Saint Lucia

Part 1 states the Act's preliminary provisions: section 3 applies it to a data controller established in Saint Lucia, or established elsewhere but using equipment in Saint Lucia to process data otherwise than in transit, and section 4 binds the State as well as private actors.

Section 33 bars a data controller from collecting personal data except for a lawful purpose connected with its function or activity where the collection is necessary for that purpose, and requires it to tell the data subject, at the point of collection, what is being collected, why, who will receive it, whether providing it is mandatory, the consequences of not providing it, and the subject's rights of access, correction and destruction.

Section 34 bars processing personal data without the data subject's express consent unless a listed ground applies, such as performing a contract with the subject, complying with a legal obligation, or a legitimate interest that does not override the subject's privacy rights, and lets the subject object to processing done on the public interest or legitimate interest grounds and revoke consent at any time.

Section 39 confines processing of data relating to offences, criminal convictions or security measures to the control of a public authority. Section 40 requires a data controller to keep personal data accurate and up to date. Section 41 requires personal data to be kept only for specified lawful purposes, not used or disclosed incompatibly with those purposes, kept adequate and relevant, and not retained longer than necessary.

Section 42 requires the data controller to take security measures appropriate to the risk of unauthorized access, alteration, or loss, having regard to the state of technology and the cost of the measures. Section 43 requires the data controller to destroy personal data once the purpose for holding it has lapsed. Schedule 2 restates these duties as eight Data Protection Principles.

Part 4, sections 46 to 51, would require a data controller to register with the Commissioner, maintain that registration, and hold a certificate the Commissioner issues, and it is enacted and not in force, as are Part 2 and Part 5.

Part 6 exempts a data controller from specified Principles and sections in listed cases, including national security, crime and taxation, health and social work, regulatory activities, journalism, research, information already public under another enactment, legal proceedings, legal professional privilege, domestic purposes, and Commissioner authorization, such as the section 64 exemption applying where the data controller is itself obliged under another enactment to make the information public.

The 2015 Act reworked four of these provisions: it replaced section 1(2) and added section 1(3) so the Minister may fix different dates for different Parts or sections, substituted the definition of data controller in section 2 and added a definition of privacy impact assessment, cut the penalty in section 34(5) to a fine alone by deleting the alternative of imprisonment, and replaced the domestic-purposes exemption in section 67.

Section 45 would bar a data controller from transferring personal data to a country or territory outside Saint Lucia unless the receiving country or territory has comparable safeguards to those in Saint Lucia and the Commissioner has authorized the transfer, subject to exceptions where the data subject consents, the transfer is necessary for a contract with or requested by the data subject, it is necessary to safeguard national security, it concerns public security, or the Commissioner approves the transfer's terms as adequately safeguarding the data subject's rights.

Section 45 sits at the end of Part 3 alongside the data-controller obligations, and it is enacted and not in force, so no transfer condition binds a data controller today. Schedule 2's Eighth Principle, the Transfer of Data Principle, restates the same rule by reference to section 45. The 2015 Act left both untouched. No notice appointing the day these provisions come into force has been located.

Part 5 of the Act, sections 52 to 57A, would give a data subject or relevant person acting for them a right to access personal data a data controller holds, requiring the controller on written request to disclose whether it holds personal data about the person, describe it, state the purposes and source of processing, explain any automated-processing logic involved, name the recipients, and permit examination or supply a copy on payment of the prescribed fee, in an alternative format where the person has a sensory disability.

Sections 53 to 55 would govern how a data controller complies with an access request, the discretion available to it, and the grounds on which access may be denied. Section 56 would give a right of rectification of inaccurate personal data, and section 57 would give a right to prohibit processing of personal data for direct marketing.

Section 57A, which shields an employee who reports a contravention of the Act to the Commissioner from dismissal or other detriment, is not in the 2011 Act: the 2015 Act inserted it. That Act also added a subsection to section 54, requiring a data controller who does not comply with an access request to notify the Commissioner and the person who made it.

The whole of Part 5 is enacted and not in force, so a data subject's access, rectification, direct-marketing-objection and employee-protection rights do not bind a data controller today. Section 64 reaches Part 5 even so, exempting information a data controller is obliged under another enactment to make public from Part 5 in respect of blocking personal data. No notice appointing the day these provisions come into force has been located.

Part 2, sections 5 to 31, would establish a Data Protection Commissioner with functions including maintaining a register of data controllers and of processing operations, verifying compliance on the Commissioner's own motion or a data subject's request, investigating complaints, issuing information notices and enforcement notices, and referring matters to the Director of Public Prosecutions.

Part 7, sections 69 to 74, would give a right of appeal to the Court, and section 71 would make contravening the Act an offence carrying, where no specific penalty is provided, a fine of up to $10,000 for an individual or $100,000 for a body corporate. Both Parts are enacted and not in force, so Saint Lucia has no operating Data Protection Commissioner and the Act's general offence and penalty provision does not bind.

The one penalty in force sits inside the commenced consent duty rather than in Part 7: section 34(5) makes a data controller who contravenes the consent requirement in section 34 liable, on summary conviction, to a fine not exceeding $25,000. The 2015 Act deleted the alternative of imprisonment from that penalty and from the general penalty in section 71(2)(a), leaving both as fines alone.

The same Act inserted section 12A, which lets the Commissioner require a department of government to prepare a privacy impact assessment and submit it for approval. Section 44, titled Unlawful disclosure of personal data, sits in Part 3 alongside the data-controller obligations but is, like section 45, enacted and not in force. No notice appointing the day these provisions come into force has been located.

Section 35 bars processing sensitive personal data (racial or ethnic origin, political opinion, religious belief, physical or mental health, sexual orientation, or criminal or financial record) except under the grounds section 34(2) and sections 36 to 38 provide, in regulations the Minister prescribes having regard to the public interest, or where the data subject has given explicit consent or has already published the data.

Section 36 lets a data controller process sensitive personal data with appropriate safeguards where necessary to exercise or perform a right or obligation the law imposes on it, to protect the vital interests of the data subject or another person where consent cannot be obtained, or to protect another person's vital interests where the data subject's consent has been unreasonably withheld.

Section 37 lets a health practitioner or another person under a professional confidentiality obligation process sensitive personal data for preventive medicine and the protection of public health, medical diagnosis, medical research, or management of health and hospital care services. The 2015 Act put medical research on that list, in place of health care or treatment.

The same Act added a subsection giving way to another enactment that specifically governs the processing of sensitive personal data for health purposes where the two are inconsistent.

Section 38 lets a data controller process or disclose sensitive personal data for research, including statistical research, only where the research purpose cannot reasonably be accomplished without individually identifiable data, the data will not be used to contact a person to participate in research, any record linkage is not harmful to the data subject, and the responsible officer has approved conditions on security and destruction of identifiers, with the recipient signing an agreement to comply with those conditions.

Section 64 additionally exempts information a data controller is obliged under another enactment to make public from sections 34, 35, 40, 41, 42, 43 and 44 and from Part 5 in respect of blocking personal data.

Section 5 prohibits knowingly and without lawful authority causing a computer system to perform a function to secure access to a program or data. Section 7 prohibits, by any means and knowingly, securing access without authority to obtain a computer service, or intercepting without authority any function of or data within a computer system.

Section 8 prohibits knowingly causing an unauthorized modification of data held in a computer system, including to impair the system's operation, hinder access to a program or data, or impair the reliability of data.

Each offence carries a graduated fine, rising for a second or subsequent offence and rising further where the computer system was damaged, impaired, or its data suppressed or modified, up to $50,000 and 18 months' imprisonment; because the trigger for each offence is that the access, interception, or modification be unauthorized or without authority, a scraper reading a public, unauthenticated page without defeating any access control or exceeding a granted authorization falls outside a plain reading of these provisions.

Banking Prudential Standard No. 3 of 2022, the Prudential Standard for Electronic Banking, is issued by the Eastern Caribbean Central Bank in exercise of the powers conferred by section 184 of the Banking Act. Banking Prudential Standard No. 3 of 2022 came into effect on 1 February 2023. Banking Prudential Standard No. 3 of 2022 applies to all institutions licensed under the Banking Act.

Paragraph 5.2.1 of the ECCB Electronic Banking Standard says that a licensed financial institution must ensure that the necessary security control infrastructure is in place to secure e-banking systems and data from both internal and external threats. Paragraph 5.2.2 of the ECCB Electronic Banking Standard says that an institution must ensure that a comprehensive security process is implemented, with policies and procedures that address internal and external security threats.

Paragraph 5.2.4 of the ECCB Electronic Banking Standard says that an institution must reinforce information security controls to preserve the confidentiality and integrity of customer data. Paragraph 5.2.8 of the ECCB Electronic Banking Standard says that appropriate systems must be employed to reduce external threats to e-banking systems, including penetration testing of internal and external networks.

Paragraph 6.4 of the ECCB Electronic Banking Standard says that the security process an institution has implemented shall be submitted to the Central Bank. Institutions found in violation of the ECCB Electronic Banking Standard are subject to the remedial actions specified in section 75 of the Banking Act.

Section 80 of the Banking Act, No. 3 of 2015 makes it an offence for a licensed financial institution to fail to comply with a requirement or prohibition imposed on it under the Part of the Act that contains section 80.

Under section 80 of the Banking Act, No. 3 of 2015, a licensed financial institution convicted of the offence of failing to comply with a requirement imposed under the Part of the Act that contains section 80 is liable to a fine of $100,000, with a further penalty for each day a continuing offence continues after conviction.

The Prudential Standard on Technology Risk Management for Institutions Licensed Under the Banking Act, 2015 is issued by the Eastern Caribbean Central Bank in exercise of the powers conferred by section 184 of the Banking Act. The ECCB Technology Risk Management Standard came into effect on 3 January 2023.

The ECCB Technology Risk Management Standard says it should be applied by all regulated licensed financial institutions unless information technology is not a significant function or alternative measures of equal effect have been taken. The ECCB Technology Risk Management Standard requires any deviation from it to be explained in a separate document that is made promptly available to the ECCB on request.

Under the ECCB Technology Risk Management Standard, the roles and responsibilities of the board of directors shall include ensuring the development of a robust cyber-risk management framework. Under the ECCB Technology Risk Management Standard, the roles and responsibilities of senior management shall include developing and implementing a cybersecurity incident response plan.

The ECCB Technology Risk Management Standard requires licensed financial institutions to establish an Information Security User Group. Section 75 of the Banking Act, No. 3 of 2015 lets the Central Bank take remedial action against a licensed financial institution that violates a prudential standard issued by the Central Bank.

Section 80 of the Banking Act, No. 3 of 2015 makes it an offence for a licensed financial institution to fail to comply with a requirement or prohibition imposed on it under the Part of the Act that contains section 80.

Under section 80 of the Banking Act, No. 3 of 2015, a licensed financial institution convicted of the offence of failing to comply with a requirement imposed under the Part of the Act that contains section 80 is liable to a fine of $100,000, with a further penalty for each day a continuing offence continues after conviction.

Section 12(7)(b) of the Virtual Asset Business Act, 2022 requires a licensee to implement and maintain policies for the virtual asset business to protect the operations of the licensee and personal information collected and stored by the licensee from cyber threats. An applicant for a licence must include with its application written policies, rules and procedures covering, among other subjects, security access control and cyber security safeguards.

A person who contravenes a provision of the Act for which a penalty is not specified is liable on summary conviction to a fine not exceeding ten thousand dollars and imprisonment for a term not exceeding two years.

Banking Prudential Standard No. 3 of 2022, the Prudential Standard for Electronic Banking, is issued by the Eastern Caribbean Central Bank in exercise of the powers conferred by section 184 of the Banking Act. Banking Prudential Standard No. 3 of 2022 came into effect on 1 February 2023. Banking Prudential Standard No. 3 of 2022 applies to all institutions licensed under the Banking Act.

Paragraph 6.4 of the ECCB Electronic Banking Standard says that all incident reports and response shall be sent to the Central Bank within 3 days of the occurrence. Paragraph 6.4 of the ECCB Electronic Banking Standard adds that any further update on the incident shall also be reported to the Central Bank.

Paragraph 5.2.7 of the ECCB Electronic Banking Standard says that an institution must implement formal incident response and management procedures for timely reporting and handling of suspected or actual security breaches, fraud, or service interruptions of its e-banking services. Paragraph 5.2.7 of the ECCB Electronic Banking Standard also says that significant incidents should be reported to the Central Bank.

Paragraph 5.11.2 of the ECCB Electronic Banking Standard says that an institution must develop a clear process for alerting the appropriate regulatory authorities in the event of security breaches or disruptive incidents. Institutions found in violation of the ECCB Electronic Banking Standard are subject to the remedial actions specified in section 75 of the Banking Act.

Section 80 of the Banking Act, No. 3 of 2015 makes it an offence for a licensed financial institution to fail to comply with a requirement or prohibition imposed on it under the Part of the Act that contains section 80.

Under section 80 of the Banking Act, No. 3 of 2015, a licensed financial institution convicted of the offence of failing to comply with a requirement imposed under the Part of the Act that contains section 80 is liable to a fine of $100,000, with a further penalty for each day a continuing offence continues after conviction.

The Prudential Standard on Technology Risk Management for Institutions Licensed Under the Banking Act, 2015 is issued by the Eastern Caribbean Central Bank in exercise of the powers conferred by section 184 of the Banking Act. The ECCB Technology Risk Management Standard came into effect on 3 January 2023.

Paragraph 12.8.1 of the ECCB Technology Risk Management Standard says that within 24 hours of becoming aware of a cyber-incident a licensed financial institution shall alert the ECCB and its Information Security User Group. Paragraph 12.8.1 of the ECCB Technology Risk Management Standard also says that the compromised institution should complete the incident report in Appendix I and submit it to the ECCB within 48 hours of the incident.

Paragraph 12.8.4 of the ECCB Technology Risk Management Standard says that an institution shall provide an update on the incident to the ECCB at a frequency determined by the ECCB. Paragraph 12.8.5 of the ECCB Technology Risk Management Standard says that after the cyber-incident is resolved an institution shall conduct a post-incident review and submit it to the ECCB.

Under the ECCB Technology Risk Management Standard, the roles and responsibilities of senior management shall include notifying directly, within seventy-two hours of the discovery of the incident, the customers whose accounts were potentially or actually compromised. Section 75 of the Banking Act, No. 3 of 2015 lets the Central Bank take remedial action against a licensed financial institution that violates a prudential standard issued by the Central Bank.

Section 80 of the Banking Act, No. 3 of 2015 makes it an offence for a licensed financial institution to fail to comply with a requirement or prohibition imposed on it under the Part of the Act that contains section 80.

Under section 80 of the Banking Act, No. 3 of 2015, a licensed financial institution convicted of the offence of failing to comply with a requirement imposed under the Part of the Act that contains section 80 is liable to a fine of $100,000, with a further penalty for each day a continuing offence continues after conviction.

Section 56 provides that fair dealing with a work for the purpose of criticism or review, or for reporting current events, does not infringe copyright provided it is accompanied by a sufficient acknowledgement, except that no acknowledgement is required where the reporting is by sound recording, film, broadcast, or cable programme. Section 55 separately permits fair dealing for research or private study.

Section 57 directs a court determining whether an act is fair dealing to weigh the nature of the work, the extent and substantiality of the part used relative to the whole, and the effect of the use on the potential market for or commercial value of the work. Section 3 binds the Crown. The Act creates no press-publisher neighbouring right, no compelled-bargaining regime, and no text-and-data-mining exception, and no provision addresses hyperlinking or framing a third party's content.