Saint LuciaData Protection Act
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Consent, Disclosure, Retention, Security
- Audit expectation
- none
What it requires
- Before collecting personal data directly from a person, tell them what is being collected, why, who will receive it, whether providing it is mandatory, the consequences of not providing it, and their rights to access, correct, and have it destroyed.NIST Privacy FrameworkCM.AW-P1
- Collect personal data only for a lawful purpose connected with your function or activity, and only where the collection is necessary for that purpose.NIST Privacy FrameworkGV.PO-P1
- Obtain a person's express consent before processing their personal data, unless a specific ground applies such as performing a contract with them, complying with a legal obligation, or a legitimate interest that does not override their privacy rights, and let them object to processing done on public interest or legitimate interest grounds and revoke consent at any time.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
- Keep personal data only for the specified purpose it was collected for, do not use or disclose it in a way incompatible with that purpose, keep it adequate and relevant and not excessive, and keep it accurate and up to date.NIST Privacy FrameworkGV.PO-P1
- Take security measures appropriate to the risk of unauthorized access, alteration, or loss of personal data, taking the state of technology and the cost of the measures into account, and make sure staff know and follow them.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkGV.AT-P1
- Destroy personal data as soon as reasonably practicable once the purpose for holding it has lapsed.NIST Privacy FrameworkCT.DM-P5
- Part 4's registration scheme (sections 46 to 51) is enacted and not in force, so a data controller currently has no statutory duty under this Act to register with the Commissioner.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.AT-P1The workforce is informed and trained on its roles and responsibilities.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P5Data are destroyed according to policy.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
1 more
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
3 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
The cited sections state duties to obtain consent, to collect for a lawful purpose, to keep data accurate, to keep it only as long as the purpose needs, to secure it and to destroy it when the purpose lapses. Section 34 asks for the data subject's express consent but does not require the controller to record or be able to show it. Section 42 requires security measures without naming a log, and sections 41(d) and 43 limit how long the personal data is kept, which limits the data and not a record. None of them requires a person to make, keep or produce a log or record. Section 3(1)(a) applies the Act to a controller established in Saint Lucia whose processing is in the context of that establishment; the equipment prong in section 3(1)(b) turns on where the processing equipment is, so it is left out of the hook.
- Kind
- None
- As of
What this law does
Part 1 states the Act's preliminary provisions: section 3 applies it to a data controller established in Saint Lucia, or established elsewhere but using equipment in Saint Lucia to process data otherwise than in transit, and section 4 binds the State as well as private actors.
Section 33 bars a data controller from collecting personal data except for a lawful purpose connected with its function or activity where the collection is necessary for that purpose, and requires it to tell the data subject, at the point of collection, what is being collected, why, who will receive it, whether providing it is mandatory, the consequences of not providing it, and the subject's rights of access, correction and destruction.
Section 34 bars processing personal data without the data subject's express consent unless a listed ground applies, such as performing a contract with the subject, complying with a legal obligation, or a legitimate interest that does not override the subject's privacy rights, and lets the subject object to processing done on the public interest or legitimate interest grounds and revoke consent at any time.
Section 39 confines processing of data relating to offences, criminal convictions or security measures to the control of a public authority. Section 40 requires a data controller to keep personal data accurate and up to date. Section 41 requires personal data to be kept only for specified lawful purposes, not used or disclosed incompatibly with those purposes, kept adequate and relevant, and not retained longer than necessary.
Section 42 requires the data controller to take security measures appropriate to the risk of unauthorized access, alteration, or loss, having regard to the state of technology and the cost of the measures. Section 43 requires the data controller to destroy personal data once the purpose for holding it has lapsed. Schedule 2 restates these duties as eight Data Protection Principles.
Part 4, sections 46 to 51, would require a data controller to register with the Commissioner, maintain that registration, and hold a certificate the Commissioner issues, and it is enacted and not in force, as are Part 2 and Part 5.
Part 6 exempts a data controller from specified Principles and sections in listed cases, including national security, crime and taxation, health and social work, regulatory activities, journalism, research, information already public under another enactment, legal proceedings, legal professional privilege, domestic purposes, and Commissioner authorization, such as the section 64 exemption applying where the data controller is itself obliged under another enactment to make the information public.
The 2015 Act reworked four of these provisions: it replaced section 1(2) and added section 1(3) so the Minister may fix different dates for different Parts or sections, substituted the definition of data controller in section 2 and added a definition of privacy impact assessment, cut the penalty in section 34(5) to a fine alone by deleting the alternative of imprisonment, and replaced the domestic-purposes exemption in section 67.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .