/

/

/

/

/

Revised Laws of Saint Lucia (2022)

Back to Revised Laws of Saint Lucia (2022)

Back to Table of Contents

41. Use of personal data

A data controller shall ensure that personal data is —

(a) kept only for one or more specified and lawful purposes for which the personal data is to be processed;

(b) not used or disclosed in any manner incompatible with the purposes for which the personal data has been processed;

(c) adequate and relevant for the purpose for which the personal data is to be processed; and

(d) not kept for longer than is necessary for the purpose for which the personal data is to be processed.

41. Use of personal data

1. Short title and commencement

2. Interpretation

4. State to be bound

5. Appointment of Data Protection Commissioner

6. Resources of the office of the Commissioner

7. Restriction on employment

8. Tenure of office

9. Functions of the Commissioner

10. Independence of functions

11. Oath and confidentiality

12. Powers of the Commissioner

12A. Privacy impact assessment

13. Delegation of functions of the Commissioner

14. Power of the Commissioner to obtain information

15. Contents of information notice

16. Failure or refusal to comply with information notice

17. Insufficient information UNDER the information notice

18. Powers of investigation

19. Form of complaint

20. Notice of investigation

21. Power to request assistance

22. Powers of entry and search

23. Warrant to enter and search premises

24. Obstruction of Commissioner or authorized officer

25. Power of Commissioner to issue enforcement notice

26. Contents of enforcement notice

27. Failure to comply with enforcement notice an offence

28. Investigations in private

29. Referral to Director of Public Prosecutions

30. Instruments of the Commissioner

31. Protection of the Commissioner and staff

32. Data Protection Principles

33. Collection of personal data

34. Consent for processing of personal data

35. Criteria for processing sensitive personal data

36. Processing of sensitive personal data

37. Processing concerning health or medical purposes

38. Processing and disclosure for research and statistical purposes

39. Processing concerning legal offences

40. Accuracy of personal data

42. Security of personal data

43. Duty to destroy personal data

44. Unlawful disclosure of personal data

45. Transfer of personal data

46. Requirement to register

47. Registration as a data controller

48. Duration of registration

49. Register of Data Controllers

50. Inspection of Register

51. Certificate issued by Commissioner

52. Right to access personal data

53. Compliance with request for access to personal data

54. Discretion in relation to access to personal data

55. Denial of access to personal data

56. Right of rectification, etc., of inaccurate personal data

57. Right to prohibit processing of personal data for direct marketing

57A. Employee's protection

58. National Security

59. Crime and taxation

60. Health and social work

61. Regulatory activities

62. Journalism, literature and art

63. Research, history and statistics

64. Information available to the public under an enactment

65. Disclosure required by law or in connection with legal proceedings

66. Legal professional privilege

67. Domestic purposes

68. Written authorization of Commissioner in certain cases

69. Appeals to Court

70. Hearing of proceedings

71. Offences and penalties

72. Offences by directors, etc., of bodies corporate

73. Annual Report

74. Regulations