Grenada

The Data Protection Act, No. 1 of 2023 applies to a person who processes, controls or authorises the processing of personal data in respect of commercial transactions in Grenada, reaching a person established in Grenada and, under section 4(2)(b), a person established elsewhere who uses equipment or network services in Grenada for processing personal data.

Section 7 bars a data user from processing personal data about a data subject without the data subject's consent, subject to the alternative grounds in section 7(2) such as contractual necessity, a legal obligation, protecting the data subject's interests, the administration of justice or the exercise of a statutory or government function, and section 7(3) requires the processing to be for a lawful purpose directly related to the data user's activity and adequate but not excessive for that purpose.

Section 9 bars a data user from disclosing personal data, without the data subject's consent, for a new purpose or to a new class of recipient, and section 20 lets a data user disclose personal data for another purpose only where the data subject consents, the disclosure is necessary to prevent or detect crime or for investigations, the disclosure is required or authorised by an enactment or court order, or the Minister deems the disclosure justified as being in the public interest.

Section 10 requires a data user to take practical steps to protect personal data against loss, misuse, unauthorised access, alteration or destruction, including obtaining a data processor's guarantees of its own technical and organisational security measures, and section 11 bars retention of personal data longer than necessary for the purpose it was processed for.

Section 12 requires a data user to take reasonable steps to keep personal data accurate, complete, not misleading and up to date, and section 14 requires every data user to establish formal procedures implementing these principles and to review them at least once every five years.

Sections 22 and 23 exempt personal data processed for an individual's own personal, family, household or recreational purposes, and let the Minister exempt further data users or provisions by Order published in the Gazette, alongside the Act's own exemptions for crime prevention and investigation, health information whose disclosure would cause serious harm, anonymised statistics and research, court orders, regulatory functions, and journalistic, literary or artistic purposes meeting a public interest test.

Section 1(2) delays the Act's commencement to a day the Minister appoints by Order in the Gazette, and no commencement Order has been located, so the Act has been assented and gazetted but is not yet in force.

Section 8 requires a data user, on request by a data subject, to tell the data subject the purposes and source of collecting and further processing their personal data, their right to request access and rectification, the classes of third party the data may be disclosed to, whether supplying the data is obligatory, and the consequences of not supplying it.

Section 13 gives a data subject the right to access personal data a data user holds about them and to have it rectified where it is inaccurate, incomplete, misleading or not up to date, except where access or rectification is refused under the Act.

Section 15 lets a person, on a written request and payment of a processing fee, require a public or private body to confirm whether it processes their personal data and, if so, to describe the data, the purposes of processing, the recipients or classes of recipient, and the source of the data.

Section 16 requires the body to give written notice within thirty days of whether access will be given and, if so, to give access within sixty days, subject to an extension of up to thirty more days in the circumstances section 16(2) lists.

Section 17 lets a data user refuse access where it cannot verify the requester's identity or locate the data, where an exemption under Part IV or a duty of confidentiality applies, where a third party identifiable from the data withholds consent to its disclosure, or where the Commission approves the refusal in writing, and requires the refusal notice to state the ground and the right to complain to the Commission.

Section 18 requires the body to let the data subject examine the data or give them a copy, in an alternative format where the data subject has a sensory disability and an alternative format already exists or conversion is reasonable.

Section 19 lets a data subject apply to have personal data amended where it is incomplete, incorrect, misleading, excessive or irrelevant to the purpose it is held for, and lets a data subject aggrieved by a refusal complain to the Commission within fifteen calendar days, though the section does not apply to records kept under the listed civil-registration and citizenship enactments.

Section 24 establishes the Information Commission as a body corporate of three members appointed by the Governor-General on the Prime Minister's recommendation in consultation with the Leader of the Opposition, and section 25 gives it the functions of monitoring and advising public and private bodies, receiving and investigating complaints, education, and research and reporting to the Minister.

Section 29 lets the Commission investigate, on a data subject's complaint or on its own initiative, whether a public or private body has contravened, is contravening or is likely to contravene the Act, and sections 30 to 32 govern the form of a complaint, the notice of investigation served on the Chief Executive Officer, and the information notice by which the Commission may compel a data user to furnish access to personal data and information about its processing and security.

Section 33 lets a Magistrate issue a warrant authorising an authorised officer to enter and search premises, inspect and test equipment, and seize documents where there are reasonable grounds to suspect an offence under the Act.

Section 34 lets the Commission serve an enforcement notice requiring a public or private body to rectify or erase personal data or supplement it with an approved statement, and requires the body, once it complies in a way that materially modifies the data, to notify the data subject and anyone the data was disclosed to in the twelve months before the notice.

Section 35 lets the Commission assess a body's processing for compliance, on its own initiative or on a request from a person affected by it, and report its findings and any direction to comply. Section 36 lets a data subject who suffers damage from a contravention of the Act by a public or private body bring civil proceedings in the High Court, subject to a defence that the body took all care reasonably required to comply.

Section 37 makes it an offence, punishable summarily by a fine not exceeding five thousand dollars or imprisonment not exceeding six months, to obstruct the Commission or an authorised officer, and section 38 bars an employer from retaliating against an employee who in good faith reports or refuses to take part in a contravention of the Act.

Section 39 makes it an offence to intentionally disclose personal information in contravention of the Act, or to collect, store or dispose of it in a way that contravenes the Act, section 40 makes it an offence to breach the whistleblower protection in section 38, and section 41 makes an officer, director or agent of a corporation who directed, authorised, assented to or participated in an offence a party to that offence.

Section 42 sets the default penalty for an offence with no penalty otherwise specified: for an individual, a fine not exceeding fifty thousand dollars or imprisonment not exceeding three years on summary conviction, or a fine not exceeding one hundred thousand dollars or imprisonment not exceeding five years on conviction on indictment, and for a body corporate, a fine not exceeding two hundred and fifty thousand dollars on summary conviction or five hundred thousand dollars on conviction on indictment.

Section 43 gives a right of appeal to the High Court against an enforcement or information notice, a decision on a complaint, or any decision of the Commission on the conduct of its duties, section 46 bars a Commission member or person acting for it from disclosing information obtained in the conduct of their functions except by court order, and section 47 requires the Commission to report annually to Parliament on its activities.

Section 21 bars a data user from processing sensitive personal data, defined in section 2 to include an individual's physical or mental health or condition, racial or ethnic origin, genetic data, biometric data that uniquely identifies an individual, sex life, political opinions, religious or philosophical beliefs, and the commission or alleged commission of an offence, except on the conditions section 21(1) lists.

The data subject's written consent to the processing of the sensitive personal data is the first of those conditions, and the others include processing necessary to an employment right or obligation, protecting the data subject's or another person's interests where consent cannot reasonably be obtained or has been unreasonably withheld, medical purposes undertaken by a healthcare professional or someone under an equivalent duty of confidentiality, legal proceedings or advice, the administration of justice, a statutory or government function, another purpose the Minister thinks fit, or information the data subject has made public.

A person who contravenes section 21(1) commits an offence and is liable, on conviction on indictment, to a fine not exceeding two hundred thousand dollars or imprisonment for a term not exceeding two years, or both.

Section 5(1) prohibits a person from, knowingly and without lawful excuse, justification or the permission of the owner or person in charge of an electronic system or network, gaining access to it, or downloading, copying or extracting data, an electronic database or information from it.

Unlike a computer-misuse offence conditioned on defeating a technical security measure, section 5's chapeau turns on the absence of permission from the person in charge of the system, a standard that on its face can reach a scraper that accesses or extracts data from a public, unauthenticated page without the site operator's permission; no reported Grenadian case has tested the provision against that fact pattern.

The offence carries a fine of up to two hundred thousand dollars or imprisonment of up to three years, or both, on summary conviction. The Act was approved in 2013 and, per Council of Europe reporting, amended by Act No. 10 of 2014 (which repealed three unrelated sections, 6, 16 and 25) and came into effect in 2016; no source located states the day-precise commencement date.

Section 10 permits, without the copyright owner's authorisation, the reproduction of a short part of a published work as a quotation, provided the reproduction is compatible with fair dealing, does not exceed the extent justified by the purpose, and is accompanied by an indication of the source and the author's name.

Section 13 permits a narrower exception for temporary reproduction made in the process of transmitting a work or making a stored work perceptible, where the person doing so is entitled to do the act by authorisation of the copyright owner or by operation of law, so it does not itself authorise unauthorised bulk collection.

The Act has no express text-and-data-mining exception, so large-scale reproduction of copyright-protected Grenadian works for model training rests only on the fair-dealing quotation ground, whose short-extract and source-attribution conditions are a poor fit for that use.

Section 6(1)(b) protects a collection of data (a database) as a derivative work only where the collection is original by reason of the selection, co-ordination or arrangement of its contents, a compilation-copyright standard rather than a sui generis database right of the kind some other jurisdictions confer.

Criminal liability for infringement (s. 43) attaches only where the infringement is for profit-making purposes and the infringer knew or had reason to believe it was an infringement, punishable on summary conviction by a fine not exceeding fifty thousand dollars and imprisonment not exceeding five years.

Section 61 delays the Act's commencement to a day the Minister appoints by Order in the Gazette; WIPO Lex lists the Act as the current version of Grenada's copyright statute without stating a commencement date, and no dated commencement Order has been located.

The Data Protection Act, No. 1 of 2023 applies to a person who processes, controls or authorises the processing of any personal data in respect of commercial transactions in Grenada, including a person established outside Grenada who uses equipment or network services in Grenada for that processing.

The definition of personal data and the general processing grounds carry no publicly-available carve-out for personal data generally; the only publicly-made ground is scoped to sensitive personal data specifically, where section 21(1)(c) permits processing sensitive personal data that has been made public as a result of steps taken by the data subject.

So a scraper collecting ordinary personal data from Grenada, including for training a model, would need a lawful basis, ordinarily the data subject's consent, once the Act is brought into force. Section 1(2) delays commencement to a day the Minister appoints by Order in the Gazette, and no such Order has been located, so the Act does not currently bind anyone.

Section 10(1) of the Copyright Act, 2011 permits, without the copyright owner's authorisation, the reproduction of a short part of a published work in the form of a quotation, provided the reproduction is compatible with fair dealing and does not exceed the extent justified by the purpose. Section 10(2) requires the quotation to be accompanied by an indication of its source and the author's name, where the name appears in the work quoted.

The provision carries no headline-length or short-extract cap distinct from this fair-practice test, and no reported Grenadian decision applies it to a systematic news aggregator rather than an individual quoting a published work. Neighbouring rights under the Act, covering performers, producers of sound recordings and broadcasting organisations, do not extend to a print or online news publisher's own reporting.

Section 61 delays the Act's commencement to a day the Minister appoints by Order in the Gazette; WIPO Lex lists the Act as the current version of Grenada's copyright statute without stating a commencement date, and no dated commencement Order has been located.