Trinidad and TobagoData Protection Act, 2011, Commissioner, contravention and enforcement
Act 13 of 2011, ss. 7-28 and 87-96 (Commissioner, contravention and enforcement)
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Office of the Information Commissioner
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- The Office of the Information Commissioner is established and operating, with powers to audit and investigate compliance, order a body to stop a contravening practice, authorise data matching, and publish compliance guidelines; the Commissioner's power to audit or enquire specifically under Part III or Part IV (sections 20 and 21) is outside the provisions that section 1(2) brought into operation on .
- The Commissioner and anyone acting under the Commissioner's direction must not disclose information obtained in performing their duties under the Act.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Part V, sections 87 to 96, which would make it an offence to contravene the General Privacy Principles, obstruct the Commissioner, breach a mandatory code of conduct, or breach the Commissioner's own confidentiality obligation under section 25, has not been proclaimed: section 1(2) names only Part I and specified sections of Part II as in force. No criminal exposure currently exists under the Act. Once proclaimed, section 95 would fine an individual up to $50,000 or three years' imprisonment on summary conviction, or up to $100,000 or five years on indictment, and section 95(2) would fine a body corporate $250,000 on summary conviction or $500,000 on indictment, with section 96 letting the Court separately impose a fine of up to ten percent of the corporation's annual turnover.
Penalty structure
Individual offender: summary conviction fine of up to $50,000 or imprisonment for three years; conviction on indictment, fine of up to $100,000 or imprisonment for five years (s. 95(1)). A body corporate is liable to a fine of $250,000 on summary conviction or $500,000 on indictment (s. 95(2)), and the Court may separately impose a fine of up to ten percent of the corporation's annual turnover for a contravention (s. 96(1)). Part V, which states these offences, is enacted but has not been proclaimed and is not in force; the figures above are the enacted, not-yet-commenced penalty.
- Rule
- Fixed only
- As of
- Currency
- TTD
- Fixed cap
- 100,000
What it makes you log
Who may demand the log
Regulator
Logging duty
These sections set up the Office of the Information Commissioner, give its inspectors power to require production of registers, records and other documents, and make obstruction, a false statement, a failure to comply with an order and other contraventions offences. They impose no duty on a public body or organisation to make or keep a log or record. The power to require production of a record, exercised when the Commissioner chooses, is coded as an on-request check by the regulator. Sections 20 and 21 limit the audit of a private organisation to one subject to an enforceable code of conduct and to a Court order. Section 27 is a report on the Office's own activities, not an audit report.
- Kind
- None
- As of
What this law does
Sections 7 to 18 establish the Office of the Information Commissioner as a body corporate, provide for the appointment, tenure, removal, remuneration and oath of the Commissioner and up to two Deputy Commissioners, and give the Commissioner powers to audit and investigate compliance, order a public body or organisation to cease a contravening practice, authorise data matching, make orders on fee reasonableness and compliance with the General Privacy Principles, and publish compliance guidelines.
Section 10 gives the Commissioner functions including promoting codes of conduct, disseminating information about the Act, monitoring compliance, cooperating with counterparts in other jurisdictions, researching privacy issues, flagging a body's failure to meet the Principles or Part III or Part IV, publishing compliance reports, and reviewing privacy impact assessments.
Section 25(1) bars the Commissioner and anyone acting under the Commissioner's direction from disclosing information obtained in performing their duties, and section 28 requires the Commissioner to publish a list of countries with comparable safeguards for personal information.
All of these provisions, together with the rest of Part I, came into force on , so Trinidad and Tobago currently has an operating Information Commissioner with these powers and functions, even though the Parts the Commissioner would chiefly enforce, Part III and Part IV, are not yet proclaimed.
Not commenced within Part II are the designation of inspectors (section 19), the Commissioner's power to audit or enquire pursuant to Part III (section 20) or Part IV (section 21), privileged information (section 24), the exceptions to the Commissioner's confidentiality obligation (section 25(2) and (3)), and the Commissioner's annual report to Parliament (section 27).
Part V, sections 87 to 96, would make it an offence to obstruct the Commissioner, make a false statement, fail to comply with a Commissioner order, violate the whistle-blowing protection, breach a mandatory code of conduct, wilfully disclose or unlawfully collect personal information in contravention of the Act, or breach the Commissioner's own confidentiality obligation under section 25, and would penalise an individual offender with a fine of up to $100,000 or five years' imprisonment on indictment and a body corporate with a fine of up to $500,000 on indictment or up to ten percent of annual turnover.
Part V is not shown as commenced: section 1(2) does not name it among the provisions brought into force on , so none of the Act's offences or penalties currently apply, and a contravention of the General Privacy Principles, including the confidentiality obligation in section 25(1) that already binds the Commissioner's own office, cannot presently be prosecuted under this Act.
Section 86, in Part IV, would require every director and officer of a corporation to take reasonable care to ensure that the corporation complies with the Act, the Regulations and any Order of the Commissioner. Section 86 is not among the provisions that section 1(2) names as having come into operation on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .