Saint LuciaData Protection Act, Commissioner, offences and penalties
Act 11 of 2011, ss. 5-31 and 69-74 (Commissioner, offences and penalties)
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- The Data Protection Commissioner has not been appointed and Part 2's investigation, information-notice and enforcement-notice powers are not in force, so no data controller currently answers to an operating supervisory authority under this Act.
- Part 7's general offence and penalty provision, section 71, is enacted and not in force, so a contravention of a provision that states no penalty of its own currently carries none under this Act.
- The one enforceable penalty is the fine under section 34(5): a data controller who processes personal data without the required consent is liable on summary conviction to a fine not exceeding $25,000, the 2015 Act having removed the alternative of imprisonment.
- Section 44's unlawful-disclosure offence and section 45's transfer restriction are both enacted and, like the rest of the Act outside sections 32 to 43, not in force.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Contravening the consent requirement in section 34 is the only offence under the Act now in force, carrying a fine of up to $25,000 on summary conviction (s. 34(5), as amended by the 2015 Act, which deleted the alternative of imprisonment). The general offence and penalty provision (s. 71, Part 7), which would fine a contravention of any other provision up to $10,000 for an individual or $100,000 for a body corporate where no specific penalty is stated, is enacted and not in force.
Penalty structure
Fine under section 34(5) for processing personal data without the required consent, as amended by the 2015 Act, which deleted the alternative of imprisonment; this is the only penalty in force under the Act. Section 71's general penalty (up to $10,000 for an individual or $100,000 for a body corporate) is enacted and not in force.
- Rule
- Fixed only
- As of
- Currency
- XCD
- Fixed cap
- 25,000
What it makes you log
Who may demand the log
Regulator
Logging duty
Sections 5 to 31 set up the Commissioner and its powers and sections 69 to 74 give an appeal and set the general offence and penalty. Section 14(1) lets the Commissioner serve a written notice asking any person for access to personal data and for information about and documentation of the processing, and sections 9(a) and (b) have the Commissioner keep a register of data controllers and a public register of processing operations. Those are the regulator's own registers and a power to demand what exists, and nothing in the cited sections requires a controller to make, keep or produce a log or record, so the duty is none and the Commissioner's information power is the on-request check. The sections state no scope clause of their own, so no territorial hook is coded.
- Kind
- None
- As of
What this law does
Part 2, sections 5 to 31, would establish a Data Protection Commissioner with functions including maintaining a register of data controllers and of processing operations, verifying compliance on the Commissioner's own motion or a data subject's request, investigating complaints, issuing information notices and enforcement notices, and referring matters to the Director of Public Prosecutions.
Part 7, sections 69 to 74, would give a right of appeal to the Court, and section 71 would make contravening the Act an offence carrying, where no specific penalty is provided, a fine of up to $10,000 for an individual or $100,000 for a body corporate. Both Parts are enacted and not in force, so Saint Lucia has no operating Data Protection Commissioner and the Act's general offence and penalty provision does not bind.
The one penalty in force sits inside the commenced consent duty rather than in Part 7: section 34(5) makes a data controller who contravenes the consent requirement in section 34 liable, on summary conviction, to a fine not exceeding $25,000. The 2015 Act deleted the alternative of imprisonment from that penalty and from the general penalty in section 71(2)(a), leaving both as fines alone.
The same Act inserted section 12A, which lets the Commissioner require a department of government to prepare a privacy impact assessment and submit it for approval. Section 44, titled Unlawful disclosure of personal data, sits in Part 3 alongside the data-controller obligations but is, like section 45, enacted and not in force. No notice appointing the day these provisions come into force has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .