Trinidad and Tobago

Section 1(2) brought Part I into force on 6 January 2012, together with sections 7 to 18, 22, 23, 25(1), 26 and 28 of Part II, while Part III, Part IV and Part V remain enacted but not proclaimed. Section 3 binds the State, and section 4 states the Act's object as protecting an individual's right to privacy and the right to keep sensitive personal information private and personal.

Section 5 keeps the Act from limiting information a party may obtain by law in a proceeding, a Court's power to compel testimony or production, or a judicial officer's own working notes. Section 6 states the General Privacy Principles, applicable to all persons who handle, store or process personal information belonging to another person, independent of whether Part III or Part IV has been brought into force for the body or organisation concerned.

Those Principles make an organisation responsible for the personal information under its control, require it to identify the collection purpose before or at collection, require the individual's knowledge and consent for collection, use or disclosure, limit collection to what is legally undertaken and necessary, limit retention and further disclosure to the purpose of collection, require the information to be accurate, complete and up to date, require appropriate safeguards, require organisations to make their information-handling policies available to individuals, and give the individual a right to challenge an organisation's compliance and receive a timely response.

Two further Principles are researched separately as their own families: paragraph (h) restricts processing sensitive personal information and paragraph (l) restricts disclosing personal information outside Trinidad and Tobago.

Section 6(l) of the General Privacy Principles already requires that personal information requested to be disclosed outside of Trinidad and Tobago be regulated, and that comparable safeguards to those under this Act exist in the receiving jurisdiction, binding every person who handles personal information regardless of whether Part III or Part IV has been proclaimed.

Section 46 would require a public body disclosing personal information to a party in another jurisdiction to tell the individual the purpose of the disclosure and the identity of the requester and the receiving jurisdiction's data protection body, and to obtain consent; where the individual withholds consent the public body would not disclose, and where the receiving jurisdiction's safeguards are in doubt the public body would refer the question to the Commissioner for a determination.

Section 72 would impose the equivalent duty on an organisation disclosing personal information under a mandatory code of conduct, again with a Commissioner referral where the organisation is not satisfied the receiving jurisdiction has comparable safeguards.

Section 28 already lets the Commissioner publish a list of countries the Commissioner considers to have comparable safeguards for personal information, which operationalises the section 6(l) principle even before sections 46 and 72 take effect.

Sections 46 and 72 are not shown as commenced: they sit in Part III and Part IV, which section 1(2) does not name among the provisions brought into force on 6 January 2012, so the detailed consent-and-referral mechanism awaits proclamation while the general section 6(l) principle already binds.

Part III, sections 52 to 59, would give every individual in Trinidad and Tobago a right of access to personal information about them held in a public body's personal information bank or otherwise under its custody or control, require the Head of a Public Body to respond within thirty days, and let an individual appeal a refusal to the Commissioner within six weeks.

Section 53 would let the Head of a Public Body refuse access where disclosure would invade another individual's privacy, reveal information supplied in confidence, reveal a confidential source of evaluative material, or fall within a Freedom of Information Act exemption, and section 68 would put the burden of proving an exemption applies on the public body.

Section 57 would give an individual a right to request correction of an error or omission, require the Head of a Public Body to annotate an unactioned correction request, and require notice of a correction to any other public body or third party the information was disclosed to in the year before the request.

Part IV, sections 75 to 85, would give the equivalent access right against an organisation subject to a mandatory code of conduct, with the same Commissioner review and complaint process, but no equivalent correction right of its own; an organisation covered by a mandatory code would instead comply with the code's own provisions.

None of Part III or Part IV is shown as commenced: section 1(2) brought only Part I and specified sections of Part II into force on 6 January 2012, so an individual currently has no statutory access or correction right against either a public body or a private organisation under this Act.

Sections 7 to 18 establish the Office of the Information Commissioner as a body corporate, provide for the appointment, tenure, removal, remuneration and oath of the Commissioner and up to two Deputy Commissioners, and give the Commissioner powers to audit and investigate compliance, order a public body or organisation to cease a contravening practice, authorise data matching, make orders on fee reasonableness and compliance with the General Privacy Principles, and publish compliance guidelines.

Section 10 gives the Commissioner functions including promoting codes of conduct, disseminating information about the Act, monitoring compliance, cooperating with counterparts in other jurisdictions, researching privacy issues, flagging a body's failure to meet the Principles or Part III or Part IV, publishing compliance reports, and reviewing privacy impact assessments.

Section 25(1) bars the Commissioner and anyone acting under the Commissioner's direction from disclosing information obtained in performing their duties, and section 28 requires the Commissioner to publish a list of countries with comparable safeguards for personal information.

All of these provisions, together with the rest of Part I, came into force on 6 January 2012, so Trinidad and Tobago currently has an operating Information Commissioner with these powers and functions, even though the Parts the Commissioner would chiefly enforce, Part III and Part IV, are not yet proclaimed.

Not commenced within Part II are the designation of inspectors (section 19), the Commissioner's power to audit or enquire pursuant to Part III (section 20) or Part IV (section 21), privileged information (section 24), the exceptions to the Commissioner's confidentiality obligation (section 25(2) and (3)), and the Commissioner's annual report to Parliament (section 27).

Part V, sections 87 to 96, would make it an offence to obstruct the Commissioner, make a false statement, fail to comply with a Commissioner order, violate the whistle-blowing protection, breach a mandatory code of conduct, wilfully disclose or unlawfully collect personal information in contravention of the Act, or breach the Commissioner's own confidentiality obligation under section 25, and would penalise an individual offender with a fine of up to $100,000 or five years' imprisonment on indictment and a body corporate with a fine of up to $500,000 on indictment or up to ten percent of annual turnover.

Part V is not shown as commenced: section 1(2) does not name it among the provisions brought into force on 6 January 2012, so none of the Act's offences or penalties currently apply, and a contravention of the General Privacy Principles, including the confidentiality obligation in section 25(1) that already binds the Commissioner's own office, cannot presently be prosecuted under this Act.

Section 6(h) of the General Privacy Principles states that sensitive personal information is protected from processing except where otherwise provided for by written law, and this principle binds every person who handles, stores or processes personal information regardless of whether Part III or Part IV has been proclaimed.

Sensitive personal information is defined as information on a person's racial or ethnic origins, political affiliations or trade union membership, religious or similar beliefs, physical or mental health or condition, sexual orientation or sexual life, or criminal or financial record.

Section 40 would limit a public body's processing of sensitive personal information to cases where it has the person's consent, or the information is processed by a health care professional for preventive medicine, diagnosis, treatment or hospital care management, has already been made public by the person, is processed for research under section 43, serves law enforcement or national security, determines access to social services, or another written law authorises it.

Section 76 states the equivalent limitation for a corporation, in materially the same terms as section 40 except that it does not include a law-enforcement-or-national-security ground.

Neither section 40 nor section 76 is shown as commenced: both sit in Part III and Part IV, which section 1(2) does not name among the provisions brought into force on 6 January 2012, so the detailed conditions for processing sensitive personal information await proclamation while the general prohibition in section 6(h) already binds.

Section 3(1) prohibits knowingly and without authority causing a computer to perform any function for the purpose of securing access to a program or data held in that computer or another one, on pain of a fine of $15,000 and imprisonment for two years, rising to $30,000 and four years on a second or subsequent conviction.

Section 2(2) defines access as unauthorised where the person is not entitled to control access of that kind and does not have the consent of the person who is; the offence does not require infringing a security measure, so it is drawn more broadly than a computer-misuse statute that turns on circumvention.

Section 3(2) adds a further fine and imprisonment where the access causes damage, and section 9 enhances the penalty to $150,000 and ten years' imprisonment where the offence involves a protected computer. No reported Trinidadian case construes whether reading a public, unauthenticated page without defeating any access control falls within the section absent the consent element being read narrowly.

Section 6(1)(b) protects, as a derivative work, a collection of works and a collection of mere data (a database), in machine-readable or other form, provided the collection is original by reason of the selection, coordination, or arrangement of its contents.

This is ordinary compilation copyright rather than a sui generis database right of the kind the European Union grants, so a database that is not original in its selection or arrangement receives no protection under this section regardless of the effort spent assembling it, and copying an unoriginal collection of data is not an infringement under this provision.

The Act predates the text-and-data-mining exception found in some newer copyright statutes, so no machine-readable opt-out mechanism or text and data mining (TDM)-specific exception exists for a protected collection.

Section 10(1) permits, without the copyright owner's authorization, the reproduction of a short part of a published work in the form of a quotation, provided the reproduction is compatible with fair dealing and does not exceed the extent justified by the purpose. Section 10(2) conditions this on the quotation being accompanied by an indication of its source and the name of the author, if the author's name appears in the work quoted.

The provision carries no headline-length or short-extract cap distinct from the fair-dealing test. No reported Trinidadian decision applies it to a systematic news aggregator rather than an individual quoting a published work, and no separate case law on the point has been located. Neighbouring rights under the Act protect performers and their fixations, not a print or online news publisher's own reporting.