Saint LuciaData Protection Act, sensitive personal data
Act 11 of 2011, ss. 35-38 (sensitive personal data)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent
- Audit expectation
- none
What it requires
- Do not process a special category of sensitive personal data (racial or ethnic origin, political opinion, religious belief, physical or mental health, sexual orientation, or criminal or financial record) unless a listed ground applies, the person has given explicit consent, or the person already published it themselves.NIST Privacy FrameworkCT.PO-P1
- Where you rely on the vital-interests or right-or-obligation grounds to process sensitive personal data without consent, put appropriate safeguards in place first.NIST Privacy FrameworkID.RA-P5
- Process sensitive personal data for health or medical purposes only through a health practitioner or someone bound by professional confidentiality, and only for preventive medicine, public health, medical diagnosis, medical research, or managing health and hospital care services.NIST Privacy FrameworkCT.PO-P1
- Before processing or disclosing sensitive personal data for research or statistical purposes, confirm identifiable data is genuinely necessary, commit not to use it to recruit research participants, get the responsible officer's approval of security and destruction conditions, and get the recipient's signed agreement to comply with them.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkID.DE-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P5Risk responses are identified, prioritized, and implemented.
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 35 to 38 bar processing sensitive personal data except on listed grounds, with appropriate safeguards, for health or medical purposes and for research. Section 38(1)(f) makes a signed agreement with the recipient of research data a condition of disclosure, which is a condition on the disclosure and no duty to keep a register or log. None of the four sections requires a person to make, keep or produce a log or record. The sections state no scope clause and invoke none, so no territorial hook is coded.
- Kind
- None
- As of
What this law does
Section 35 bars processing sensitive personal data (racial or ethnic origin, political opinion, religious belief, physical or mental health, sexual orientation, or criminal or financial record) except under the grounds section 34(2) and sections 36 to 38 provide, in regulations the Minister prescribes having regard to the public interest, or where the data subject has given explicit consent or has already published the data.
Section 36 lets a data controller process sensitive personal data with appropriate safeguards where necessary to exercise or perform a right or obligation the law imposes on it, to protect the vital interests of the data subject or another person where consent cannot be obtained, or to protect another person's vital interests where the data subject's consent has been unreasonably withheld.
Section 37 lets a health practitioner or another person under a professional confidentiality obligation process sensitive personal data for preventive medicine and the protection of public health, medical diagnosis, medical research, or management of health and hospital care services. The 2015 Act put medical research on that list, in place of health care or treatment.
The same Act added a subsection giving way to another enactment that specifically governs the processing of sensitive personal data for health purposes where the two are inconsistent.
Section 38 lets a data controller process or disclose sensitive personal data for research, including statistical research, only where the research purpose cannot reasonably be accomplished without individually identifiable data, the data will not be used to contact a person to participate in research, any record linkage is not harmful to the data subject, and the responsible officer has approved conditions on security and destruction of identifiers, with the recipient signing an agreement to comply with those conditions.
Section 64 additionally exempts information a data controller is obliged under another enactment to make public from sections 34, 35, 40, 41, 42, 43 and 44 and from Part 5 in respect of blocking personal data.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .