Antigua and Barbuda

Section 5 requires a data user to obtain a data subject's consent before processing personal data other than sensitive personal data, unless the processing is necessary for a listed alternative ground such as performing a contract, complying with a legal obligation, protecting the data subject's vital interests, the administration of justice, or exercising a function conferred by law, and requires every such processing to be for a lawful purpose directly related to the data user's activity, necessary for that purpose, and adequate but not excessive.

Section 7 bars disclosing personal data for a purpose other than the one notified at collection, or a purpose directly related to it, without the data subject's consent, subject to the exceptions in section 17.

Section 17 lets a data user disclose personal data for a different purpose where the data subject consents, the disclosure prevents or detects crime or is required or authorized by law or a court order, the data user reasonably believed it had the right to disclose or would have had the data subject's consent, or the Minister determines the disclosure is justified in the public interest.

Section 8 requires a data user to take practical security steps against loss, misuse, unauthorized or accidental access, disclosure, alteration or destruction of personal data, having regard to its sensitivity, where it is stored, the security measures built into that storage, and the reliability of personnel with access, and requires the same guarantees from a data processor engaged on the data user's behalf.

Section 9 bars keeping personal data longer than necessary for the purpose it was processed for. Section 10 requires a data user to keep personal data accurate, complete, not misleading and up to date, having regard to the purpose it was collected and further processed for.

Section 19 exempts personal data processed for an individual's personal, family or household affairs entirely, and exempts data processed for crime prevention or investigation, apprehension or prosecution of offenders, or tax assessment and collection, for preparing statistics or conducting research, for a court order or judgment, or for discharging regulatory functions, from the General, Notice and Choice, Disclosure and Access Principles, and exempts data processed only for journalistic, literary or artistic purposes from those principles plus the Retention and Data Integrity Principles, where publication would be in the public interest.

Section 20 lets the Minister, on the Information Commissioner's recommendation, exempt a data user or class of data users from any or all of the Act's principles by Order published in the Gazette.

Section 6 requires a data user, on a data subject's request, to disclose the purposes for which their personal data is being or will be collected and processed, any information available about its source, the classes of third parties it may be disclosed to, whether supplying the data is obligatory or voluntary and the consequences of not supplying it, and how to contact the data user with inquiries or complaints.

Section 11 gives a data subject the right to access their personal data held by a data user and to have it corrected where it is inaccurate, incomplete, misleading or not up to date, except where access or correction is refused under this Act.

Section 12 requires a public body or private body, on a person's written request and payment of the prescribed fee, to say whether personal data of which that person is the data subject is being processed and, if so, to communicate the data itself, the purposes of processing, the classes of recipients and the source of the data.

Section 13 requires the body to give written notice within thirty days of the request whether access will be granted and, if so, to give access, subject to an extension of up to thirty further days or a longer period needed to convert the data into an alternative format.

Section 14 lets a body deny access where it lacks information to identify the requester or locate the data, where an exemption or duty of confidentiality applies, where a third party identifiable from the data withholds consent, or where the Information Commissioner approves the refusal in writing, and requires the Chief Executive Officer's refusal notice to state the specific statutory ground and the right to complain to the Information Commissioner.

Section 15 requires the body to let the data subject examine the personal data or give them a copy, in an alternative format where the data subject has a sensory disability and that format already exists or converting to it is reasonable.

Section 16 requires the body, on a data subject's written application specifying the claimed defect and the amendment requested, to correct personal data found to be incomplete, incorrect, misleading, excessive or irrelevant without obliterating the pre-amendment text, or to refuse with written reasons and tell the data subject of the right to complain to the Information Commissioner within twenty-eight days.

Section 21 assigns the Information Commissioner appointed under the Freedom of Information Act 2004 the powers, functions and duties needed to enforce this Act. Section 22 makes it an offence for a person to intentionally disclose another person's personal information in contravention of this Act, or to collect, store or dispose of personal information in a manner that contravenes it.

Section 18(3) separately makes contravening the sensitive personal data conditions in section 18(1) an offence carrying a fine of up to two hundred thousand dollars or imprisonment of up to three years, or both.

Section 23 makes a contravention of this Act for which no other penalty is specified an offence carrying, for an individual, a fine of up to fifty thousand dollars or imprisonment of up to three years on summary conviction, or a fine of up to one hundred thousand dollars or imprisonment of up to five years on conviction on indictment, and for a body corporate, a fine of up to two hundred thousand dollars on summary conviction or five hundred thousand dollars on indictment.

Section 24 gives a right of appeal to the Eastern Caribbean Supreme Court against a requirement in an enforcement notice or an information notice, against a decision of the Information Commissioner on a complaint, or against any decision of the Information Commissioner in the conduct of duties and powers under this Act.

Section 25 bars criminal or civil proceedings against the Information Commissioner, or a person acting on the Commissioner's behalf, for anything done in good faith in exercising a power, duty or function under this Act, and gives absolute privilege to words spoken and reports made in good faith in that exercise.

Section 26 bars the Information Commissioner and anyone acting on the Commissioner's behalf from disclosing information that comes to their knowledge in the conduct of their functions under this Act. Section 27 requires the Information Commissioner to include a report on data protection activities under this Act in the annual report made to Parliament under the Freedom of Information Act 2004. The Act does not arm a data subject with an independent private right of civil action.

Section 18(1) bars a data user from processing sensitive personal data, meaning information about a data subject's physical or mental health or condition, sexual orientation, political opinions, religious or similar beliefs, or the commission or alleged commission of an offence, except where the data subject has given explicit consent to the processing.

Section 18(1)(b) lists the alternative grounds on which sensitive personal data may be processed without consent, including exercising or performing an employment law right or obligation, protecting the vital interests of the data subject or another person where consent cannot be given or reasonably obtained, medical treatment by a healthcare professional or a person under an equivalent duty of confidentiality, legal proceedings or obtaining legal advice, establishing, exercising or defending legal rights, the administration of justice, or exercising a function conferred by written law.

Section 18(1)(c) also permits processing sensitive personal data that the data subject has already made public through their own deliberate action. Section 18(2) lets the Minister, by Order published in the Gazette, exclude some of those grounds in specified cases or make them subject to further conditions.

Section 3(1) prohibits a person from intentionally, without lawful excuse or justification, accessing an electronic system or network, downloading, copying or extracting data or an electronic database from it, introducing a contaminant or malicious code, damaging or disrupting the system, denying an authorised person access to it, or destroying or altering source code with intent to cause damage.

The trigger is the absence of a "lawful excuse or justification" for the access, rather than a requirement to infringe a security measure, so the provision reads on its face more broadly than a statute limited to defeating an access control; a service that publishes a page for open, unauthenticated public access would ordinarily give a visitor a lawful excuse to access and copy it.

The offence carries a fine of up to two hundred thousand dollars or imprisonment of up to three years, or both, on summary conviction, or a fine of up to five hundred thousand dollars or imprisonment of up to seven years, or both, on conviction on indictment.

Section 15(2) makes a compilation of data or other material, described in the Act as a database, eligible for protection only as a literary work, and only where the selection or arrangement of its contents is the author's own intellectual creation; that protection does not reach the underlying data itself, and the Act creates no separate sui generis database right.

Section 52 lets a person deal fairly with a literary, dramatic, musical or artistic work for the purposes of research or private study without infringing copyright, and section 53 lets a person, once a work has been lawfully disclosed, fairly deal with it for the purposes of criticism or review, or (other than a photograph) for reporting current events, without infringing copyright, so long as it is accompanied by a sufficient acknowledgement.

Section 6(9)(a) excludes an idea, concept, method of operation, process, principle, procedure, system, discovery or mere data from copyright protection even where expressed in a work, so a bare fact or item of data is never itself a protected work under Antiguan law.

Section 15(2) makes a compilation of data or other material, described in the Act as a database, eligible for protection only as a literary work, and only where the selection or arrangement of its contents is the author's own intellectual creation; that protection does not reach the underlying data itself, and the Act creates no separate sui generis database right of the kind the European Union's Database Directive provides.

Section 52 lets a person deal fairly with a literary, dramatic, musical or artistic work for the purposes of research or private study without infringing copyright, and section 53 separately lets a person, once a work has been lawfully disclosed, fairly deal with it for the purposes of criticism or review of that or another work, or (other than a photograph) for the purpose of reporting current events, without infringing copyright, so long as it is accompanied by a sufficient acknowledgement; no acknowledgement is required where current events are reported by sound recording, film, broadcast or cable programme.

Section 54 directs a court assessing fair dealing to weigh the nature of the work, the extent and substantiality of the part used relative to the whole, the purpose and character of the use, and the effect of the use on the work's potential market or commercial value.