37
No. 2 ]

Data Protection (Amendment) Act
SAINT LUCIA
No. 2 of 2015
ARRANGEMENT OF SECTIONSSections
1. Short title
2. Interpretation
3. Amendment of section 1
4. Amendment of section 2
5. Amendment of section 5
6. Amendment of section 6
7. Amendment of section 7
8. Amendment of section 11
9. Insertion of section 12A
10. Amendment of section 34
11. Amendment of section 37
12. Amendment of section 46
13. Repeal of section 48
14. Amendment of section 54
15. Insertion of section 57A
16. Amendment of section 67
17. Amendment of section 71
18. Amendment of section 72[ 2015.

38
No. 2 ]

Data Protection (Amendment) Act[ 2015.

39
No. 2 ]

Data Protection (Amendment) Act[ 2015.

I ASSENT[L.S.]PEARLETTE LOUISY,Governor-General.
March 31, 2015.

SAINT LUCIA_______
No. 2 of 2015
AN ACT to amend the Data Protection Act, No. 11 of 2011.

[ 13th April, 2015 ]BE IT ENACTED by the Queen’s Most Excellent Majesty, byand with the advice and consent of the House of Assembly and theSenate of Saint Lucia, and the authority of the same, as follows:

40
No. 2 ]

Data Protection (Amendment) Act[ 2015.

Short title

1. This Act may be cited as the Data Protection (Amendment)
Act, 2014.
Interpretation

2. In this Act, “principal Act” means the Data Protection Act,
No.11 of 2011.
Amendment of section 1

3. Section 1 of the principal Act is amended by (a) deleting subsection (2) and by substituting the following “(2) Subject to subsection (3), this Act shall come into force
on a date to be fixed by the Minister by Order published inthe Gazette.”; and(b) by inserting immediately after subsection (2) the following
new subsection –“(3) The Minister may fix different dates for the coming into
force of different Parts or sections of this Act.”.
Amendment of section 2

4. Section 2 of the principal Act is amended by(a) deleting the definition of “data controller” and by substituting
the following ““data controller” means a person who, either alone or withothers, determines how personal data is processed;”; and(b) inserting the following definition in its correct alphabeticalsequence –““privacy impact assessment” means an assessment that isconducted to determine if a proposed enactment, system,project, programme, activity or other function meets therequirements of the Data Protection Principles in Schedule2;”.

41
No. 2 ]

Data Protection (Amendment) Act[ 2015.

Amendment of section 5

5. Section 5 of the principal Act is amended by deleting subsection(2) and by substituting the following –“(2) A person shall be qualified to be appointed as the Data
Commissioner under subsection (1) if the person has a minimumof six years training or experience in any of the following fields(a) law;(b) economics;(c) finance;(d) information management;(e) information and communication technology;(f) accounting; or(g) human resource management.”.
Amendment of section 6
6. Section 6 of the principal Act is amended in subsection (2) bydeleting the word “budget” and by substituting the word “fund”.
Amendment of section 7
7. The principal Act is amended by deleting section 7 and by
substituting the following –“7. The Commissioner shall not hold any other office ofemployment which is likely to conflict with the discharge of hisor her functions as Commissioner.”.
Amendment of section 11
8. Section 11 of the principal Act is amended in subsection (3)by –(a) inserting a full stop immediately after the word “dollars”;
and(b) deleting the words “or to imprisonment for a term notexceeding six months or to both.”.

42
No. 2 ]

Data Protection (Amendment) Act[ 2015.

Insertion of section 12A

9. The principal Act is amended by inserting immediately after
section 12 the following new section “Privacy impact assessment

12A. (1) The Commissioner may require a department ofgovernment to prepare a privacy impact assessment if the initiatives
covered by the privacy impact assessment are of a wide scope, or use
personal data of a nature that may require the protection of the personal
data of an individual.
(2) A privacy impact assessment shall be in the prescribed formand shall be submitted to the Commissioner for approval.
(3) Where a privacy impact assessment is submitted in accordancewith subsection (2), the Commissioner shall evaluate the privacy impact
assessment in accordance with the Data Protection Principles set out
in Schedule 2 and where necessary, make recommendations to thedepartment of government for revision and amendment of the privacy
impact assessment.
(4) A privacy impact assessment approved by the Commissioner
shall be implemented by the department of government in the manner
directed by the Commissioner.”.
Amendment of section 34

10. Section 34 of the principal Act is amended in subsection (5)by –(a) inserting a full stop immediately after the word “dollars”;
and(b) deleting the words “or to imprisonment for a term notexceeding six months.”.
Amendment of section 37

11. Section 37 of the principal Act is amended –(a) in subsection (1), by deleting paragraph (c) and by substituting
a new paragraph (c) as follows “(c) medical research;”; and43
No. 2 ]

Data Protection (Amendment) Act[ 2015.

(b) by inserting a new subsection (3) as follows –“(3) Where –(a) an enactment specifically governs the processing ofsensitive personal data for health purposes; and(b) there is an inconsistency between this Act and theother enactment,that other enactment shall prevail.”.
Amendment of section 46

12. Section 46 of the principal Act is amended –(a) by deleting subsection (1) and by substituting the following “(1) A person shall not act as a data controller unless that
person is registered as a data controller in accordance withsection 47.”;(b) by deleting subsection (2) and by substituting the following –“(2) A person who, without reasonable excuse, acts as a datacontroller without being registered under this Act, commits
an offence and is liable on summary conviction to a fine notexceeding ten thousand dollars.”; and(c) by inserting immediately after subsection (2) a new subsection(3) as follows –“(3) The Minister may, by Order, exempt a data controller
from complying with subsection (1) if the data controller isregistered under another Act.”.
Repeal of section 48

13. The principal Act is amended by repealing section 48.
Amendment of section 54

14. Section 54 of the principal Act is amended by inserting
immediately after subsection (5) a new subsection (6) as follows –“(6) Where a data controller does not comply with a request madeunder section 52 by a data subject or relevant person, the datacontroller shall notify the Commissioner and the data subject orrelevant person, of the non-compliance.”.

44
No. 2 ]

Data Protection (Amendment) Act[ 2015.

Insertion of section 57A

15. The principal Act is amended by inserting immediately after
section 57 the following new section “Employee’s protection

57A. (1) An employer shall not, dismiss, suspend, demote,discipline, harass or otherwise disadvantage an employee or deny that
employee a benefit where –(a) the employee, on reasonable belief has –(i) notified the Commissioner that the employer or any otherperson has contravened or is about to contravene this Act;(ii) done or stated the intention of doing anything that isrequired to be done in order to avoid having any person
contravene this Act; or(iii) refused to do or stated the intention of refusing to do
anything that is in contravention of this Act;(b) the employer believes that the employee will do anything
described in paragraph (a).
(2) Where an employer contravenes subsection (1), an employee
is entitled to lay a complaint before the Commissioner for determinationof the matter.
(3) Notwithstanding subsection (2), where an employee isdismissed, suspended, demoted, disciplined, harassed or otherwise
disadvantaged or denied a benefit in subsection (1), the matter shall betreated as an unfair dismissal in accordance with section 131 of theLabour Act, No. 37 of 2006.
(4) The Commissioner shall, in conducting deliberations orhearings in relation to an investigation in private under section 28,exempt an employee who acts in accordance with subsection (1)(a)from making further representations on any contravention of this Act.”.
Amendment of section 67

16. The principal Act is amended by deleting section 67 and bysubstituting the following –45
No. 2 ]

Data Protection (Amendment) Act[ 2015.

“67. Personal data that is processed by an individual is exempt
from the provisions of this Act where such processing is donesolely for a purpose related to the personal, family or household
affairs of that individual.”.
Amendment of section 71

17. Section 71 of the principal Act is amended in paragraph (2)(a) by –(a) inserting a full stop immediately after the word “dollars”;
and(b) deleting the words “or to imprisonment for a term notexceeding six months or to both.”.
Amendment of section 72

18. Section 72 of the principal Act is amended in paragraph (a)by–(a) inserting a full stop immediately after the word “dollars”;
and(b) deleting the words “or to imprisonment for a term notexceeding six months, or to both.”.
Passed in the House of Assembly this 10th day of March, 2015.
PETER I. FOSTER,
Speaker of the House of Assembly.
Passed in the Senate this 12th day of March, 2015.
CLAUDIUS J. FRANCIS,President of the Senate.

SAINT LUCIA
PRINTED BY THE NATIONAL PRINTING CORPORATIONCASTRIES
2015[ Price : $4.50 ]46
No. 2 ]

Data Protection (Amendment) Act[ 2015.