Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1697647408854.pdf (Bahamas)
Policy Statement and Guidance Complaint Handling First Floor Cecil Wallace-Whitfield Centre West Bay Street P.O.

Box N-3017 Nassau, N.P.
Bahamas Telephone: (242) – 702-1552 / 702-1534 Fax: (242) – 327-7501 E-mail dataprotection@bahamas.gov.bs Website www.bahamas.gov.bs/dataprotection Data Protection (Privacy of Personal Information) Act, 2003 May, 2012 Office of the Data Protection Commissioner Policy Statement and Guidance on Complaint Handling ______________________________________________________________________________ Scope Background This Policy Statement and Guidance Document applies to all persons and businesses (“Data Controllers”), who collect and process personal data, which fall within the scope of Data Protection (Privacy of Personal Information) Act 2003.
Structure Part I introduces the paper.

It seeks to explain why such a paper is considered necessary and provides a basic overview of the policy.

Part II is the Commissioner’s stated policy on complaint handling.

The policy is divided into the following described sections: 1.

Lodge your complaint with the Data Controller first 2.

When to make your complaint to the Commissioner 3.

How to make a complaint to the Commissioner 4.

The nature of the Commissioner’s role in complaint handling 5.
How the Commissioner will handle your complaint 6.

Action the Commissioner can take and remedies available 7.

Alternative solutions Part I: Introduction The Office of the Data Protection Commissioner (“the Commissioner”) is responsible for the supervision of all persons and businesses with regard to promoting the observance of the data protection principles and ensuring compliance with the provisions of the Data Protection (Privacy of Personal Information) Act 2003.
The Act applies to a data controller in respect of any data only if: the data controller is established in the Bahamas and the data are processed in the context of that establishment; or the data controller is not established in The Bahamas but uses equipment in The Bahamas for processing the data otherwise than for the purpose of transit through The Bahamas.

There are further specific responsibilities of the above classes of the controller as denoted in Section 4 of the Act.
Office of the Data Protection Commissioner Policy Statement and Guidance on Complaint Handling ______________________________________________________________________________ Section 5 of the Act sets out the exclusions to the above (Section 4) and relates to matters of National Security; and/or safeguarding the security of The Bahamas; Parliamentary deliberations etc.
the public interest; pending civil, criminal or international legal assistance procedures; and information kept by an individual for a personal, family or household affairs or kept only for his recreational purposes.

Part II: Policy Statement and Guidance on Complaints From time to time, the Commissioner may receive complaints about the way Data Controllers have handled information personal to the individual.
This document explains the Commissioner’s policy towards such complaints, and how they will be dealt with.

1.

Lodge your complaint with the Data Controller first 1.1 If you have a complaint about the way a Data Controller has handled information personal to you, we would recommend that you first try to resolve the complaint directly with the Data Controller.
Many businesses have a Data Protection Officer who is an employee of the company (perhaps the Human Resources Manager) and seeks to ensure that the business remains compliant with the data protection principles and the Act.

However, complaints should be addressed in the first instance to the senior management of the company concerned.

Complaining first to the Data Controller allows the business an opportunity to put things right at an early stage.
1.2 If lodging your complaint with the institution first is either impractical or inappropriate, the Commissioner will be happy to listen to your complaint 2.

When to make your complaint to the Commissioner 2.1 If you are not happy with the way in which the institution has dealt with your complaint, or if you have not received a response within 21 days after making your complaint, you may wish to seek the assistance of the Commissioner.
2.2 We will check to ensure that the institution has complied with the data protection principles with regard to the processing of personal data relating to you, as well as making sure that the institution has handled your complaint in a proper manner.

2.3 The Commissioner will normally require copy documentation or evidence to support your complaint.
Office of the Data Protection Commissioner Policy Statement and Guidance on Complaint Handling _____________________________________________________________________________ 3.

How to make your complaint to the Commissioner 3.1 You should put your complaint in writing, with full details of the nature of your complaint, your name, and how we may contact you.

You should also include copies of any relevant correspondence that may assist us in our investigations.
3.2 We do not normally deal with verbal or anonymous complaints; however, if your complaint relates to the generic processes of an institution as opposed to a specific complaint in relation to you, we may consider an investigation.

Please contact us by telephone if you have any individual difficulties which might prevent you from making a written complaint.
3.3 Alternatively, you may download the relevant form from our website at www.bahamas.gov.bs/dataprotection 3.4 In order to progress your complaint, we will often need to disclose details of your complaint to the institution concerned.

We will therefore also need your written consent for us to disclose details of your complaint to the institution.

The form referred to in paragraph 3.3 above includes a section on customer consent.
3.5 If you do not wish to use the website form to make a complaint, you may write to us at the following address: Office of the Data Protection Commissioner First Floor Cecil Wallace-Whitfield Centre West Bay Street P.O.

Box N- 3017 Nassau, N.P., Bahamas.

Or email us at dataprotection@bahamas.gov.bs 4.


The Nature of the Commissioner’s role in complaint handling 4.1 The Commissioner’s primary duty is to promote the observance of the data protection principles by Data Controllers to ensure that personal data relating to individuals are afforded a high level of protection.

4.2 Summary proceedings for an offence under this Act may be brought and prosecuted by the Commissioner.
Where a person is convicted of an offence under this Act, they shall be liable to a fine, and in some cases the Court may order that the data be forfeited, erased or destroyed.

4.3 We expect Data Controllers to have satisfactory systems and controls in place to enable them to deal with customer complaints in a thorough and proper manner.
Office of the Data Protection Commissioner Policy Statement and Guidance on Complaint Handling ______________________________________________________________________________ 4.4 We will therefore try to ensure that the Data Controller handles your complaint properly.

It is important to note however that we do not have the power to order an institution to pay you compensation.

Only the Court is able to grant payments of compensation, and then only in certain circumstances as prescribed by Law.

5.
5.

How will the Commissioner handle your complaint?

5.1 All complaints will be treated in strict confidence, although as already previously stated, and with your prior consent, we may need to disclose details of your complaint to the institution concerned.

5.2 Upon receipt of a written complaint, we will issue an acknowledgement to you, normally within three working days.
5.3 Provided you are content for us to contact the institution concerned, we will write to the institution to obtain any further documentary evidence that will assist the investigation and will seek their comments and/or explanation as to the circumstances surrounding the complaint.

Alternatively, we may meet with representatives of the institution to discuss the complaint and attempt to broker a mutually accepted solution.
We ask the institution to provide this initial response within 21 days of writing to them.

5.4 We will review the response provided in order to ensure that:  The Data Controller has handled your complaint properly and has followed its own complaint handling procedures; and  The Data Controller has compiled with the data protection principles and its regulatory requirements as set out in the Act.
 Upon the conclusion of our investigation, we will revert to you with the results of our investigation, together with any action we propose to take, if any.

6.

Action we can take and remedies available 6.1 In the light of complaint, or a series of complaint, the Commissioner may decide to take action against a Data Controller, for instance by requiring it to modify its procedures for the handling of personal data.
These would include complaints that indicate that a Data Controller has breached the data protection principles or the Law.

Office of the Data Protection Commissioner Policy Statement and Guidance on Complaint Handling ______________________________________________________________________________ 6.2 In cases of regulatory concerns, we will follow up with the institution to establish the facts and, if necessary, require remedial action to be taken.
We will advise you of the results of our investigations and any action we decide to take.

In the cases of complaints where more serious concerns are highlighted, the Commission is able to take the following action: Enforcement Notices The Commissioner has a power under Section 16 of the Act to issue Enforcement Notices in circumstances where the Commissioner is satisfied that a data controller has contravened or is contravening any of the data protection principles.
The Commissioner may require the data controller to do one or both of the following, to ensure future compliance with those principles contravened.

a) To take specified steps within a specified time, or to refrain from taking specified steps after a specified time; or b) To refrain from processing any personal data, or any personal data of specified description, or to refrain from processing them for a specified purpose or in a specified manner, after a specified time.
(Twenty-one days is the usual time frame referred to above).

There is provision to appeal such notices under Section 24 of the Act.
Information Notices Section 18 of the Act gives the Commissioner the power to issue Information Notices, where the Commissioner: a) Has received a request under Section 8 in respect of any processing of personal data; or b) Reasonably requires any information for the purpose of determining whether a data controller has compiled, or is complying, with the data protection principles.
The Commissioner may serve a notice on the relevant Data Controller (or on a data processor who processes data on behalf of the Data Controller; being data or processing relevant to the request or the determination, as the case may be), requiring the person served with the notice to furnish The Commissioner with specified information relating to the request or to compliance with the principles.
Office of the Data Protection Commissioner Policy Statement and Guidance on Complaint Handling ______________________________________________________________________________ Special Information Notices There remains an avenue to appeal against the various forms of Notice under the provisions of Section 24 of the Act.
However, no enactment or rule of law prohibiting or restricting the disclosure of information shall preclude a person from furnishing to the Commissioner any information that is necessary or expedient for the performance by the Commissioner of his functions.
Please note that the above shall not apply to information that in the opinion of the Minister or the Minister for National Security is, or was, kept for the purpose of safeguarding the security of The Bahamas or information that is privileged form disclosure in the proceedings in any court.

7 Alternative Solution 7.1 There may be occasions where following our investigations and subsequent action, you are still not satisfied that your complaint has been resolved.
Should this prove to be the case and we are unable to offer any further assistance, you would have the option to explore:-  Independent Legal Advice You may wish to seek independent legal advice from your own lawyer, should you wish to pursue a claim against the institution.

Office of the Data Protection Commissioner First Floor Cecil Wallace-Whitfield Centre E-mail: dataprotection@bahamas.gov.bs P.O.

Box N- 3017 Nassau, N.P., Bahamas.

Telephone: (242) -702-1552 Fax: (242) -327-7501