St Vincent and the Grenadines - Privacy Act 2003
151
SAINT VINCENT AND THE GRENADINES
ACT NO. 18 OF 2003
I ASSENT
[LS.]
DR FREDERICK. BALLANTYNE
Governor-General 15th October, 2003
ANACT to make provision for the promotion and protection of the privacy of individuals, and for connected matters.
[ 21st October, 2003 ]
BE IT ENACTED by the Queen's Most Excellent Majesty, by and with the advice and consent of the House of Assembly of Saint Vincent and the Grenadines and by the authority of the same, as follows:
PARTI
PRELIMINARY
1. ThisAct may be cited as the Privacy Act, 2003. Short title
2 This Act shall come into operation on a day to be appointed by Commencement
the Minister, by Order published in the Gazette.
3. The object of this Act is to make provision for the collection, Object of Act
holding, use, correction and disclosure of personal infonnation in a manner that recognises the right of individuals to privacy with respect to their personal infonnation.
4. In this Act - Interpretation
"administrative purpose", in relation to the use ofpersonal information a bout an individual, means the use of that information in a decision making process by a public authority that affects that individual;
No.18
152
Privacy 2003
"chief executive officer" includes the officer for the time being exercising the highest level of administrativefunctions within any public authority;
"Commissioner" means the Privacy Commissioner aJ. pointed under section 16;
''correct" in relation to personal information, means to alter that information by way of correction, deletion, oraddition; and "correction" has a corresponding meaning;
"document'' means any medium inwhich infonnation is recorded, whether printed or on tape orfilm orbye)ectronic means or otherwise and includes any map, diagram, photograph, film, microfilm, video-tape,sound recording, or machine-readable record or any record which is capable of being produced from amachine-readable record by means of equipment or a programme (or a combination of both) which is &1sedfor that purpose by the public authority which holds th·: record;
"Minister" means the Minister who has been a..:signed responsibility for information under the Constitu·t on;
"personal infonnation" means infonnation about an identifiable individual that is recorded in any formincluding, without restricting the generality of the foregoing -
(a) information re1ating to the race, sex, national or ethnic origin, religion, age or marital status of theindividual;
(b) information relating to the education or the medical, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved orwhich refers to the individual;
No.18
153
Privacy 2003
(c) any identifying number, symbol or other particular assigned to theindividual;
(d) the address, fingerprints, 'Deoxyribo Nucleic Acid' or blood type of the individual;
'
{e) the name of the individual where it appears with other
. personal information relating to the individual or where the disclosure of the name itself would reveal
information about the individual;
(f) correspondence sent to a public authority by the individuai that isexplicitly or implicitly of a private or confidential nature, and replies tosuch correspondence that would reveal the contents of the original correspondence; or
(g) the views or opinions of any other person about the individual;
''public authority" includes -
(a) Parliament or any committee of Parliament;
(b) the Cabinet as constituted under the Constitution;
(c) a Ministry, a department or division of a Ministry;
(d) a local authority;
(e) a public statutory corporation or body;
(f) a body corporate or an incorporated body established for a public purpose, which is owned or controlled by the State;
(g) an embassy, consulate or mission of the State or any office of theState situated outside of Saint Vincent and the Grenadines whosefunctions include the provision of diplomatic or consular services for or on behalf of Saint Vincent and the Grenadines;
· No.18
154
Privacy 2003
(h) any other body designated by the Minister by regulation made under this Act, to be a public authority for the purposes of this Act.
Saving or certain 5. This Act shall not affect the operation of any enactment that other enactments makes provision with respect to the collection, holding, use , correction or disclosure of personal information and is capable of operating
concurrently with this Act.
Act to bind S tate
Collection of persona) information
Source of Persona] information
6. This Act shall bind.the State.
PARTil
COLLECTION, USE,DISCLOSUREANDRETENTIONOF PERSONALINFORMATION
7. {1) A public authority shall not collect personal information unless - .
(a} the information is collected for a lawful pmpose directly related to a function or activity of theauthority; and
(b) the collection of the information is necessary for, or directly related to, that purpose.
(2) A public authority shall not collect personal infonnation -
(a) by unlawful means; or
(b} by means that, in the circumstances of the ca e - (i} are unfair; or
(i11 intrude to an unreasonable extent UJIOD the personal affairs of the individual concen .ed.
8. (1) A public authority may, subject to subsection (3), collect personal information directly from theindividual concerned.
(2) At or before the time, or if that is not practicable, as soon as practicable after, a public uthoritycollects personal information under subsection (I), the authority shall take such steps as are, in the circumstances, reasonable to ensure that the individual concerned is aware of-
155
No.18 Privacy 2003
(a) the purposes for which the information is being collected,;
(b) the fact that the collection of the information is authorised orrequired by ot under law, if such collection is so authorised or required; and
I (c) the intended recipients of the information.
(3) A public authority is not obliged to comply with subsection
(l) where-
(a) the information is publicly available information;
(b) the individual concerned authorises the collection of theinformation from someone else;
(c) non-compliance will not prejudice the interests of the individualconcerned;
(d) non-compliance is necessary -
(i) for the prevention, detection, investigation, prosecution or punishment of any offence or breach oflaw;
(ii) for the enforcement of a law imposing a pecuniary or custodial penalty or both;
(in) for the protection of public revenue;
(iv) for the preparation for, or conduct of, proceedings before any court or tribunal, or implementation of the orders of a court ortribunal;
(v) in the interests of national security; or
(vi) for the prevention of the spread of a communicable or contagious disease;
(e) compliance would prejudice the purpose of the collection; or
No.18
156
Privacy 2003
Accuracy, etc. of personal information to be checked before use
Limits on use of personal information
(f) compliance is not reasonably practicabh in the circumstances of the particular case.
9. Where a public authority holds personal infonnation, having regard to the purpose for which theinformation is proposed to be used. it shall not use that information without t ng such steps as are, in the circumstances, reasonable to ensure that, the information is complete,
accurate, up to date, relevant and not misleading.. (
10. Subject to section 12, where a public authority holds personal information that was collected inconnection with a particular purpose, it shall not use that information for any other purpose unless -
(a) the individual concerned authorises the use of the infonnation for that other purpose;
(b) use of the information for that other purpose is authorised or required by or under law;
(c) the purpose for which the infonnation is used i·· directly related to the purpose for which the informa; ion was collected;
(d) the infonnation is used -
(i) in a form in which the individual concerned is not identified; or
{ii) for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the individual concerned;
(e) the authority believes on reasonable grounds that use of the information for that otherpurpose is nP.cessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or other perso orto public health or safety; or
(f) use of information for that other purpose is nt -:essary-
No.18
157
Privacy 2003
(i) for the prevention, detection, investigation, prosecution or punishment of any offence or breach oflaw;
(it) for the enforcement of a law imposing a pecuniary or custodial penalty or both ;
(fu) for the protection of public revenue;
(iv) for the preparation for, or conduct of, proceedings before any court or tribunal, or implementationof the orders of a court or tribunal; or
(v) in the interests of national security.
11. (1) Subjecttosection 12, whereapublicauthorityholdspersonal information, it shall not disclose the information to a person, body or agency (other than the individual concerned), unless -
(a) the individual concerned bas expressly or impliedly consented to the disclosure;
(b) the disclosure of the information is required or authorised by or under law;
(c) the disclosure of the information is one of the purposes in connection with which the information wascollected, or is directly connected to that purpose;
(d) the individual concerned is reasonably likely to have been aware or made aware under section 8 (2)(c) that information of that kind is usually passed on to that person, body or agency;
(e) the information is to be disclosed -
{i) in a form in which the individual concerned is not identified; or
Limits on disclosure of personal information
No.18
158
Privacy 2003
Condition for use or disclosure of personal information
(iI) for statistical or research purposes and wiU not b e published in a form that could reasonably bet>xpected to identify the individual concerned; or
{f} the authority believes on reasonable grouads that
disclosure of the information is necessary -
(i) to prevent or lessen a serious and imminent threat to the life or health of the individual concernedor other person, or to public health or safety;
(n) for the prevention, detection, investigation, prosecution or punishment of any offence or breach oflaw;
(iit) the enforcement of a law imposing a pecuniary or custodial penalty or both;
(iv) the protection of public revenue;
{v) the preparation for, or conduct of, pro eedings before any court or tribunal, or implementation of the orders of a court or tribunal; or
(vi) in the interests of national security.
· (2) Any person, body or agency to whom personal infonnation is disclosed under subsection (1) shall not use ordisclose the information for a purpose other than the purpose for which the information was given to that person, body oragency.
12. A public authority shall only use or disclose personal infonnation under section 10 or section 11, where such useor disclosure would not amount to an unreasonable invasion of privacy of the individual concerned, taking into account the specific nature oft he personal infonnation and the specific purpose for which it is to be so used or disclosed.
No.18
159
Privacy 2003
13;· Where a public authority holds personal information, it shall ensure that -
(a) the information is- .pro 'te c ted, by such security safeguards as is reasonable in the circumstances to take, against loss, unauthorised access, use, modification or disclosure, and against other misuse; and
(b) where it is necessary for the information to be given to a person, body or agency in connection with the provisions of a service to the authority, everything reasonably within the power of the authority is doneto prevent unauthorised use or disclosure of the information.
14. (1) Where a public authority uses personal information for an administrative purpose, it shall retain theinformation only for such period of time after it is so used as may be prescn'bed by regulation in order to ensure that the individual concerned bas a reasonable opportunity to obtain access to the information, if necessary.
(2) Subject to subsection (1) and this Act, the Minister shall prescribe by regulation, guidelines for the retention and disposal of personal information held by a public authority.
15. (1) Where a document of a public authority to which access has been given under any enacttnent, containspersonal information of a person and that person claims that the information -
(a) is incomplete, incorrect or misleading; or
{b) not relevant to the purpose for which the document is held,
the public authority may, subject to Sijbsection (2), on the application of
that person, amend the information upon being satisfied Qf the claim
(2) An application under subsection (1) shall-
(a) be in writing; and
(b} as far as practicable, specify:
Storage and security of personal information
Retention and disposal of personal information
Correction of personal information
No.18
160
Privacy 2003
(i) the document or official document containing the record of personal information that is claimed to require amendment,
(ii) the information that is claimed to be incomplete, incorrect or misleading,
(fu) whether the information isclaimed to be inl'omplete, incorrect or misleading,
(iv) the applicant's reasons for so claiming, fnd
(v) the amendment requested by the applicant.
(3) To the extent that it is practicable to do so, the public authority shall, when making any amendment under this se ction to personal information in a document, ensure that it does notobliterate the text of the document as it existed prior to the amendment.
(4) Where a public authority is not satisfied with the reasons for an a ppIication under subsection (1), it may refuse to make any amendment to the information and inform the applicant of its refusal together with its reasons for so doing.
(5) A person aggrieved by a decision of a public authority to refuse an application for an amendment to information may make a complaint in writing to the Commissioner within twenty-eight days of the date of receipt of the communication of the refusal.
PARTW
PRIVACY COMMISSIONER
Office of Privacy 16. {I) For the purposes of this Act, there is hereby established
Commissioner the office of Privacy Commissioner.
(2) The Privacy Commissioner shall be appointed by the Governor-General upon consultation with the Pub]ic Service Commission, subject to such tenns and conditions as may bespecified in the instrument of appointment.
Tenure of office
17. (I) A person appointed as Privacy Commissioner shall hold office during good behaviour for a period ofthree years and shall, at the expiration of such period, be eligible for reappointment.
No.18
161
Privacy 2003
(2) A person appointed as Privacy Commissioner may resign from office by writing under bis or her handaddressed to the Governor General and shall in any case' vacate office on attaining the age of sixty five years.
{3) Tlle Ptj.vacy Commissioner may be removed from office only for inability to discharge the functionsof office (whether arising from infinnity of body or mind or any other cause) or for misbehaviour.
18. (1) No person shall be qualified for appointment to the office of
Privacy Commissioner if that person -
(a) isaMemberofParliament;
(b) is a member of a local authority;
(c) is an undischarged bankrupt; or
(d) has at any time been convicted of any offence involving dishonesty or moral turpitude.
(2) The Privacy Commissioner shall vacate office if any circumstances arise that, if he or she were not Privacy Commissioner, would cause him or her to be disqualified for appointment as such, by virtue of subsection (1) of this section.
Disqualification for appointment
19. A person appointed as Privacy Commissioner shall not Restriction on necessarily be a full-time officer and may be employed in any other employment capacity during any period in which the person holds office as Privacy
Commissioner.
20. (1) Where - FiJJing of vacancy
(a) a vacancy arises in the office of Privacy Commissioner; or
(b) by reason of illness, absence from the country or other sufficient cause, a person appointed as Privacy Commissioner is unable to perform his or herfunctions under this Act,
· No.18
162
Privacy · 2003
the Governor-General may, upon consultation with the Public Service Commission, appoint a suitable person to act in that office or perfonn those functions, as the case may be.
Functions of 21. (I) The functions of the Privacy Commissioner shall be -
Privac y
Commissioner (a) to monitor compliance by public authorities of the
provisions of this Act;
{b) to provide advice to public authorities on their ( obligations under the provisions, and generally on the operation, of this Act;
(c) to receive and investigate complaints about alleged violations of the privacy of persons and in respect thereof may makereports to complainants;
(d) to inquire generally into any matter, including any enactmentor law, or any practice, orprocedure, whether governmental ornon-governmental, or any technical development, if it appears to the Commissioner that the privacy of the individual is being, or may be, ged thereby;
(e) for the purpose of promoting the protection of individual privacy, to undertake educational programmes on theCommissioner's own behalf or in co-operation with otherpersons or authorities acting on behalf of the Commissioner;
(f) to make public statements in relation to any matter affectingthe privacy of the individual or of rny class of individuals;
(g} to receive and invite representations from me1.nbers of thepublic on any matter affecting the priva1 y of the individual;
(h) to consult and co-operate with other persons and bodies concerned with the privacy of the individual;
(i) to make suggestions to any person in relation to any matterthat concerns the need for , or the desirability
No.18
163
Privacy 2003
of, action by that person in the interests of the privacy of the individuals;
(J) to undertake research into, and to monitor developments in, data processing and computer technology to ensure that any adverse effects of such deve opments on the privacy of individuals are minin:ri ed, and to report to the Minister theresults of such research and monitoring;
(le) to examine any proposed legislation. including subordinate legislation or proposed policy of the Government that the Commissioner considers may affect the privacy of individuals, and to report to the Minister the results of thatexamination;
(1) to report with or without request to the Minister from time to time on any matter affecting the privacy of the individual, including the need for, or desirability of, talcing legislative, administrative, or other action to give protection or better protection to the privacy oft he individual;
{m) to report to the Minister from time to time on the desirability of the acceptance,by Saint Vincent and the Grenadines of any international instrument relating to the privacy of the individuals;
{n) to gather such information as in the opinion of the Commissioner will assist the Commissioner in discharging the duties and performing the functions of the Commissioner under this Act;
(o) to receive complaints from any decision of a public authority pursuant to section 15 (4) refusing an application for the amendment of information;
(p) to do anything incidental or conducive to the performance of any of thepreceding functions; and
No.18
164
Privacy 2003
Staff and funds
Receipt and investigation of complaints
(q) to exercise and perform such other functions, powers, and duties as are conferred or imposed on the Commissioner by or under this Act or any other enactment.
22. (1) There shall be appointed such officers and employees as may be necessary to enable the PrivacyCommissioner to discharge the duties and perform the functions of such Commissioner under this Act.
(2) Parliament shall appropriate annually, for the use of the Privacy Commissioner, such sums ofmoney as may be necessary for the proper exercise, performance and discharge, by the Commissioner, of his or her powers, duties and functions under this Act.
PARTIV
INVESTIGATIONOFCOMPLAINTS
23. (1) Subject to this Act, the Commissioner shall reciive and investigate a complaint from any person inrespect of any matter relating to -
Mode of
complaint
(a) the collection, amendment, retention or disposal of personal information by a public authority; or
{b) the use or disclosure of personal information held by n public authority;
(2) Nothing in this Act precludes the Commissioner from receiving and investigating complaints of a nature described in subsection
(1) that are submitted by a person authorised by the complainant to act
on behalf of the complainant, and reference to a complainant in any other section includes a reference to a person soauthorised.
(3) Where the Commissioner is satisfied that there are reasonable grounds to investigate a matter under this Act, the Commissioner may initiate a complaint in respect thereof.
24. (1) A complaint under this Act shall be n ade to the Commissioner in writing unless the Commi ;sioner authorises otherwise.
No.18
165
Privacy 2003
(2) The Commissioner shall give such reasonable assistance as is necessary inthe circllll)Stances to enable any person who wishes to make a complaint to theCommissioner, to put the complaint in writing.
25.
t
Before commencing an investigation of a complaint under this Notice of Act, the Conmtissioner shall notify the chiefexecutive officer of the public in ve 5dg a t ion authority concerned of the intention to carry out the investigation and
shall inform the chief executive officer of the substance of the complaint.
26. Subject to this Act, the Commissioner may determine the procedure to be followed in the dischargeof any duty or the performance of any fimction of the Commissioner under this Act.
Tl. (1) Every investigation of a complaint under this Act by the Commissioner shall be conducted in private.
(2) In the course of an investigation of a complaint under this Actby the Commissioner, thecomplainant and the chief executive officer of the public authority concerned shall be given an opportunity tomake representations to the Commissioner, but no one is entitled as of right to be present during a hearing or, to have access to, or to comment on, representations made to the Commissioner by any other person.
28. (1) The Commissioner has, in relation to carrying out of the investigation of any complaint under this Act, the ·power -
(a) to summon and enforce the appearance of persons before the Commissioner and compelthem to give oral or written evidence on oath and to produce such documents and things as the Commissioner deems requisite to the full investigation and consideration of the complaint, in the same manner and to the same extent as the High Court;
(b) to administer oaths;
(c) to receive and accept such evidence and other information, whether on oath or by affidavit or otherwise, as the Commissioner sees fit, whether or not the evidence or information is or wou]d be admissible in a court oflaw;
Regulation of procedure
Investigation in private
Powers of Privacy Commissioner in carrying out investigations
No.18
166
Privacy 2003
Findings and recommendations of Privacy Commissioner
(d) to enter anypremises occupied by any public authority on satisfying any securityrequirements of the :1uthority relating to the premises;
(e) to converse in private with any person in an,y· remises entered pursuant to paragraph (d)and otherwISe carry out therein such inquiries within the power of the
Commissioner under this Act as the Commissioner sees ri
fit; and
(f) to examine or obtain copies of or extracts from books or other records found in anypremises entered pursuant to paragraph (d) containing any matter relevant to theinvestigation.
(2) Notwithstanding any other Act of Parliament or any privilege under the law of evidence, theCommissioner may, during the investigation of any complaint under thisAct, examine any information recorded in any form held by a public authority and no information that the Commissioner may examine under this subsection may be withheld from the
. Commissioner on B!!Y grounds.
(3) Any document or things produced pursuant to thi. section by any person or public authorityshall be returned by the Commissioner within a reasonable time after a request is made to theCommissioner by that person or authority, but nothing in this subsection precludes the Commissioner from again requiring its production in accordance with this section.
29. (1) If, on investigating a complaint under this Act in recommendations in respect ofpersonal information, the Commissioner finds that the complaint is well-founded, the Commissioner shall provide to the Minister and the chief executive officer of the public authority that has control o fthe personal information with a report containing -
(a) the findings of the investigation and any recommendations that the Commissioner considers appropriate; and
No.18
167
Privacy 2003
(b) where appropriate, a quest that, _within a time specified therein, notice be given to th Commissioner of any action taken or proposed to be taken to implement the recommendations contained in the report or reasons why no such action has been or is proposed to be taken.
(2) The Commissioner shall, after investigating a complaint under this Act, report to the complainantthe results of the investigation, but where a notice bas been requested under paragraph (1) (b), no report shall bemade under this subsection until the expiration of the time within which the notice is to be given to the. Commissioner.
(3) Where anotice has been requested under paragraph (1) (b) but no such notice is received by the Commissioner within the time specified therefore or the action described in the notice is , in the opinion of theCommissioner, inadequate or inappropriate or will not be taken in a reasonable time, the Commissioner shall so advisethe complainant in his report under subsection (2) and may include in the report such comments on the matter as he thinks fit.
(4) Where, fallowing the investigation of a c omplaint1 the Commissioner has maderecommendations to a public authority under subsection (1), and the decision of the public authority is -
(a) not to implement the recommendations; or
(b) to implement the recommendations, but, in the opinion of the Commissioner, not within areasonable time or in a manner that is inadequate or inappropriate,
the complainant is entitled to seek judicial review of the decision of the public authority.
30. (1) The Commissioner may, from time to time at the discretion of the Commissioner, carry out aninvestigation in respect of personal information under the control of a public authority to ensure compliance withsections 7 to 14 of this Act.
(2) Sections 25 to 28 apply, where appropriate and with such modifications as the circumstancesrequire, in respect of investigations carried out under subsection (1).
Review of compliance with certain provisions
No.18
168
Privacy 2003
Report to Parliament
Security Requirements
Confidentiality
Protection of Commissioner, etc. from criminal
or civil proceedings
{3) If, following an investigation under subsection (1). the Commissioner considers that a public authority has not complied with sections 7 to 14 of this Act, the Commissioner shall provide the Minister andthe chief executive officer of the authority with a report containing the findings of the investigation and any recommendations that the Commissioner considers appropriate.
(4) Any report made by the Commissi ner under su ,section
(3) may be included in a report made to Parliament pursuant to this Act. (
31. The Commissioner shall, as soon as practicable after t1e thirty first of December of each year, prepare a report on the activities of the office during that year and cause a copy of the report to be laidbefore Parliament.
32. The Commissioner and every person acting on behalf or under the direction of the Commissionerwho receives or obtains information relating to any investigation under this Act or any other Act of Parliament shall, with respect to the use of that information. satisfy any security requirements applicable to, and talceany oath of secrecy required to be taken by, persons who nonnally have access to and use of that information.
33. Subject to this Act, the Commissioner and every person acting on behalf or under the direction ofthe Commissioner shall not disclose any information that comes to their knowledge in carrying out dutiesand performing functions under this Act.
34. (I) Notwithstanding the provisions of section 37, no ·riminal or civil proceedings lie against theCommissioner, or against an/ person acting on behalf or under the direction of the Commissioner, for.,nything done, reported or s aid in good faith i n the course oft he exercise or perfonnance or purported exercise, discharge, or perfonnance of any power, duty or function of the Commissioner under this Act.
(2) For the purpose of any law relating to libel or slander,
(a) anything said, any information supplied or any document or thing produced in goodfaith in the course of an investigation carried out by or on behalf of the Commissionerunder this Act is absolutely privileged; and
No.18
169
Privacy 2003
(b} any report made in good faith by the Commissioner under this Act is absolutely privileged.
,
35. (1) No person shall obstruct the Commissioner or any person Obstruction
acting on behalf or under the direction of the Commissioner in the discharge andperformance of the Commissioner's duties and functions under this Act
J (2) Every person who contravenes this section is guilty of an offence andliable on summary conviction to a fine not exceeding five thousand dollars.
PARTV
MISCELLANEOUS
36. The chief executive officer of a public authority may, subject to section 38 (2) (b), by order,designate one or more officers or employees of that authority to exercise, discharge or perform any of the powers, duties or functions of the chief executive officer under this Act that are specified in the order.
37. In any civil or criminal proceedings against a public authority for the disclosure of any personalinformation pursuant to this Act, or for any consequences that flow from that disclosure, it shall be anabsolute answer that such disclosure was made in good faith.
38. (1) The Minister may make regulations for giving effect to the purpose of this Act and forprescnoing anything required or authorised by this Act to be prescribed.
(2) Notwithstanding the generality of subsection (1), regulations made under this section may prescribe •
(a) guidelines for the disposal of personal information held by a public authority;
(b) officers who may make decisions on behalf of a public authority.
Delegation by the chief executive officer of public authority
Proceedings where disclosure was in good faith
Regulations
. No.18
170
Privacy 2003
(3) All regulations made under this Act shall be laid before Parliament as soon as may be afterthe making thereof and shall be subject to negative resolution.
Passed in the House of Assembly this 27th day of June, 2003.
NICOLEHERBERT
Clerk of the House of Asseml ly (Ag.)
Printed by the Government Printer at the Government Printing Office, Kingstown, St Vmcent and the Grenadines.
2003 [Price $12.00]