Trinidad and TobagoData Protection Act, 2011, sensitive personal information
Act 13 of 2011, ss. 6(h), 40 and 76 (sensitive personal information)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent
- Audit expectation
- none
What it requires
- Section 6(h)'s general principle already binds everyone who handles, stores or processes personal information: do not process sensitive personal information (racial or ethnic origin, political affiliation or trade union membership, religious belief, physical or mental health, sexual orientation, or criminal or financial record) unless a written law otherwise provides for it.
- Once Part III is in force, a public body may process sensitive personal information only with the person's consent, or where a listed exception applies, such as health care treatment by a health care professional, information the person already made public, research under section 43, law enforcement or national security, or determining access to social services.
- Once Part IV is in force, a corporation may process sensitive personal information in its possession only with the person's consent, or where a listed exception applies, such as health care treatment, information already made public, research under section 43, or where written law requires it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 40(1) bars a public body, and section 76(1) a corporation, from processing sensitive personal information without the person's consent, with the listed exceptions. Each is a condition of processing and states no duty to make, keep or produce a record of the consent or the processing. Principle 6(h) only says sensitive personal information is protected from processing except where written law provides. Section 76(4) makes a contravention an offence, which is not a record duty.
- Kind
- None
- As of
What this law does
Section 6(h) of the General Privacy Principles states that sensitive personal information is protected from processing except where otherwise provided for by written law, and this principle binds every person who handles, stores or processes personal information regardless of whether Part III or Part IV has been proclaimed.
Sensitive personal information is defined as information on a person's racial or ethnic origins, political affiliations or trade union membership, religious or similar beliefs, physical or mental health or condition, sexual orientation or sexual life, or criminal or financial record.
Section 40 would limit a public body's processing of sensitive personal information to cases where it has the person's consent, or the information is processed by a health care professional for preventive medicine, diagnosis, treatment or hospital care management, has already been made public by the person, is processed for research under section 43, serves law enforcement or national security, determines access to social services, or another written law authorises it.
Section 76 states the equivalent limitation for a corporation, in materially the same terms as section 40 except that it does not include a law-enforcement-or-national-security ground.
Neither section 40 nor section 76 is shown as commenced: both sit in Part III and Part IV, which section 1(2) does not name among the provisions brought into force on , so the detailed conditions for processing sensitive personal information await proclamation while the general prohibition in section 6(h) already binds.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .