Grenada

The Data Protection Act, No. 1 of 2023 applies to a person who processes, controls or authorises the processing of personal data in respect of commercial transactions in Grenada, reaching a person established in Grenada and, under section 4(2)(b), a person established elsewhere who uses equipment or network services in Grenada for processing personal data.

Section 7 bars a data user from processing personal data about a data subject without the data subject's consent, subject to the alternative grounds in section 7(2) such as contractual necessity, a legal obligation, protecting the data subject's interests, the administration of justice or the exercise of a statutory or government function, and section 7(3) requires the processing to be for a lawful purpose directly related to the data user's activity and adequate but not excessive for that purpose.

Section 9 bars a data user from disclosing personal data, without the data subject's consent, for a new purpose or to a new class of recipient, and section 20 lets a data user disclose personal data for another purpose only where the data subject consents, the disclosure is necessary to prevent or detect crime or for investigations, the disclosure is required or authorised by an enactment or court order, or the Minister deems the disclosure justified as being in the public interest.

Section 10 requires a data user to take practical steps to protect personal data against loss, misuse, unauthorised access, alteration or destruction, including obtaining a data processor's guarantees of its own technical and organisational security measures, and section 11 bars retention of personal data longer than necessary for the purpose it was processed for.

Section 12 requires a data user to take reasonable steps to keep personal data accurate, complete, not misleading and up to date, and section 14 requires every data user to establish formal procedures implementing these principles and to review them at least once every five years.

Sections 22 and 23 exempt personal data processed for an individual's own personal, family, household or recreational purposes, and let the Minister exempt further data users or provisions by Order published in the Gazette, alongside the Act's own exemptions for crime prevention and investigation, health information whose disclosure would cause serious harm, anonymised statistics and research, court orders, regulatory functions, and journalistic, literary or artistic purposes meeting a public interest test.

Section 1(2) delays the Act's commencement to a day the Minister appoints by Order in the Gazette, and no commencement Order has been located.

Section 8 requires a data user, on request by a data subject, to tell the data subject the purposes and source of collecting and further processing their personal data, their right to request access and rectification, the classes of third party the data may be disclosed to, whether supplying the data is obligatory, and the consequences of not supplying it.

Section 13 gives a data subject the right to access personal data a data user holds about them and to have it rectified where it is inaccurate, incomplete, misleading or not up to date, except where access or rectification is refused under the Act.

Section 15 lets a person, on a written request and payment of a processing fee, require a public or private body to confirm whether it processes their personal data and, if so, to describe the data, the purposes of processing, the recipients or classes of recipient, and the source of the data.

Section 16 requires the body to give written notice within thirty days of whether access will be given and, if so, to give access within sixty days, subject to an extension of up to thirty more days in the circumstances section 16(2) lists.

Section 17 lets a data user refuse access where it cannot verify the requester's identity or locate the data, where an exemption under Part IV or a duty of confidentiality applies, where a third party identifiable from the data withholds consent to its disclosure, or where the Commission approves the refusal in writing, and requires the refusal notice to state the ground and the right to complain to the Commission.

Section 18 requires the body to let the data subject examine the data or give them a copy, in an alternative format where the data subject has a sensory disability and an alternative format already exists or conversion is reasonable.

Section 19 lets a data subject apply to have personal data amended where it is incomplete, incorrect, misleading, excessive or irrelevant to the purpose it is held for, and lets a data subject aggrieved by a refusal complain to the Commission within fifteen calendar days, though the section does not apply to records kept under the listed civil-registration and citizenship enactments. No notice appointing the day the Act comes into force has been located.

Section 24 establishes the Information Commission as a body corporate of three members appointed by the Governor-General on the Prime Minister's recommendation in consultation with the Leader of the Opposition, and section 25 gives it the functions of monitoring and advising public and private bodies, receiving and investigating complaints, education, and research and reporting to the Minister.

Section 29 lets the Commission investigate, on a data subject's complaint or on its own initiative, whether a public or private body has contravened, is contravening or is likely to contravene the Act, and sections 30 to 32 govern the form of a complaint, the notice of investigation served on the Chief Executive Officer, and the information notice by which the Commission may compel a data user to furnish access to personal data and information about its processing and security.

Section 33 lets a Magistrate issue a warrant authorising an authorised officer to enter and search premises, inspect and test equipment, and seize documents where there are reasonable grounds to suspect an offence under the Act.

Section 34 lets the Commission serve an enforcement notice requiring a public or private body to rectify or erase personal data or supplement it with an approved statement, and requires the body, once it complies in a way that materially modifies the data, to notify the data subject and anyone the data was disclosed to in the twelve months before the notice.

Section 35 lets the Commission assess a body's processing for compliance, on its own initiative or on a request from a person affected by it, and report its findings and any direction to comply. Section 36 lets a data subject who suffers damage from a contravention of the Act by a public or private body bring civil proceedings in the High Court, subject to a defence that the body took all care reasonably required to comply.

Section 37 makes it an offence, punishable summarily by a fine not exceeding five thousand dollars or imprisonment not exceeding six months, to obstruct the Commission or an authorised officer, and section 38 bars an employer from retaliating against an employee who in good faith reports or refuses to take part in a contravention of the Act.

Section 39 makes it an offence to intentionally disclose personal information in contravention of the Act, or to collect, store or dispose of it in a way that contravenes the Act, section 40 makes it an offence to breach the whistleblower protection in section 38, and section 41 makes an officer, director or agent of a corporation who directed, authorised, assented to or participated in an offence a party to that offence.

Section 42 sets the default penalty for an offence with no penalty otherwise specified: for an individual, a fine not exceeding fifty thousand dollars or imprisonment not exceeding three years on summary conviction, or a fine not exceeding one hundred thousand dollars or imprisonment not exceeding five years on conviction on indictment, and for a body corporate, a fine not exceeding two hundred and fifty thousand dollars on summary conviction or five hundred thousand dollars on conviction on indictment.

Section 43 gives a right of appeal to the High Court against an enforcement or information notice, a decision on a complaint, or any decision of the Commission on the conduct of its duties, section 46 bars a Commission member or person acting for it from disclosing information obtained in the conduct of their functions except by court order, and section 47 requires the Commission to report annually to Parliament on its activities. No notice appointing the day the Act comes into force has been located.

Section 21 bars a data user from processing sensitive personal data, defined in section 2 to include an individual's physical or mental health or condition, racial or ethnic origin, genetic data, biometric data that uniquely identifies an individual, sex life, political opinions, religious or philosophical beliefs, and the commission or alleged commission of an offence, except on the conditions section 21(1) lists.

The data subject's written consent to the processing of the sensitive personal data is the first of those conditions, and the others include processing necessary to an employment right or obligation, protecting the data subject's or another person's interests where consent cannot reasonably be obtained or has been unreasonably withheld, medical purposes undertaken by a healthcare professional or someone under an equivalent duty of confidentiality, legal proceedings or advice, the administration of justice, a statutory or government function, another purpose the Minister thinks fit, or information the data subject has made public.

A person who contravenes section 21(1) commits an offence and is liable, on conviction on indictment, to a fine not exceeding two hundred thousand dollars or imprisonment for a term not exceeding two years, or both. No notice appointing the day the Act comes into force has been located.

Section 5(1) prohibits a person from, knowingly or without lawful excuse or justification, or without the permission of the owner or any other person in charge of an electronic system or network, gaining access to it, or downloading, copying or extracting data, an electronic database or information from it, including information or data held or stored in a removable storage medium.

Unlike a computer-misuse offence conditioned on defeating a technical security measure, section 5's chapeau names the absence of permission from the owner or person in charge of the system as one of its alternative conditions, a standard that on its face can reach a scraper that accesses or extracts data from a public, unauthenticated page without the site operator's permission; no reported Grenadian case has tested the provision against that fact pattern.

The offence carries a fine of up to two hundred thousand dollars or imprisonment of up to three years, or both, on summary conviction. Act 23 of 2013 came into force on 18 November 2016. Council of Europe reporting records an amendment by Act 10 of 2014 that repealed three unrelated sections, 6, 16 and 25.

Section 10 permits, without the copyright owner's authorisation, the reproduction of a short part of a published work as a quotation, provided the reproduction is compatible with fair dealing, does not exceed the extent justified by the purpose, and is accompanied by an indication of the source and the author's name.

Section 13 permits a narrower exception for temporary reproduction made in the process of transmitting a work or making a stored work perceptible, where the person doing so is entitled to do the act by authorisation of the copyright owner or by operation of law, so it does not itself authorise unauthorised bulk collection.

The Act has no express text-and-data-mining exception, so large-scale reproduction of copyright-protected Grenadian works for model training rests only on the fair-dealing quotation ground, whose short-extract and source-attribution conditions are a poor fit for that use.

Section 6(1)(b) protects a collection of data (a database) as a derivative work only where the collection is original by reason of the selection, co-ordination or arrangement of its contents, a compilation-copyright standard rather than a sui generis database right of the kind some other jurisdictions confer.

Criminal liability for infringement (s. 43) attaches only where the infringement is for profit-making purposes and the infringer knew or had reason to believe it was an infringement, punishable on summary conviction by a fine not exceeding fifty thousand dollars and imprisonment not exceeding five years. The Act came into force on 26 April 2012 under the Copyright Act (Commencement) Order, 2012, made under section 61 of the Act.

The Data Protection Act, No. 1 of 2023 applies to a person who processes, controls or authorises the processing of any personal data in respect of commercial transactions in Grenada, including a person established outside Grenada who uses equipment or network services in Grenada for that processing.

The definition of personal data and the general processing grounds carry no publicly-available carve-out for personal data generally; the only publicly-made ground is scoped to sensitive personal data specifically, where section 21(1)(c) permits processing sensitive personal data that has been made public as a result of steps taken by the data subject.

So the general principle in section 7, which bars processing personal data without the data subject's consent unless another listed ground applies, reaches a scraper collecting ordinary personal data from Grenada, including for training a model. Section 1(2) provides that the Act comes into operation on a day to be appointed by the Minister by Order in the Gazette, and that the Minister may appoint different dates for different provisions.

Banking Prudential Standard No. 3 of 2022, the Prudential Standard for Electronic Banking, is issued by the Eastern Caribbean Central Bank in exercise of the powers conferred by section 184 of the Banking Act. Banking Prudential Standard No. 3 of 2022 came into effect on 1 February 2023. Banking Prudential Standard No. 3 of 2022 applies to all institutions licensed under the Banking Act.

Paragraph 5.2.1 of the ECCB Electronic Banking Standard says that a licensed financial institution must ensure that the necessary security control infrastructure is in place to secure e-banking systems and data from both internal and external threats. Paragraph 5.2.2 of the ECCB Electronic Banking Standard says that an institution must ensure that a comprehensive security process is implemented, with policies and procedures that address internal and external security threats.

Paragraph 5.2.4 of the ECCB Electronic Banking Standard says that an institution must reinforce information security controls to preserve the confidentiality and integrity of customer data. Paragraph 5.2.8 of the ECCB Electronic Banking Standard says that appropriate systems must be employed to reduce external threats to e-banking systems, including penetration testing of internal and external networks.

Paragraph 6.4 of the ECCB Electronic Banking Standard says that the security process an institution has implemented shall be submitted to the Central Bank. Institutions found in violation of the ECCB Electronic Banking Standard are subject to the remedial actions specified in section 75 of the Banking Act.

Section 80 of the Banking Act, No. 20 of 2015 makes it an offence for a licensed financial institution to fail to comply with a requirement or prohibition imposed on it under the Part of the Act that contains section 80.

Under section 80 of the Banking Act, No. 20 of 2015, a licensed financial institution convicted of the offence of failing to comply with a requirement imposed under the Part of the Act that contains section 80 is liable to a fine of one hundred thousand dollars, with a further penalty for each day a continuing offence continues after conviction.

The Prudential Standard on Technology Risk Management for Institutions Licensed Under the Banking Act, 2015 is issued by the Eastern Caribbean Central Bank in exercise of the powers conferred by section 184 of the Banking Act. The ECCB Technology Risk Management Standard came into effect on 3 January 2023.

The ECCB Technology Risk Management Standard says it should be applied by all regulated licensed financial institutions unless information technology is not a significant function or alternative measures of equal effect have been taken. The ECCB Technology Risk Management Standard requires any deviation from it to be explained in a separate document that is made promptly available to the ECCB on request.

Under the ECCB Technology Risk Management Standard, the roles and responsibilities of the board of directors shall include ensuring the development of a robust cyber-risk management framework. Under the ECCB Technology Risk Management Standard, the roles and responsibilities of senior management shall include developing and implementing a cybersecurity incident response plan.

The ECCB Technology Risk Management Standard requires licensed financial institutions to establish an Information Security User Group. Section 75 of the Banking Act, No. 20 of 2015 lets the Central Bank take remedial action against a licensed financial institution that violates a prudential standard issued by the Central Bank.

Section 80 of the Banking Act, No. 20 of 2015 makes it an offence for a licensed financial institution to fail to comply with a requirement or prohibition imposed on it under the Part of the Act that contains section 80.

Under section 80 of the Banking Act, No. 20 of 2015, a licensed financial institution convicted of the offence of failing to comply with a requirement imposed under the Part of the Act that contains section 80 is liable to a fine of one hundred thousand dollars, with a further penalty for each day a continuing offence continues after conviction.

Section 11(6)(b) of the Virtual Asset Business Act, 2021 requires a registrant to implement and maintain policies for the virtual asset business to protect the operations of the registrant and personal information collected and stored by the registrant from cyber threats. An applicant for registration must include with its application written policies, rules and procedures covering, among other subjects, security access control and cyber security safeguards.

Section 19(1)(d) of the Act makes it an offence to contravene a provision of the Act for which a penalty is not provided. A person who commits an offence under the Act is liable on summary conviction to a fine of $10,000 and imprisonment of 2 years.

Banking Prudential Standard No. 3 of 2022, the Prudential Standard for Electronic Banking, is issued by the Eastern Caribbean Central Bank in exercise of the powers conferred by section 184 of the Banking Act. Banking Prudential Standard No. 3 of 2022 came into effect on 1 February 2023. Banking Prudential Standard No. 3 of 2022 applies to all institutions licensed under the Banking Act.

Paragraph 6.4 of the ECCB Electronic Banking Standard says that all incident reports and response shall be sent to the Central Bank within 3 days of the occurrence. Paragraph 6.4 of the ECCB Electronic Banking Standard adds that any further update on the incident shall also be reported to the Central Bank.

Paragraph 5.2.7 of the ECCB Electronic Banking Standard says that an institution must implement formal incident response and management procedures for timely reporting and handling of suspected or actual security breaches, fraud, or service interruptions of its e-banking services. Paragraph 5.2.7 of the ECCB Electronic Banking Standard also says that significant incidents should be reported to the Central Bank.

Paragraph 5.11.2 of the ECCB Electronic Banking Standard says that an institution must develop a clear process for alerting the appropriate regulatory authorities in the event of security breaches or disruptive incidents. Institutions found in violation of the ECCB Electronic Banking Standard are subject to the remedial actions specified in section 75 of the Banking Act.

Section 80 of the Banking Act, No. 20 of 2015 makes it an offence for a licensed financial institution to fail to comply with a requirement or prohibition imposed on it under the Part of the Act that contains section 80.

Under section 80 of the Banking Act, No. 20 of 2015, a licensed financial institution convicted of the offence of failing to comply with a requirement imposed under the Part of the Act that contains section 80 is liable to a fine of one hundred thousand dollars, with a further penalty for each day a continuing offence continues after conviction.

The Prudential Standard on Technology Risk Management for Institutions Licensed Under the Banking Act, 2015 is issued by the Eastern Caribbean Central Bank in exercise of the powers conferred by section 184 of the Banking Act. The ECCB Technology Risk Management Standard came into effect on 3 January 2023.

Paragraph 12.8.1 of the ECCB Technology Risk Management Standard says that within 24 hours of becoming aware of a cyber-incident a licensed financial institution shall alert the ECCB and its Information Security User Group. Paragraph 12.8.1 of the ECCB Technology Risk Management Standard also says that the compromised institution should complete the incident report in Appendix I and submit it to the ECCB within 48 hours of the incident.

Paragraph 12.8.4 of the ECCB Technology Risk Management Standard says that an institution shall provide an update on the incident to the ECCB at a frequency determined by the ECCB. Paragraph 12.8.5 of the ECCB Technology Risk Management Standard says that after the cyber-incident is resolved an institution shall conduct a post-incident review and submit it to the ECCB.

Under the ECCB Technology Risk Management Standard, the roles and responsibilities of senior management shall include notifying directly, within seventy-two hours of the discovery of the incident, the customers whose accounts were potentially or actually compromised. Section 75 of the Banking Act, No. 20 of 2015 lets the Central Bank take remedial action against a licensed financial institution that violates a prudential standard issued by the Central Bank.

Section 80 of the Banking Act, No. 20 of 2015 makes it an offence for a licensed financial institution to fail to comply with a requirement or prohibition imposed on it under the Part of the Act that contains section 80.

Under section 80 of the Banking Act, No. 20 of 2015, a licensed financial institution convicted of the offence of failing to comply with a requirement imposed under the Part of the Act that contains section 80 is liable to a fine of one hundred thousand dollars, with a further penalty for each day a continuing offence continues after conviction.

Section 10(1) of the Copyright Act, 2011 permits, without the copyright owner's authorisation, the reproduction of a short part of a published work in the form of a quotation, provided the reproduction is compatible with fair dealing and does not exceed the extent justified by the purpose. Section 10(2) requires the quotation to be accompanied by an indication of its source and the author's name, where the name appears in the work quoted.

The provision carries no headline-length or short-extract cap distinct from this fair-practice test, and no reported Grenadian decision applies it to a systematic news aggregator rather than an individual quoting a published work. Neighbouring rights under the Act, covering performers, producers of sound recordings and broadcasting organisations, do not extend to a print or online news publisher's own reporting.

The Act came into force on 26 April 2012 under the Copyright Act (Commencement) Order, 2012, made under section 61 of the Act.