SurinameDraft Law on the Protection of Privacy and Personal Data, Commissioner, remedies and fines
Arts. 23-42 Wet Bescherming Privacy en Persoonsgegevens
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Cooperate with the Commissioner for Personal Data Protection, an independent authority the bill would establish, including by giving access to the records, information, and premises the Commissioner needs to investigate a complaint.NIST Privacy FrameworkGV.PO-P5
- Let a data subject or their representative lodge a complaint with the Commissioner about your processing, and give reasonable assistance to a person who wants to put a complaint in writing.NIST Privacy FrameworkGV.MT-P7
- Pay compensation to a person who suffers material or non-material damage because you processed their personal data in violation of this law, unless you show you were not in any way responsible for the event that caused the damage.
- Do not dismiss, suspend, demote, discipline, fine, intimidate, or otherwise disadvantage an employee for reporting in good faith that you have or will violate this law.NIST Privacy FrameworkGV.MT-P5
- Comply with the chapter V obligations on controllers and processors, with the principles, data subject rights and cross border transfer chapters, and with every decision, order or notice of the Commissioner.NIST Privacy FrameworkGV.PO-P5
- Let a data subject authorise a nonprofit organisation active in privacy protection to lodge a complaint or exercise their judicial and compensation rights on their behalf.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- GV.MT-P5Policies, processes, and procedures are established and in place to receive, analyze, and respond to problematic data actions disclosed to the organization from internal and external sources (e.g., internal discovery, privacy researchers, professional events).
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
This is the higher of the bill's two fine tiers (art. 35(6)(b)): SRD 10,000 or 4 percent of worldwide annual turnover, whichever is higher, for a violation of the principles, rights, or cross border transfer chapters, or non-compliance with a Commissioner order. A lower tier applies to a chapter V (controller and processor obligations) violation: SRD 5,000 or 2 percent of worldwide annual turnover, whichever is higher (art. 35(6)(a)). Both are administrative fines; the bill sets no criminal penalty.
- Rule
- Higher of
- As of
- Currency
- SRD
- Fixed cap
- 10,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Proposed: Commissioner for Personal Data Protection (Commissaris voor persoonsgegevensbescherming), an independent authority the bill would create
Settledness
- As of
- Open questions
- Do the remedies that article 34(2) of the draft law points to as 'de artikelen 36 en 37' mean articles 38 and 39 (judicial remedies before the kantonrechter), given that articles 36 and 37 concern notice of a proposed fine and the factors for setting it?
What it makes you log
Who may demand the log
Regulator
Logging duty
Articles 23 to 42 set up the Commissioner for Personal Data Protection and its powers, the complaint route, liability and the administrative fines. Article 32(1)(a) lets the Commissioner order a controller or processor to provide the information the Commissioner needs for its tasks, and article 32(1)(d) gives it access to all personal data and information needed for them. That is a power to demand what exists; no article in the range requires anyone to make or keep a log or record, so the duty is none and the expectation on request. The register of processing activities is article 18 and the breach record article 20(4), both on their own rows. The text is a draft bill.
- Kind
- None
- As of
What this law does
Article 23 establishes an independent Commissioner for Personal Data Protection (Commissaris voor Persoonsgegevensbescherming), responsible for supervising and enforcing this law, accountable to De Nationale Assemblee.
Article 33 gives every data subject or their legal representative the right to lodge a complaint with the Commissioner, and articles 34 and 37 set the complaint procedure, including a decision within three months, extendable by three months for complex cases, and the factors the Commissioner weighs before imposing a fine.
Article 35 lets the Commissioner fine a controller or processor for a violation: up to SRD 5,000 or 2 percent of worldwide annual turnover, whichever is higher, for violating the chapter V obligations on controllers and processors, and up to SRD 10,000 or 4 percent of worldwide annual turnover, whichever is higher, for violating the principles, rights, or cross border transfer chapters, or for failing to comply with a Commissioner decision, order, or notice or to grant access needed for a complaint investigation.
Articles 38 and 39 give a person effective judicial remedies against the Commissioner and against a controller or processor respectively, before the kantonrechter, and article 40 gives every person who suffers material or non-material damage from a violation of this law the right to compensation from the controller or processor responsible, with joint and several liability where more than one is involved.
Article 41 bars an employer from dismissing, suspending, demoting, disciplining, fining, intimidating or otherwise disadvantaging an employee for reporting in good faith that the employer or another person has violated or will violate this law. Article 42 lets a data subject authorise a nonprofit organisation active in privacy protection to lodge a complaint or exercise their judicial and compensation rights on their behalf.
The bill contains no criminal penalty for a violation; its sanctions are the administrative fine, the compensation claim, and the Commissioner's other decisions and orders. The bill remains under consideration before De Nationale Assemblee, with no enactment timeline.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .