by Linda Straker
- Assented by Deputy Governor-General Dessima William on 9 May 2023
- Published in extraordinary Government Gazette on 10 May 2023
- Act applies to an individual who processes or has control over or authorises processing any personal data regarding commercial transactions in Grenada
A date of effect was not included for the controversial 2023 Data Protection Bill when it was published in an extraordinary gazette of the Government Gazette on 10 May 2023. That publication is the penultimate step for the Bill to become law.
Governor-General Dame Cecile La Grenade is out of state. Assented by Deputy Governor-General Dessima William on 9 May 2023, the Data Protection Act is an Act to promote the protection of personal data processed by public and private bodies, to provide for the establishment of the Information Commission and related matters.
“This Act shall come into operation on a day to be appointed by the Minister by Order in the Gazette, and the Minister may appoint different dates for different provisions of this Act,” said Section 2 of the legislation, which the Lower House of Parliament approved on 14 March 2023. The Upper House approved it on 6 April 2023.
According to the legislation, which went through several amendments in both Houses, the objects of the Act are to safeguard personal data processed by public bodies and private bodies in an era in which technology increasingly facilitates the processing of personal data by balancing the necessity of processing personal data by public bodies and private bodies; safeguard personal data from unlawful processing by public bodies and private bodies, to promote transparency and accountability in the processing of personal data.
According to the gazetted version, the Act applies to an individual who processes or has control over or authorises processing any personal data regarding commercial transactions in Grenada. This includes people who are residents of Grenada or using networking services based in Grenada.
“This Act applies to a person in respect of personal data if– (a) the person is established in Grenada and the personal data is processed, whether or not in the context of that establishment, by that person or any other person employed or engaged by that establishment; or (b) the person is not established in Grenada, but uses equipment or network services in Grenada for processing the personal data otherwise than for the purposes of transit through Grenada,” explained the legislation.
Exemption from the Act includes personal data processed for the prevention or detection of crime or for investigations; the apprehension or prosecution of offenders; the assessment or collection of any tax or duty or any other imposition of a similar nature; or for the Proceeds of Crime Act, and other legislation enacted for anti-money-laundering and combating terrorist financing shall be exempted from the General Principle, the Notice and Choice Principle, the Disclosure Principle, the Access Principle, and other related provisions of the legislation.
Personal data processed only for journalistic, literary, or artistic purposes shall be exempted from the General Principle, the Notice and Choice Principle, the Disclosure Principle, the Retention Principle, the Data Integrity Principle, the Access Principle, and other related provisions of the Act. This is provided that the processing undertaken is with a view to publication by an individual of the journalistic, literary or artistic material, and the data user reasonably believes that the publication would be in the public interest, taking into account the special importance of public interest in freedom of expression.
If an individual violates the Data Protection Bill, the summary penalty is a maximum of EC$50,000 or 3 years imprisonment, while the indictable penalty is EC$100,000 or 5 years imprisonment.
The summary penalty for a corporate body found guilty of violating the clauses of the legislation is EC$250,000, while the indictable penalty is no more than EC$500,000.
