penalty for an offence with no penalty otherwise specified at, for an individual, a fine of not more than fifty thousand dollars or imprisonment of three years on summary conviction, or one hundred thousand dollars or five years on indictment, and for a body corporate, two hundred and fifty thousand dollars on summary conviction or five hundred thousand dollars on indictment. No notice appointing the day the Act comes into force has been located.
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .