Saint LuciaData Protection Act, rights of data subjects and others
Act 11 of 2011, ss. 52-57A (rights of data subjects)
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Part 5's data-subject rights (access, rectification, objection to direct marketing, and employee protection, sections 52 to 57A) are enacted and not in force; a data controller currently has no statutory duty under this Part to answer an access, correction, or objection request.
- Once Part 5 is in force, respond to a data subject's written access request by disclosing whether you hold personal data about them, describing it, stating the purposes and source of processing, explaining the logic of any automated processing, naming the recipients, and letting them examine or obtain a copy on payment of the prescribed fee, in an alternative format if they have a sensory disability.NIST Privacy FrameworkCT.DM-P1
- Once Part 5 is in force, correct inaccurate personal data on request and stop processing a person's personal data for direct marketing on their objection.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 52 requires a controller to answer a written access request with a written response and to permit examination or supply a copy. Section 53 sets a 30-day clock, section 55(2) requires a written notice of a refusal with its reasons, section 56 requires rectification and notice to third parties, and section 57 requires erasure or a stop on direct marketing within 30 days and a written notice of the action taken. Each is a duty to answer or notify the data subject, and none requires the controller to keep a register or log of requests. The page for section 57A could not be read, so nothing is coded from it. The sections state no scope clause, so no territorial hook is coded.
- Kind
- None
- As of
What this law does
Part 5 of the Act, sections 52 to 57A, would give a data subject or relevant person acting for them a right to access personal data a data controller holds, requiring the controller on written request to disclose whether it holds personal data about the person, describe it, state the purposes and source of processing, explain any automated-processing logic involved, name the recipients, and permit examination or supply a copy on payment of the prescribed fee, in an alternative format where the person has a sensory disability.
Sections 53 to 55 would govern how a data controller complies with an access request, the discretion available to it, and the grounds on which access may be denied. Section 56 would give a right of rectification of inaccurate personal data, and section 57 would give a right to prohibit processing of personal data for direct marketing.
Section 57A, which shields an employee who reports a contravention of the Act to the Commissioner from dismissal or other detriment, is not in the 2011 Act: the 2015 Act inserted it. That Act also added a subsection to section 54, requiring a data controller who does not comply with an access request to notify the Commissioner and the person who made it.
The whole of Part 5 is enacted and not in force, so a data subject's access, rectification, direct-marketing-objection and employee-protection rights do not bind a data controller today. Section 64 reaches Part 5 even so, exempting information a data controller is obliged under another enactment to make public from Part 5 in respect of blocking personal data. No notice appointing the day these provisions come into force has been located.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .