Trinidad and TobagoData Protection Act, 2011, cross border disclosure of personal information
Act 13 of 2011, ss. 6(l), 46 and 72 (cross border disclosure)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Section 6(l)'s general principle already binds everyone who handles personal information: before disclosing personal information outside Trinidad and Tobago, make sure the disclosure is regulated and that comparable safeguards to those under this Act exist in the receiving jurisdiction.NIST Privacy FrameworkCT.PO-P2
- Once Part III is in force, before a public body discloses personal information to a party in another jurisdiction, tell the individual the purpose of the disclosure and the identity of the requester and the receiving jurisdiction's data protection body, and obtain the individual's consent.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P2
- Once Part IV is in force, follow the same disclosure, consent and Commissioner-referral process before an organisation covered by a mandatory code of conduct discloses personal information to another jurisdiction.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 46 and 72 have a public body or an organisation inform the individual of the purpose and of who asks, obtain consent before a disclosure to a party residing in another jurisdiction, and refer the question of comparable safeguards to the Commissioner where it is not satisfied. Each is a condition of the transfer and a referral, and none requires the body to make, keep or produce a record of the consent, the transfer or the referral. Principle 6(l) only says such transfers are regulated and need comparable safeguards. The destination test is not a scope clause.
- Kind
- None
- As of
What this law does
Section 6(l) of the General Privacy Principles already requires that personal information requested to be disclosed outside of Trinidad and Tobago be regulated, and that comparable safeguards to those under this Act exist in the receiving jurisdiction, binding every person who handles personal information regardless of whether Part III or Part IV has been proclaimed.
Section 46 would require a public body disclosing personal information to a party in another jurisdiction to tell the individual the purpose of the disclosure and the identity of the requester and the receiving jurisdiction's data protection body, and to obtain consent; where the individual withholds consent the public body would not disclose, and where the receiving jurisdiction's safeguards are in doubt the public body would refer the question to the Commissioner for a determination.
Section 72 would impose the equivalent duty on an organisation disclosing personal information under a mandatory code of conduct, again with a Commissioner referral where the organisation is not satisfied the receiving jurisdiction has comparable safeguards.
Section 28 already lets the Commissioner publish a list of countries the Commissioner considers to have comparable safeguards for personal information, which operationalises the section 6(l) principle even before sections 46 and 72 take effect.
Sections 46 and 72 are not shown as commenced: they sit in Part III and Part IV, which section 1(2) does not name among the provisions brought into force on , so the detailed consent-and-referral mechanism awaits proclamation while the general section 6(l) principle already binds.
When LexLint raises it
When your app profile says your app distributes a software product, ships a mobile app or processes personal data.
Back to the example · Lint your app
Page updated .