First

SessionTenth Parliament
Trinidad and Tobago

Republicof

REPUBLIC OF TRINIDAD AND TOBAGO

Act No. 13 of 2011

[L.S.]AN ACT to provide for the protection of personalprivacy and information[Assented to, 2011]

ENACTED by the Parliament of Trinidad and Tobago as Enactment
follows:
PART IPRELIMINARY
1. (1) This Act may be cited as the Data Protection Short title andcommencement
Act, 2011.

2

No. 13

Data Protection

2011(2) This Act shall come into operation on such day
as is fixed by the President by Proclamation.
Interpretation

2. In this Act—
“Commissioner” means the Information
Commissioner appointed under section 8;“Court” means the High Court of Trinidad andTobago;“data” means any document, correspondence,
memorandum, book, plan, map, drawing,
pictoral or graphic work, photograph, film,
microfilm, sound recording, videotape,machine-readable record and any otherdocumentary material, regardless ofform or characteristics, and any copy of
those things;“data matching” means the comparison,
whether naturally or by means of any
electronic or other device, of any data that
contains personal information about
individuals with other documents containing
personal information about individuals forthe purpose of producing new forms of
information about individuals;“enterprise” means a partnership or body
(corporate or unincorporated) engaged inbusiness;“Head of a Public Body” means the President,
the Prime Minister, the President of the
Senate, the Speaker of the House ofRepresentatives, the Chief Administratorof the Tobago House of Assembly, the Chief
Secretary of the Tobago House of
Assembly, the Permanent Secretary of a
Ministry, the Head of a Government
Department, the Head of the Judiciary,
Chief Executive Officer of an enterprise or
the Chairman of an agency or where such
title does not exist, the person who
performs such duties;

No. 13

Data Protection

2011“health care body” means a regional healthauthority established under the Regional
Health Authorities Act, a hospital, extended Chap. 29:05
care facility, clinic, psychiatric hospital as
defined under the Mental Health Act, a Chap. 28:02
private hospital as defined under thePrivate Hospitals Act, and similar bodies Chap. 29:03
licensed by the Minister with responsibility
for health;“individual” means a natural person;“information sharing agreement” means anagreement that sets conditions for one ormore of the following:(a) the exchange of personal information
between a public body and aperson, a group of persons or an
organization;(b) the disclosure of personal information
by a public body to a person, agroup of persons or an organization;or(c) a collection of personal information
by a public body from a public body,a person or a group of persons of anorganization;“Minister” means the Minister to whom
responsibility for data protection is
assigned and “Ministry” shall be construed
accordingly;“personal information” means information
about an identifiable individual that isrecorded in any form including—(a) information relating to the race,
nationality or ethnic origin,religion, age or marital status of
the individual;

3

4

No. 13

Data Protection

2011(b) information relating to theeducation or the medical, criminalor employment history of theindividual or information relating
to the financial transactions inwhich the individual has been
involved or which refers to theindividual;(c) any identifying number, symbol orother particular designed to identify
the individual;(d) the address and telephone contact
number of the individual;(e) the name of the individual where it
appears
with other personal
information relating to theindividual or where the disclosureof the name itself would reveal
information about the individual;(f) correspondence
sent
to
an
establishment by the individualthat is explicitly or implicitly of a
private or confidential nature, andany replies to such correspondence
which would reveal the contents of
the original correspondence;(g) the views and opinions of any otherperson about the individual; or(h) the fingerprints, deoxyribonucleic
acid, blood type or the biometriccharacteristics of the individual;“personal information bank” means a collectionof personal information that is organizedor retrievable by the name of the individual
or by an identifying number, symbol or otherparticulars assigned to the individual;

No. 13

Data Protection

2011“premises” includes land or any vessel, vehicle
or aircraft and references to the occupier or
any premises include references to theperson in charge of the land or any vessel,
vehicle or aircraft;“privacy impact assessment” means anassessment that is conducted to determine if
a proposed enactment, system, project,programme or activity meets therequirements of the General Privacy
Principles of section 6;“public body” means—(a) the Office of the President;(b) Parliament,a
Joint
SelectCommittee of Parliament or acommittee of either House of
Parliament;(c) the Court of Appeal, the High
Court, the Industrial Court, theTax Appeal Board or any court ofsummary jurisdiction;(d) the Cabinet as constituted under
the Constitution, a Ministry or
Department, Division or Agency ofa Ministry;(e) the Tobago House of Assembly, theExecutive Council of the Tobago
House of Assembly or a division of
the Tobago House of Assembly;(f) a municipal corporation establishedunder the Municipal Corporations
Chap. 25:04
Act;(g) a statutory body, responsibility forwhich is assigned to a Minister ofGovernment;

5

6

No. 13

Data Protection

2011(h) a company incorporated under thelaws of Trinidad and Tobago that is
owned and controlled by the State;(i) a Service Commission establishedunder the Constitution or otherwritten law; or(j) a body corporate or an unincorporated entity in relation to any functionthat it exercises on behalf of theState, or which is supported, directly
or indirectly by Government funds
and over which Government is in aposition to exercise control;“record” means recorded information collected,
created or received in the initiation,
conduct or completion of an activity andthat comprises sufficient content, context
and structure to provide evidence or proofof that activity or transaction;“sensitive personal information”
information on a person’s–

means(a) racial or ethnic origins;(b) political affiliations or trade union
membership;(c) religious beliefs or other beliefs of asimilar nature;(d) physical orcondition;

mentalhealthor(e) sexual orientation or sexual life; or(f) criminal or financial record;

No. 13

Data Protection

2011

7

“sensory disability” means a disability that
relates to sight or hearing; and“service provider” means a person retained
under a contract to perform services of apublic body.
3. This Act binds the State.

Act binds the State

4. The object of this Act is to ensure that protection is Object of the Act
afforded to an individual’s right to privacy and the rightto maintain sensitive personal information as private
and personal.
5. This Act shall not—Inapplicability of Act(a) limit information available by law to a party
in any proceeding;(b) limit the power of a court or tribunal tocompel a witness to testify or to compel the
production of a document or other evidence;or(c) apply to notes prepared by or for an individual
presiding in a court of Trinidad and Tobago orin a tribunal if those notes are prepared forthat individual’s personal use in connection
with the proceedings.
6. The following principles are the General Privacy General
Privacy Principles
Principles which are applicable to all persons who
handle, store or process personal information belonging
to another person:(a) an organization shall be responsible for the
personal information under its control;(b) the purpose for which personal informationis collected shall be identified by theorganization before or at the time ofcollection;

8

No. 13

Data Protection

2011(c) knowledge and consent of the individual are
required for the collection, use or disclosureof personal information;(d) collection of personal information shall be
legally undertaken and be limited to what isnecessary in accordance with the purpose
identified by the organization;(e) personal information shall only be retained
for as long as is necessary for the purpose
collected and shall not be disclosed for
purposes other than the purpose ofcollection without the prior consent of theindividual;(f) personal information shall be accurate,complete and up-to-date as is necessary forthe purpose of collection;(g) personal information is to be protected bysuch appropriate safeguards having regard
to the sensitivity of the information;(h) sensitive personal information is protectedfrom processing except where otherwise
provided for by written law;(i) organizations are to make available toindividuals documents regarding their policies
and practices related to the management of
personal information except where otherwise
provided by written law;(j) organizations shall, except where otherwise
provided by written law, disclose at therequest of the individual, all documents
relating to the existence, use and disclosureof personal information, such that theindividual can challenge the accuracy andcompleteness of the information;

No. 13

Data Protection

2011(k) the individual has the ability to challenge
the organization’s compliance with theabove principles and receive timely andappropriate
engagement
fromtheorganization; and(l) personal information which is requested tobe disclosed outside of Trinidad and Tobago
shall be regulated and comparable
safeguards to those under this Act shallexist in the jurisdiction receiving thepersonal information.
PART II
OFFICE OF THE INFORMATION COMMISSIONER
7. There is hereby established a body corporate to be Office of the
known as the Office of the Information Commissioner. Information
Commissioner
8. (1) There shall be an Information Commissioner Appointment of(hereinafter referred to as “the Commissioner”) who Information
Commissioner
shall—(a) be the head of the Office of the Information
Commissioner;(b) be appointed by the President; and(c) possess the qualifications and experience
set out in subsection (2).
(2) A person appointed to be the Information
Commissioner under subsection (1) shall be an attorneyat-law within the meaning of the Legal Profession Act Chap. 90:03
with at least ten years standing and shall have training
or experience in economics, finance, information security,
technology, audit or human resource management.
(3) A person appointed under subsection (1) shallhold office for five years and may be reappointed.

910No. 13

Data Protection

2011

Schedule(4) A person appointed under subsection (1) shall,
before he performs the functions of Information
Commissioner, take and subscribe to the oath of office
set out in Part A of the Schedule.

Powers ofInformation
Commissioner

9. (1) The Commissioner shall monitor the administration of this Act to ensure its purposes are achieved.
(2) In carrying out his powers under subsection(1), the Commissioner may—(a) conduct audits and investigations to ensurecompliance with any provision of this Act;(b) advise on the privacy protection implicationsof proposed legislative schemes or government
programmes and receive representations fromthe public concerning data protection andprivacy matters;(c) after hearing representations from the Headof a Public Body or an organization subject
to a mandatory code of conduct and who may
be engaged in processes that may be incontravention of this Act, order the public
body or organization to cease collection
practices or destroy collections of personal
information that contravene this Act;(d) authorize the collection of personal information
otherwise than directly from the individualin appropriate circumstances;(e) make orders regarding the reasonablenessof fees required by an organization subject tothis Act;(f) authorize data matching by a public body or
public bodies;(g) make orders, including such terms andconditions as the Commissioner considers
appropriate, following an appeal orcomplaint filed by an individual pursuant tosection 58, 78 or 79A;

No. 13

Data Protection

2011(h) make orders regarding compliance with the
General Privacy Principles set out insection 6 by a public body or an organization
subject to a mandatory code of conduct;(i) publish guidelines regarding compliancewith the Act, including but not limited to
guidelines on the development of industry
codes of conduct, firm compliance policies,
procedures for handling complaints, guidelines
dealing with conflict of interest for industry
bodies or individuals who mediate or deal withcomplaint resolution, guidelines dealing withsecurity of information and information
systems, and guidelines for information
sharing agreements or data matching
agreements;(j) exercise his corporate powers in relation
thereto in such manner as he thinks fit, in
accordance with this Act;(k) make such administrative arrangements as
may be necessary for the proper conduct of
his functions; and(l) exercise such other powers as may be
assigned to him under any other writtenlaw.
10. The Commissioner appointed under section 8 Functions ofInformation
shall—
Commissioner(a) promote the development of codes of conduct
for guidance as to good practice;(b) promote the adherence to good practices by
persons subject to this Act;(c) disseminate information about this Act;(d) monitor compliance with this Act;

11

12

No. 13

Data Protection

2011(e) co-operate with counterparts in otherjurisdictions to promote the protection of
personal privacy in the public and private
sectors;(f) carry out special studies or research regarding
privacy or related issues;(g) bring to the attention of the head of the
public body or organization subject to a
mandatory code of conduct any failure tomeet the standards imposed by the General
Privacy Principles set out in section 6 or the
responsibilities established by Part III andPart IV of this Act;(h) issue public reports on the status ofcompliance with this Act;(i) review and approve privacy impact
assessments as required by this Act; and(j) exercise such other functions that may be
assigned to him under any other written
law.
Deputy Information
Commissioner

11. (1) The President may appoint no more than two
Deputy Information Commissioners who shall meet thesame requirements for qualifications or experience as
specified for the Information Commissioner under
section 8.
(2) Where more than one Deputy Information
Commissioner is appointed the President shall specify
which function each respective Deputy Information
Commissioner shall perform either under this Act orunder the Freedom of Information Act, 1999 or any
other written law.
(3) A
DeputyInformation
Commissioner
appointed under subsection (1) shall hold office for aperiod not exceeding five years and may be reappointed.

No. 13

Data Protection

2011

13

(4) A Deputy Information Commissioner may, inthe absence or incapacity of the Commissioner, act in
his place.
(5) Where the post of Information Commissioner isvacant, a Deputy Information Commissioner may act as
the Information Commissioner until such time as aCommissioner is appointed to the vacant post.
(6) In the absence or incapacity of a Deputy
Information Commissioner, the President may appointan acting Deputy Information Commissioner.
(7) A person appointed under subsection (1) shall,
before he performs the functions of Deputy Information
Commissioner, take and subscribe to the oath of office
set out in Part B of the Schedule.
12. (1) The Commissioner or Deputy Information Resignation orofCommissioner may be removed from office only for removal
Information
cause, including misconduct in relation to his duties or Commissioner andInformation
physical or mental inability to fulfil the responsibilities Deputy
Commissionerof the office.
(2) The Commissioner or Deputy Information
Commissioner may at any time resign his office byletter addressed to the President.
13. Section 141 of the Constitution shall apply to the Remuneration of
offices of the Commissioner and the Deputy Information Information
Commissioner andCommissioner.
Deputy Information
Commissioner

14. (1) The Office of the Information Commissioner Seal of Office of theshall have a seal which shall be kept in the custody of Information
Commissioner
the Commissioner and shall be judicially noticed assuch.
(2) The seal of the Office of the Information
Commissioner may be affixed to documents andinstruments in the presence of the Commissioner andshall be attested by the signature of the Commissioner
and the signature shall be sufficient evidence that theseal was duly and properly affixed and is the lawful sealof the Office of the Information Commissioner.

14

No. 13

Data Protection

2011(3) All documents, other than those required bylaw to be under seal made by, and all decisions of theCommissioner may be signified under the hand of theCommissioner.

Chap. 56:01
Chap. 56:02

Service of documents

Execution of
documents(4) Notwithstanding the provisions of theConveyancing and Law of Property Act and the Real
Property Act relating to the matters thereunderrequired to be performed and to the mode of theirperformance prior to the registration of a Deed, document
or other instrument, the affixing of the seal of the Office of
the Information Commissioner and the signing by theCommissioner in the manner set out in subsection (2) shallbe, and shall be taken as sufficient evidence for the
purposes of those Acts of the due execution by the Officeof the Information Commissioner of any Deed,
document or other instrument.
15. Service upon the Commissioner of any notice,order or other document shall be effected by delivering
the same or by sending it by registered post addressedto the Commissioner at the office of the Office of theInformation Commissioner.
16. (1) Any document required to be executed by the
Office of the Information Commissioner shall be deemed
to be duly executed if signed—(a) by the Commissioner; or(b) outside Trinidad and Tobago, by the person
or persons authorized by the Commissioner
so to sign, but in such case the instrument
so authorizing such person or persons shallbe attached to and form part of the
document.
(2) Any cheque, bill of exchange or order for thepayment of money required to be executed by theCommissioner shall be deemed to be duly executed if
signed by a person or persons authorized to do so by theCommissioner.

No. 13

Data Protection

2011

15

17. (1) The Commissioner may employ such persons Staff of the Office ofas he considers necessary for the due and efficient Information
Commissioner
performance of his duties and functions under this Act
on such terms and conditions as are agreed between theCommissioner and the person and subject to suchmaximum limit of remuneration as the Minister may
determine.
(2) Subject to subsection (3) and the approval of
the appropriate Service Commission or Statutory
Authority and with the consent of the officer, any officer
in the public service or a Statutory Authority may beseconded to the service of the Office of the Information
Commissioner.
(3) Where a secondment referred to in subsection(2) is effected, arrangements shall be made to preserve
the rights of the officer so transferred to any pension,
gratuity or other allowance for which he would havebeen eligible had he not been seconded to or from theservice of the Office of the Information Commissioner.
(4) A period of transfer on secondment shall be forthree years and may only be extended for a further two
years.
(5) Subject to the approval of the Commissioner,
the appropriate Service Commission and with theconsent of the officer, an officer in the public service ora Statutory Authority may be transferred to the serviceof the Office of the Information Commissioner on terms
and conditions no less favourable than those enjoyed by
the officer at the time of transfer in the public service or
Statutory Authority, as the case may be.
(6) The Commissioner shall establish a pension
plan, or where the establishment of a plan is not
feasible, the Commissioner shall make arrangements
for membership in an existing plan.
(7) Subject to the rules of the pension plan establishedin accordance with subsection (6), all employees of the
Office of the Information Commissioner shall be eligible tobecome members of the pension plan established inaccordance with subsection (6).

16

No. 13

Data Protection

2011(8) Superannuation benefits which had accrued toa person transferred in accordance with subsection (5)shall be preserved as at the date of his employment by
the Commissioner and such benefits shall continue toaccrue under the relevant pension law up to the date ofestablishing a pension plan for the date on whicharrangements are made for membership in a plan on thebasis of pay, pensionable emoluments or salary, as thecase may be, applicable, at the time of this transfer to theoffice held by him immediately prior to his employment by
the Commissioner.
(9) Where a person who is transferred inaccordance with subsection (5) dies, retires or his post in
the Office of the Information Commissioner is abolishedor he is retrenched by the Commissioner prior toestablishing or prior to the arrangements being madefor membership in a pension plan and, if at the date that
his service is terminated by any of the above-mentioned
methods he was in receipt of a salary higher than thepay, pensionable emoluments or salary referred to in
subsection (8), the superannuation benefits payable tohis estate or to him, as the case may be, shall be basedon the higher salary.
(10) The difference between the superannuation
benefits payable on the basis of the higher salaryreferred to in subsection (9) and the superannuation
benefits payable under the relevant pension law, on thebasis of the pay, pensionable emoluments or salaryreferred to in subsection (8), shall be paid by theCommissioner.
(11) Where a person who is transferred inaccordance with subsection (5) dies, retires or his post in
the Office of the Information Commissioner is abolishedor he is retrenched from the Office of the Information
Commissioner while being a member of the pension
plan established in accordance with subsection (6), heshall be paid superannuation benefits by the pension
plan at the amount which, when combined withsuperannuation benefits payable under the relevantNo. 13

Data Protection

2011

17

pension law, is equivalent to the benefits based on his
pensionable service in the public service or a Statutory
Authority combined with his service in the Office of theInformation Commissioner and calculated at the final
salary applicable to him on the date that his service wasterminated by any of the above-mentioned methods.
(12) For the purpose of subsection (11), “final
salary” shall have the meaning assigned to it by thepension plan.
18. (1) Subject to subsection (2), the Commissioner Delegation
may authorize any person according to their qualifications
for the purposes of this Act, to exercise or perform,
subject to such restrictions or limitations as theCommissioner may specify, any powers, duties orfunctions of the Commissioner.
(2) The Commissioner may delegate to only the
Deputy Information Commissioner responsibilities
regarding review of personal information that deals
with matters that may be exempt from disclosure
pursuant to sections 24 to 26 of the Freedom of Chap. 22:02
Information Act.
19. (1) The Commissioner may appoint officers within Designation andthe Office of the Information Commissioner to be inspectors powers of inspectors
according to their qualifications for the purposes of thisAct and shall furnish each such inspector with a certificate
of his designation.
(2) Where the Commissioner is conducting an
enquiry or inspection under this Act the officers
appointed under subsection (1) shall act on his behalf.
(3) An inspector shall, subject to sections 20 and
21, have the power to do all or any of the following
things for the purpose of the execution of this Act:(a) if he considers necessary, take with him
when entering any premises, a police officer;

18

No. 13

Data Protection

2011(b) to require any person whom he finds in or onsuch premises to give such information as isin his power to give as to who is the owneror occupier thereof and the employer ofworkers employed to work thereon;(c) to make such examinations, inspections,investigations and enquiries as may benecessary to ascertain whether this Act isbeing complied with;(d) to require the production of or to seize,
inspect or examine and to copy registers,
records or other documents;(e) to examine, either alone or in the presence of
any other person as the inspector deems
necessary, for the purposes of this Act, withrespect to the observance of the provisions of
this Act or the Regulations, any person whom
he finds on premises or whom he hasreasonable cause to believe to be, or to havebeen within the preceding two months,
employed thereon, and to require any such
person to be so examined and to sign adeclaration of the truth of the mattersrespecting which he is so examined; so,however, that no person shall be required
under this provision to answer any question
or to give evidence tending to incriminate
himself; and(f) to seize and detain for such time as may benecessary any article by means of which, orin relation to which he reasonably believes any
provision of this Act has been contravened.
Power ofCommissioner to
conduct an audit orenquiry of a Public
Body pursuant toPart III20. (1) Where the Information Commissioner isconducting an audit or enquiry into the practices of a
Public Body for the purposes of ensuring compliancewith the General Privacy Principles set out in Part I, orNo. 13

Data Protection

2011

determining an appeal pursuant to Part III, theCommissioner may—(a) with the permission of the head of the public
body or on application for a warrant undersubsection (4), enter and inspect any premises
occupied by a public body for the purposes ofan audit or enquiry;(b) require the production of any document orrecord relevant to the enquiry that is in thecustody or control of a public body; or(c) seize and detain relevant documents on
obtaining a warrant under subsection (4).
(2) The Commissioner shall not retain any
information obtained from an audit or enquiry undersubsection (1) beyond the period for which it is required.
(3) The Commissioner may exercise his powers
under this section with respect to the Office of the
President, Parliament, a Joint Select Committee of
Parliament or a committee of either House of
Parliament, the Cabinet, the Court of Appeal, the High
Court, the Industrial Court, the Tax Appeal Board or
any court of summary jurisdiction, the Tobago House of
Assembly, the Executive Council of the Tobago House of
Assembly only with the consent of the President, theSpeaker of the House of Representatives or the
President of the Senate, the Head of the Cabinet, theChief Justice, the Presiding Officer, the Chief
Administrator of the Tobago House of Assembly, theChief Secretary of the Tobago House of Assembly or the
Head of the Executive Council, as the case may be.
(4) Where the head of a public body refuses to—(a) allow the Information Commissioner or any
person acting for or under him to enter andinspect premises under subsection (1)(a), theInformation Commissioner shall, where hebelieves that such entry is necessary, apply
to a Magistrate for a warrant to so enter,seize and inspect; or

19

20

No. 13

Data Protection

2011(b) produce a document or record undersubsection(1)(b),
the
Information
Commissioner shall, where he believes therequest to be reasonable, apply to the Court
for an Order requiring the public body to
produce such documents.
(5) Subsection (4) shall not apply to any public
body referred to in subsection (3).
(6) Where the Head of a Public Body referred to in
section (3) refuses to—(a) allow the Information Commissioner or any
person acting for or under him to enter andinspect premises under subsection (1)(a);(b) produce a document or record undersubsection (1)(b);
the Information Commissioner may apply to a judge foran order to direct the Head of the Public Body to—(c) allow the Information Commissioner or any
person acting for or under him to enter andinspect premises and seize any document
found therein for the purposes of an adult or
enqiry; or(d) produce the document or record.
Power ofCommissioner to
conduct audit orenquiry pursuant toPart IV

21. (1) Where the Commissioner is conducting anaudit or enquiry into the compliance practices of a person
subject to the provisions of an enforceable code of conduct
pursuant to Part IV of this Act, the Commissioner may,pursuant to the authority provided under subsection (2)by an order of the Court—(a) require the production of any document orrecord that is in the custody or control of aperson subject to an enforceable code of
conduct; or(b) enter and inspect any premises occupied bya person subject to an enforceable code of

No. 13

Data Protection

2011

21

conduct and seize any document or record
found therein relevant to the audit orenquiry.
(2) Where a private enterprise refuses to allow
the Commissioner or any person acting for or under him
to enter and inspect premises under subsection (1)(b),
the Commissioner may apply to the Court for an Orderto so enter and inspect.
(3) Where a private enterprise refuses to produce
a document or record under subsection (1)(b), theCommissioner may apply to the Court for an Orderrequiring the private enterprise to produce such
documents.
(4) The Commissioner shall not retain any
information obtained from an audit or enquiry undersubsection (1) beyond the period for which it is required.
22. (1) All expenses of the Office of the Information Expenses andof the OfficeCommissioner shall be met out of moneys provided by accountsof the Information
Commissioner
Parliament.
(2) All revenues of the Office of the Information
Commissioner shall be paid into the Consolidated Fund.
(3) The accounts of the Office of the Information
Commissioner shall be audited by the Auditor Generalin accordance with the provisions of the Exchequer andChap. 69:01
Audit Act.
23. A statement made to or an answer given by a Statements made tonotperson during an investigation or enquiry by the Commissioner
admissible
Commissioner is inadmissible as evidence in court orany other proceeding, except in—(a) a prosecution for perjury in respect of sworn
testimony made before the Commissioner;(b) a prosecution for an offence under this Act;or(c) an application for judicial review under thisAct or an appeal from a decision with respect
to that application.

22
Privileged
information

Restrictions on
disclosure of
information by
Commissioner andstaff

No. 13

Data Protection

2011

24. Anything said in information supplied or any
data produced by a person during an investigation or
enquiry by the Commissioner is privileged in the samemanner as if the investigation or enquiry were a
proceeding in a court.
25. (1) The Commissioner and anyone acting for orunder the direction of the Commissioner shall notdisclose any information obtained in performing theirduties, powers and functions under this Act.
(2) Notwithstanding
subsection(1),
theCommissioner may disclose or may authorize anyone
acting for or under the direction of the Commissioner, todisclose information—(a) necessary to conduct an investigation, audit
or enquiry under this Act or establish
grounds for findings and recommendations
contained in a report under the Act; or(b) in the course of a prosecution or an appeal
from, or judicial review of, a decision of theCommissioner.

Protection ofCommissioner andstaff

Annual report ofCommissioner

26. Proceedings shall not lie against the Commissioner
or a person acting for or under the direction of theCommissioner for anything done, reported or said ingood faith in the exercise or performance or the intended
exercise or performance of a duty, power or function
under this Part.
27. (1) The Commissioner shall submit a reportannually to Parliament within three months after theend of the calendar year on the activities of the Office of
the Information Commissioner for the previous year
commencing one year after the coming into operation ofthis Act.
(2) the Commissioner may submit a special
report to Parliament at any time commenting on any
matters within the scope, duties and functions of theCommissioner where the matter is of such urgency orimportance that it should not be deferred to the time of
the next annual report to Parliament.

No. 13

Data Protection

2011

23

28. The Commissioner shall by Order publish in the Commissioner tolist of
Gazette and at least two newspapers in daily circulation publish
equivalentin Trinidad and Tobago a list of countries which have jurisdictions
comparable safeguards for personal information asprovided by this Act.
PART IIIPROTECTION OF PERSONAL DATA BY PUBLIC BODIES
29. (1) The following information about an individual Personal information
who is or has been an employee or official of a public
body is not personal information for the purpose of thisAct:(a) the fact that the individual is or has been an
employee or official of a public body;(b) the title, business address and businesstelephone number of the individual;(c) the name of the individual on a document
prepared by the individual in the course of
employment; and(d) the professional opinions or views of theindividual given in the course of employment.
(2) Information about an individual who is or was
performing services under contract for a public bodythat relates to the services performed, including theterms of the performance, the name of the individual,
and the opinions or views of the individual given in thecourse of the performance of those services is not
personal information for the purposes of the Act.
(3) Information relating to any discretionary
benefit of a financial nature including the granting of alicence or permit conferred to an individual, including
the name of the individual and the exact nature of thebenefit is not personal information for the purposes of
the Act.
(4) Information about an individual who has been
deceased for more than twenty years is not personal
information for the purpose of this Act.

24
Collection of
personal information

Personal information
to be collected
directly

No. 13

Data Protection

2011

30. Personal information shall not be collected by orfor a public body unless—(a) the collection of that information isexpressly authorized by or under any
written law;(b) the information is collected for the purposesof law enforcement; or(c) that information relates directly to and isnecessary for an operating programme oractivity of the public body.
31. (1) Where a public body requires personal
information from an individual it shall collect thepersonal information or cause the personal information
to be collected directly from that individual.
(2) Notwithstanding subsection (1), personal
information may be collected from a source other than
the individual where—(a) another method of collection is authorized
by the individual, by the Commissioner or by
any other written law;(b) the collection of information is necessary for
medical treatment of an individual and it is
not possible to collect the information directlyfrom that individual or the collection isnecessary to obtain authority from that
person for another method of collection; and(c) the information is collected for the purposeof—(i) determining the suitability for an
honour or award including anhonorary degree, scholarship, prize
or bursary;(ii) proceedings before a court or a
judicial or quasi-judicial tribunal;(iii) collecting a debt or fine or making apayment; or(iv) law enforcement.

No. 13

Data Protection

2011

25

32. (1) A public body shall ensure that the individual Individual to befrom whom it collects personal information or causes informed of purpose
personal information to be collected is informed of—(a) the purpose for collecting it;(b) the legal authority for collecting it; and(c) the title, business address and businesstelephone number of an official or employeeof the public body who can answer theindividual’s questions about the collection.
(2) Subsection (1) shall not apply if compliancewith subsection (1) would—(a) result in the collection of inaccurate
information;(b) defeat the purpose or prejudice the use forwhich the information is to be collected;(c) prejudice a law enforcement matter; or(d) prejudice the defence of Trinidad andTobago or of any foreign state allied to or
associated with Trinidad and Tobago or harmthe detection, prevention or suppression ofespionage, sabotage or terrorism.
33. Personal information that has been used by a Retention of personal
used forpublic body for an administrative purpose shall be information
an administrative
retained by the authority for such period of time after it purpose
has been used as may be prescribed by Order of the
Minister, to ensure that the individual to whom it
relates has a reasonable opportunity to obtain access tothat information.
34. Where the personal information of an individual Accuracy of personalis in the custody or control of a public body and the information
personal information will be used by or on behalf of the
public body to make a decision that directly affects theindividual, the public body shall make every reasonable
effort to ensure that the personal information isaccurate and complete.

26
Protection of
personal information

Storage and access of
personal informationin Trinidad andTobagoNo. 13

Data Protection

2011

35. A public body shall protect personal informationin its custody or under its control by making reasonablesecurity arrangements against such risks as unauthorizedaccess, collection, use, alteration, disclosure or disposal.
36. A public body shall ensure or take steps to ensurethat personal information in its custody or under its
control is stored only in Trinidad and Tobago andaccessed only in Trinidad and Tobago unless—(a) the individual to whom the information
relates has identified the information andhas consented in the prescribed manner toits being stored in or accessed from anotherjurisdiction; or(b) the information is stored in or accessed fromanother jurisdiction that has comparable
safeguards as provided by this Act.

Disposal of personal
information

Use of personal
information

Consistent purpose

37. A public body shall dispose of all personal informationin its control or custody in accordance with Regulations
made by the Minister under this Act.
38. Personal information under the custody or control
of a public body shall not, without the consent of theindividual to whom it relates, be used by the authority
except for the purpose for which the information was
obtained or compiled by the public body, or for a use
consistent with that purpose, or for a purpose for which
the information may be disclosed by the public body
pursuant to section 42.
39. The use of personal information is consistent withthe purposes for which it was obtained or compiled, if
the use has a reasonable and direct connection to the
purpose, and is necessary for performing the statutory
duties of, or for operating a legally authorized
programme of a public body that uses or discloses theinformation or causes the information to be used ordisclosed.

No. 13

Data Protection

2011

27

40. (1) A public body shall not process sensitive Limitation onofpersonal information unless it obtains the consent of the processing
sensitive personal
person to whom that sensitive personal information information inpossession of public
relates.
body(2) Notwithstanding subsection (1), sensitive
personal information may be processed—(a) by a health care professional or an employee
or agent of a health care body at the directionof a health care professional for the purposesof health and hospital care where it isnecessary for—(i) preventative medicine and theprotection of public health;(ii) medical diagnosis;(iii) health care and treatment; and(iv) the management of health andhospital care services;(b) where it has been made public by the person
to whom such information relates;(c) for research and statistical purposes inaccordance with section 43;(d) in the interest of law enforcement andnational security;(e) for the purposes of determining access tosocial services; or(f) in accordance with or where authorized byany other written law.
(3) For the purpose of this section, “health care
professional” means a person registered under the–(a) Medical Board Act;
Chap. 29:50(b) Dental Profession Act;
Chap. 29:54
Chap. 29:51(c) Opticians Registration Act;(d) Pharmacy Board Act;
Chap. 29:52
Chap. 29:53(e) Nurses and Midwives Registration Act;(f) Professions Related to Medicine Act; andChap. 90:04(g) Emergency
Ambulance
Servicesand Act No. 8 of 2009
Emergency Medical Personnel Act, 2009.

28

No. 13

Data Protection

2011(4) A person who contravenes this section commits
an offence.
Disclosure of personal
information in
Trinidad and Tobago

When personal
information may bedisclosed

41. Personal information under the custody or control
of a public body shall not be disclosed by the public bodyin Trinidad and Tobago without the consent of theindividual to whom it relates, except in accordance withsections 42, 43, 44 and 45.
42. Except as provided under any other written law,personal information under the control of a public bodymay only be disclosed—(a) for the purposes for which the information
was collected or compiled by the public bodyor for a use consistent with that purpose;(b) for any purpose in accordance with any
written law or any order made pursuant tosuch written law that authorizes suchdisclosure;(c) for the purpose of complying with a subpoena
or warrant issued or order made by a court,
person or body with jurisdiction to compel
the production of information or for the
purpose of complying with rules of court
relating to the production of information;(d) to the Attorney General of Trinidad andTobago for the purpose of, or in connection
with, legal proceedings involving the State,
where such disclosure is reasonably
required in the interests of fairness andprior notice of such disclosure is given to theperson to whom the information relates;(e) to an investigative body specified by the
Minister by Order, on the written request of
the investigative body, for the purpose ofinvestigating compliance with any written
law or carrying out a lawful investigation, if
the request specifies the purpose anddescribes the information to be provided;

No. 13

Data Protection

2011

29

(f) by one law enforcement agency in Trinidad
and Tobago to another law enforcement
agency within Trinidad and Tobago for the
purpose of enforcement of a written law;(g) to a law enforcement agency in a foreigncountry under a written agreement, treaty
or under the authority of the Government of
Trinidad and Tobago;(h) if the head of the public body agrees that acompelling circumstance exists that affects
the health or safety of any person and if
notice of the disclosure is mailed to the last
known address of the individual to whom
the information relates, unless the head of
the public body has a reasonable belief thatproviding notification could harm the healthor safety of any person;(i) so that the next of kin or friend of an
injured, ill or deceased person may becontacted;(j) for the purpose of collecting monies owing by
an individual to the Government of Trinidad
and Tobago or by a public body to anindividual;(k) for statistical purposes where the disclosure
meets the requirements of section 43; or(l) for archival purposes where the disclosure
meets the requirements of section 44.
43. A public body may disclose personal information Disclosure forandor may cause personal information in its custody or researchstatistical purposes
control to be disclosed for a research purpose, including
statistical research only if—(a) the research purpose cannot reasonably be
accomplished unless that information isprovided in individually identifiable form;

30

No. 13

Data Protection

2011(b) the information is disclosed on condition
that it not be used for the purpose ofcontacting a person to participate inresearch;(c) any record linkage is not harmful to theindividual to whom that information isabout and the benefits to be derived from therecord linkage are clearly in the public
interest;(d) the head of the public body concerned has
approved conditions relating to the following:(i) security and confidentiality;(ii) the removal or destruction of theindividual identifiers at the earliest
reasonable time; and(iii) the prohibition of any subsequent
use or disclosure of that information
in individually identifiable form
without the express authorizationof that public body; and(e) the person to whom that information isdisclosed has signed an agreement to comply
with the approved conditions, this Act andany of the public body’s policies andprocedures relating to the confidentiality of
personal information.
Disclosure forarchival or historical
purposes

44. The archives of the Government of Trinidad andTobago or the archives of a public body may disclose
personal information or cause personal information inits custody or control to be disclosed for archival or
historical purposes if—(a) the disclosure would not be an unreasonableinvasion of professional or personal privacy;(b) the disclosure is for historical research andis in accordance with section 42;

No. 13

Data Protection

2011

31

(c) the information concerns someone who has
been deceased for twenty or more years; or(d) the information is in a record that has been
in existence for one hundred or more years.
45. Notwithstanding sections 42, 43 and 44, medical Disclosure of medical
to beinformation shall not be disclosed by a public body information
restrictedexcept—(a) with the consent of the person to whom suchinformation relates; or(b) by order of the Court.
46. (1) Where personal information under the Disclosure of
information
custody and control of a public body is to be disclosed to personaloutside of Trinidad
a party residing in another jurisdiction, the public body and Tobago
shall inform the individual to whom it relates of—(a) the purpose for which the information is
being collected once that purpose is known
to the public body; and(b) the identity of—(i) the person requesting the information;and(ii) the relevant public body withresponsibility for Data Protectionin the other jurisdiction,and obtain
information.

hisconsent

beforedisclosingthe(2) Where a person under subsection (1) does notconsent to the release of his personal information, thepublic body shall not so disclose.
(3) Subsections (1) and (2) shall not apply where
the circumstances set out in section 41 exist, but
personal information may be limited where the public
body determines that the jurisdiction to which thepersonal information is being sent does not havecomparable standards.

32

No. 13

Data Protection

2011(4) Where a person under subsection (1) consents
to the release of his information and the public body is—(a) satisfied that the jurisdiction to which theinformation is being sent has comparable
safeguards, as provided by this Act, thepublic body shall disclose the personal
information; or(b) not satisfied that the jurisdiction to which theinformation is being sent has comparable
safeguards, the public body shall refer thematter to the Commissioner for a determination
as to whether the other jurisdiction has
comparable safeguards as provided by thisAct and inform the individual to whom thepersonal information relates, of the referral.
(5) Upon a referral under subsection (4)(b), theCommissioner shall make a determination whether theother jurisdiction has or does not have comparable
safeguards as provided by this Act, and inform thepublic body accordingly.
(6) Where the public body is informed that thejurisdiction to which the information is being sent—(a) has comparable safeguards, the public bodyshall inform the person concerned anddisclose the personal information;(b) does not have comparable safeguards, thepublic body shall inform the person
concerned and obtain his consent for thedisclosure—(i) without limitation; or(ii) with limitation on the information
sharing to the extent necessary toensure the protection of personalprivacy and information.

No. 13

Data Protection

2011

33

47. (1) Every public body shall prepare a privacy Privacy impact
and
impact assessment, in the form prescribed by the assessment
mitigation
Commissioner, for any proposed enactment, system,
project, programme or activity where such enactment,
system, project, programme or activity would or would
reasonably be expected to substantially or materially
impact personal information.
(2) Upon preparation of a privacy impact assessment, every public body shall submit such privacy
impact assessment to the Commissioner for approval.
(3) Where a privacy impact assessment has been
submitted in accordance with subsection (2), theCommissioner shall evaluate such privacy impact
assessment in accordance with the General Privacy
Principles set out in section 6 and where necessary,
make recommendations to the public body foramendments.
(4) Where
theCommissioner
makesa
recommendation under subsection (3), the public bodyshall make the necessary amendments to its privacy
impact assessment.
(5) Every public body shall take all reasonable
steps in accordance with its privacy impact assessment
to avoid unnecessary intrusions into personal privacy
when designing, implementing or enforcing enactments,
systems, projects, programmes or activities.
48. (1) The Head of a Public Body shall cause to be Personal information
included in personal information banks, all personal banks
information under the control or in the custody of the
public body that—(a) has been used, is being used or is available
for use for an administrative purpose; or(b) is organized or intended to be retrieved bymeans of the name of an individual or by an
identifying number, symbol or other particularassigned to an individual.

34

No. 13

Data Protection

2011(2) Notwithstanding subsection (1), personal
information under the custody or control of the Archivesof the Government of Trinidad and Tobago that has
been transferred to it by a public body for historical or
archival purposes shall not be included in personal
information banks.
Information sharing

49. (1) Where a public body intends to share information
with other public bodies, it shall do so only pursuant toan agreement in a manner prescribed by theCommissioner by Order.
(2) An Order under subsection (1) shall be
published in the Gazette and two newspapers in daily
circulation in Trinidad and Tobago.

Data matching shallbe approved byCommissioner

50. (1) Subject to subsection (5), before a public bodymatches personal information from a set of data withpersonal information from another set of data, whether
or not pursuant to an information sharing agreement,
the public body shall obtain the written authorization of
the Commissioner.
(2) In determining whether to authorize data
matching by a public body or public bodies, using a data
matching programme, the Commissioner shall consider
whether or not—(a) the objective of the matching programme
relates to a matter of significant public
importance;(b) the matching programme would achieve theobjective in a way which would achievemonetary savings that are both significant
and quantifiable or will achieve othersignificant benefits to society;(c) the public interest in allowing the matching
programme to proceed outweighs the public
interest in adhering to the General Privacy
Principles set out in section 6 that the
programme would otherwise contravene; orNo. 13

Data Protection

2011

35

(d) the programme involves data or information
matching on a scale that is excessive, having
regard to the number of public bodies thatwill be involved in the programme and theamount of details about the individual thatwould be matched under the programme.
(3) The Information Commissioner shall complete
his determination in respect of the data matching
request within sixty days of the request.
(4) In approving data matching by a public body or
public bodies, the Commissioner may impose whatever
terms and conditions that he considers appropriate.
(5) Where the Information Commissioner fails tocomplete his determination in respect of a data matching
request under subsection (3), the public body may apply
to the Minister for a determination of the matter.
(6) In giving his authorization under subsection (1),the Commissioner may give covering authorization toallow the matching of data where such matching is partof a system of practice approved by him.
51. (1) The Commissioner shall publish periodically, Personal information
but not less than annually, an index of the personal index
information that is held by the public bodies that
includes a summary of the following:(a) the personal information banks that are in
the custody or control of each public body;(b) the information sharing agreements enteredinto by any public body with another public
body or other person;(c) the data matching activities approved by theCommissioner;(d) the contact information of the official towhom requests relating to personal information
contained in the data bank should be sent;

36

No. 13

Data Protection

2011(e) a statement of the purposes for which
personal information in the data bank was
obtained or compiled and a statement of theuses consistent with those purposes forwhich the information is used or disclosed;(f) a statement of the retention and disposal
standards and practices that apply to thepersonal information in the data bank; and(g) privacy impact assessments prepared by any
Ministry of the Government of Trinidad andTobago.
(2) For the purpose of this section, “contact
information” means the title, business address, businesstelephone and facsimile number and business e-mail of
an official or employee of the public body.
(3) Where the Commissioner publishes the index
of personal information held by public bodies undersubsection (1), such publication shall be made in theGazette and at least two newspapers in daily circulationin Trinidad and Tobago.
Right of access topersonal information
in a public body52. (1) Subject to section 53, every individual who isin Trinidad and Tobago has a right to and shall on
request, be given access to—(a) personal information about that individual
contained in a personal information bank in
the custody and control of a public body; and(b) any other personal information about theindividual under the custody or control of apublic body with respect to which theindividual is able to provide sufficiently
specific information on the location of theinformation as to render it reasonably
retrievable by the public body.

No. 13

Data Protection

2011

37

(2) A request for access to personal information
shall be made to the public body that has control of thepersonal information bank or of the information, as thecase may be, in the form approved by the Commissioner.
(3) The Head of a Public Body may, where
reasonable and in appropriate circumstances, provide
personal information in accordance with the provisionsof this Act in response to an oral request.
53. (1) A head of a public body may refuse to disclose Refusal of access topersonal information to the individual to whom the personal information
information relates where—(a) the disclosure would constitute an unjustified
invasion of another individual’s personalprivacy;(b) the disclosure could reasonably be expected
to reveal information supplied in confidence;(c) it is evaluative or opinion material compiled
solely for the purpose of determining
suitability, eligibility or qualifications for
employment or for the awarding of government
contracts and other benefits where thedisclosure would reveal the identity of asource who furnished information to theinstitution in circumstances where it may
reasonably be assumed that the identity ofthe source would be held in confidence; and(d) a disclosure would result in disclosure of
information that is exempt from disclosure
under Part IV of the Freedom of Information Chap. 22:02
Act.
(2) The Head of a Public Body may disregard
requests from an individual for access to that individual’s
personal information where it would unreasonablyinterfere with the operations of the public body becauseof the repetitious or systematic nature of the requests or
the requests are frivolous or vexatious.

38
Severance andrefusal to disclose
existence of
information

No. 13

Data Protection

2011

54. (1) The Head of a Public Body shall make every
effort to sever information that is exempt from disclosure
pursuant to section 53 from information that may bemade available to the individual requesting access to his
personal information and make the non-exempt
information available.
(2) Where acknowledgment of the existence of
information that is exempt from disclosure would reveal
critical information about the nature or contents of theinformation, the Head of a Public Body may refuse todisclose the existence of the information.

Exercise of rights ofdeceased persons, etc.

55. Any right or power conferred on an individual by
this Act may be exercised—(a) where the individual is deceased, by theindividual’s personal representative if theexercise of the right or power relates to theadministration of the individual’s estate;(b) by the individual’s attorney under a power ofattorney;(c) by the individual’s guardian; or(d) where the individual is less than eighteen
years of age, by a person who has lawful
custody of the individual.

Responsibilities ofpublic bodies

56. (1) Where a request is made for access to personal
information pursuant to section 52, the head of the
public body shall, within thirty days of the request being
received where access is—(a) granted in whole or in part, give theinformation to the individual who made therequest; or(b) refused in whole or in part, give the individual
who made the request a written response
stating—(i) that the information does not exist;orNo. 13

Data Protection

2011

39

(ii) the specific provision of the Act onwhich a refusal could reasonably be
expected to be based if the information
existed; or(c) refused in whole or in part, give the individual
who made the request information regarding
the right of appeal to the Commissioner.
(2) Where access is granted in whole or in part, thehead of the public body shall ensure that the information
is available in a comprehensive form, including where
reasonable, comprehensible to an individual with asensory disability.
57. (1) Where an individual believes there is an error Right to requestofor omission in his personal information, the individual correction
personal information
may request the Head of a Public Body that has theinformation in its custody or under its control, to correct
the information.
(2) If no correction is made in response to arequest under subsection (1), the Head of a Public Body
shall annotate the information with the correction thatwas requested but not made and notify the individual
who made the request that no correction was made.
(3) On correcting or annotating personal
information under this section, the Head of a Public
Body shall notify any other public body or any third
party to whom that information has been disclosed
during the one-year period before the correction was
requested, of such correction or annotation.
(4) Upon being notified under subsection (3) of acorrection or annotation of personal information, a public
body shall make the correction or annotation on any
record of that information in its custody or control.
58. An individual who has filed a request for his Appeal topersonal information pursuant to section 52 or who has Information
Commissioner
requested correction of personal information pursuant
to section 57 may appeal any decision of the head of the
public body to the Commissioner.

40
Time for application

Complaints to theCommissioner

Immediate dismissal

No. 13

Data Protection

2011

59. An appeal to the Commissioner under section 58
shall be made within six weeks of the date when thenotice was given of the decision appealed from, by filingwith the Commissioner a written notice of appeal.
60. Where an individual has a reasonable belief thata public body is not complying with the provisions of thisAct, he may make a complaint to the Commissioner.
61. The Commissioner may dismiss—(a) an appeal if the notice of appeal does notpresent a reasonable basis for concludingthat the personal information to which thenotice relates exists or is incorrect; or(b) a complaint if the written complaint does
not contain sufficient particulars to make adetermination of non-compliance with theprovisions of this Act.

Informing of noticeof appeal

Mediation

Enquiry by theCommissioner

62. Upon receiving the notice of appeal under section
59, or a complaint under section 60, the Commissioner
shall inform the Head of a Public Body concerned andany other affected person of the notice of appeal or thecomplaint.
63. The Commissioner may authorize a mediator toinvestigate the circumstances of the appeal under
section 58 and to try to effect a settlement of the matter
under appeal.
64. (1) The Commissioner may conduct an enquiry toreview the decision of the Head of a Public Body, or acomplaint in respect of a public body, if the Commissioner
has—(a) not authorized a mediator to conduct aninvestigation under section 63; or(b) authorized a mediator to conduct aninvestigation under section 63, but nosettlement has been reached.

No. 13

Data Protection

2011

41

(2) Where the Commissioner conducts an enquiry
under this section he may, on the conclusion of suchenquiry in respect of—(a) a request for access either—(i) affirm the decision of the Head of a
Public Body; or(ii) order the Head of a Public Body torelease the personal information or
make the corrections requested;(b) a complaint—(i) dismiss the complaint; or(ii) order the Head of the Public Body
to comply with the relevant
provisions of this Act deemed to be
in breach.
(3) Where an enquiry is conducted under thissection, it may be conducted by the Commissioner on his
own or by a tribunal comprising the Commissioner andone or more Deputy Commissioners.
(4) A person aggrieved by a decision of theCommissioner or the tribunal under this section may
apply to the High Court for Judicial Review.
65. The enquiry by the Commissioner or a mediator Enquiry in private
and any meetings held by a mediator with parties to theappeal may be conducted in private.
66. The individual who requested access to or Representations
correction of personal information, the Head of a Public
Body concerned and any affected party shall be given
the opportunity to make representations to theCommissioner, but none is entitled to—(a) be present during;(b) have access to; or(c) comment on,
representations made to the Commissioner by any otherperson.

42
Right to counsel oran agent

Burden of proof

No. 13

Data Protection

2011

67. An individual who requests access to personal
information, the Head of a Public Body concerned andany affected party may be represented by counsel or an
agent.
68. Where a public body refuses to give access topersonal information, the burden of proof that the
information lies within one of the specified exemptionsof the Act is on a balance of probabilities and lies upon
the public body.
PART IVPROTECTION OF PERSONAL DATA BY THE PRIVATE SECTOR

Application ofGeneral Privacy
Principles

69. A person who—(a) collects, retains, manages, uses, processes orstores personal information in Trinidad andTobago;(b) collects personal information from individuals
in Trinidad and Tobago; or(c) uses an intermediary or telecommunications
service provider located in Trinidad andTobago to provide a service in furtherance ofparagraph (a) or (b),shall follow the General Privacy Principles set out insection 6 in dealing with personal information.

Codes of practice

70. The Commissioner shall consult with industry to
promote the application of the General Privacy
Principles through the development of codes of practicethrough such means as—(a) providing guidance on the development ofcodes of practice;(b) providing guidance on complaint resolution
mechanisms;(c) fostering education on the General Privacy
Principles;No. 13

Data Protection

2011

43

(d) working with government and private sector
bodies to promote awareness of codes ofconduct among consumers; and(e) taking any action that appears to theCommissioner to be appropriate.
71. (1) Notwithstanding section 69 where, in the Commissioner may
development
opinion of the Commissioner, the public interest requireof code of conduct
warrants the immediate and mandatory development ofcodes of conduct dealing with the application of theGeneral Privacy Principles to a particular industry,
economic sector, or activity, the Commissioner may, by
Order, require the development of a code of conduct andset a time limit for its development.
(2) Subject to subsection (1), where there is anappropriate government regulator of an industry,
economic sector or activity, the Commissioner may
request the regulator to oversee the development of thecode of conduct for that industry, economic sector or
activity.
72. (1) Where a mandatory code of conduct is developed Cross borderofpursuant to section 71, it shall require at a minimum disclosure
personal informationthat personal information under the custody or control
of an organization shall not be disclosed by thatorganization to any third party without the consent of
the individual to whom it relates, except in general,
where such information is disclosed for the purposes—(a) for which the information was collected orfor use consistent with that purpose;(b) of a Court Order; or(c) of complying with any written law.
(2) Where personal information under thecustody and control of an organization is to be disclosed
to a party residing in another jurisdiction, theorganization shall inform the individual to whom it
relates of the—(a) purpose for which the information is being
collected once that purpose is known to theorganisation;

44

No. 13

Data Protection

2011(b) identity of—(i) the person requesting the information;and(ii) the relevant public body withresponsibility for Data Protectionin the other jurisdiction,and obtain his consent before disclosing the information.
(3) Where a person under subsection (2) does notconsent to the release of his personal information, theorganization shall not so disclose.
(4) Where a person under subsection (2) consents
to the disclosure of his information and the organizationis—(a) satisfied that the jurisdiction to which theinformation is being sent has comparable
safeguards as provided by this Act, theorganization shall disclose the personal
information;(b) not satisfied that the jurisdiction to which
the information is being sent has comparable
safeguards, the organization shall refer thematter to the Commissioner for adetermination as to whether the otherjurisdiction has comparable safeguards asprovided by this Act and inform the individual
to whom the personal information relates of
the referral.
(5) Upon a referral under subsection (4), theCommissioner shall make a determination whether theother jurisdiction has or does not have comparable
safeguards as provided by this Act, and inform theorganization accordingly.
(6) Where the organization is informed that thejurisdiction to which the information is being sent—(a) has comparable safeguards, the organization
shall inform the person concerned anddisclose the personal information; orNo. 13

Data Protection

2011

45

(b) does not have comparable safeguards, theorganization shall inform the person
concerned and obtain his consent for thedisclosure—(i) without limitation on the personal
information; or(ii) with limitation on the personal
information sharing to the extent
necessary to ensure the protectionof personal privacy and information.
73. (1) Where a mandatory code of conduct is Approval of code of
developed, the sector shall apply to the Commissioner conduct
for the approval of such code prior to its use.
(2) Where a voluntary code of conduct is developed,
the sector may apply to the Commissioner for theapproval of such code prior to its use.
(3) The Commissioner may approve a code of conduct
dealing with compliance with the General Privacy
Principles set out in section 6 developed by an industry
sector, an industry organization or a professional body.
(4) Where the Commissioner is satisfied that acode of conduct submitted for approval in accordancewith subsection (1) or (2) meets the requirements set out
in subsection (5), he shall approve the code of conduct.
(5) In approving a code of conduct, theCommissioner shall consider—(a) compliance with the General Privacy
Principles set out in section 6;(b) use and adequacy of dispute resolution
mechanisms within the industry as well as
within individual firms;(c) the potential for development or
encouragement of anti-competitive conduct;(d) the adequacy of the process used to develop
the code of conduct, including involvement of
stakeholders, such as relevant consumers,
suppliers and other interested groups;

46

No. 13

Data Protection

2011(e) the role of industry sector regulators if any;and(f) any other matters that the Commissioner
considers relevant.
Mandatory codes ofconduct

Right of access topersonal information

74. (1) Where the Commissioner has approved a codeof conduct, the Minister may by Order, make compliancewith the code mandatory with respect to those to whom
the code of conduct applies under this Act.
(2) An Order made by the Minister undersubsection (1), shall be subject to negative resolution of
Parliament.
(3) Where a code of conduct has been mademandatory under subsection (1), the persons orenterprises to whom or to which it applies shall comply
with the provisions of the code of conduct.
(4) Without limiting the generality of subsection(1), where a government regulator has jurisdiction overan industry, economic sector or activity so that the codeof conduct dealing with the application of the General
Privacy Principles can be made mandatory pursuant toother legislation, the regulator may make a code of
conduct approved by the Commissioner mandatory.
(5) Where an industry regulator has mandated
compliance in dealing with the protection of personalprivacy that has been approved by the Commissioner
and the legislation under which the code of conduct has
been made mandatory has adequate provisions forcomplaint resolution and sanctions for non-compliancewith the provisions of the code of conduct, theCommissioner may forebear from exercising his powers
with respect to compliance.
75. (1) An individual who has personal information
stored in an organization which is subject to a mandatorycode of conduct has a right to and shall on request, begiven access to—(a) personal information about that individualin the custody and control of the organisation;andNo. 13

Data Protection

2011

47

(b) any other personal information about theindividual under the custody or control of
the organization with respect to which theindividual is able to provide sufficiently
specific information on the location of theinformation as to render it reasonably
retrievable by the organisation.
(2) A request for access to personal information
shall be made to the organization that has control of thepersonal information in the form approved by theCommissioner.
(3) The organisation may, where reasonable andin appropriate circumstances, provide personal informationin accordance with the provisions of this Act in responseto an oral request.
76. (1) A corporation shall not process sensitive Limitation onofpersonal information in its possession unless it obtains processing
sensitive personal
the consent of the person to whom that sensitive information in thepossession of apersonal information relates.
corporation(2) Notwithstanding subsection (1), sensitive
personal information may be processed—(a) by a health care professional or an employee
or agent of a health care body at the directionof a health care professional for the purposesof health and hospital care where it isnecessary for—(i) preventative medicine and theprotection of public health;(ii) medical diagnosis;(iii) health care and treatment; and(iv) the management of health andhospital care services;(b) where it has been made public by the person
to whom such information relates;(c) for research and statistical purposes inaccordance with section 43; and(d) where the disclosure is required by written
law.

48

No. 13

Data Protection

2011

Chap. 29:50(3) For the purpose of this section, “health care
professional” means a person registered under the—(a) Medical Board Act;

Chap. 29:54(b) Dental Profession Act;

Chap. 29:51(c) Opticians Registration Act;

Chap. 29:52(d) Pharmacy Board Act;

Chap. 29:53(e) Nurses and Midwives Registration Act;

Chap. 90:04(f) Professions Related to Medicine Act; andAct No. 8 of 2009

Refusal of request
for access to personal
information

Request for review
or complaint to theCommissioner(g) Emergency Ambulance Services andEmergency Medical Personnel Act; 2009.
(4) A person who contravenes this section commits
an offence.
77. (1) The head of an organization subject to a
mandatory code of conduct may, upon the written
authorization of the Commissioner, disregard a requestfrom an individual for access to that individual’s
personal information where it would unreasonablyinterfere with the operations of the organization
because of the repetitious or systematic nature of therequests or the requests are frivolous or vexatious.
(2) Where an organization disregards a request
under subsection (1) it shall notify the individual
making the request.
78. Where an organization is subject to a mandatorycode of conduct and an individual has a reasonable
belief that the organization has within its custody orcontrol personal information regarding that individual,
the individual may—(a) where the individual has requested access toor the correction of personal information
held by an organization and the organization
has refused such request, ask theCommissioner to conduct a review of theresulting decision, act or failure to act of theorganization; orNo. 13

Data Protection

2011

49

(b) make a complaint to the Commissioner
regarding an alleged failure of the organization
to comply with the provisions of the mandatorycode of conduct.
79. A request for a review by, or a complaint to the Time for application
review or
Commissioner shall be made within six weeks of the forcomplaint
date of the decision or six weeks from which the failure
to comply with the mandatory codes of conduct firstbecame known or should have become known.
79A. Where an individual has a reasonable belief that Complaint to theonan organisation is not complying with the provisions of Commissioner
non-compliancethis Act, he may make a complaint to the Commissioner.
80. The Commissioner may not entertain—
Immediate dismissalof request for review(a) a request for a review of the decision where or complaint
the written request does not present a
reasonable basis for concluding that thepersonal information to which the request
relates, exists; or(b) a complaint under section 78 or 79A where
the written complaint does not containenough particulars to make a determinationof non-compliance with the mandatory codeof conduct on the part of the organization or
this Act.
81. Upon receiving the written request or complaint Notification ofunder section 78 or 79A, the Commissioner shall inform request or complaint
the head of the organization concerned and any otheraffected person of the request or complaint.
82. (1) Subject to section 83(2), the Commissioner Enquiry of request
may conduct an enquiry into a request or complaint or complaint
under section 78 or 79A.
(2) Where the Commissioner conducts an enquiry
under this section he may, on the conclusion of suchenquiry in respect of—(a) a request for access to information or thecorrection of information—(i) affirm the decision of the organization;

50

No. 13

Data Protection

2011(ii) order the head of an organization torelease the personal information or
make the correction requested; or(iii) make the correction requested; or(b) a complaint—(i) dismiss the complaint; or(ii) order the head of the organization
to comply with the provisions of themandatory code of conduct or thisAct.
(3) Where an enquiry is conducted under
this section, it may be conducted by the Commissioner
on his own or by a tribunal comprising theCommissioner and one or more Deputy Commissioners.
(4) A person aggrieved by a decision of theCommissioner or the tribunal under this section may
apply to the High Court for Judicial Review.
Mediation of request

83. (1) The Commissioner may authorize a mediator
to investigate the circumstances of the request under
section 78 and to try to effect a settlement of the matter.
(2) Where the Commissioner has—(a) not authorized a mediator to conduct aninvestigation under subsection (1); or(b) authorized a mediator to conduct aninvestigation under subsection (1) but nosettlement has been reached,he may conduct an enquiry into a request under section 82.

Enquiry of request to
be conducted in
privateRepresentations

84. An enquiry by the Commissioner or a mediatorand any meetings held by a mediator with parties to therequest may be conducted in private.
85. An individual who requested access to, thecorrection of personal information or who made acomplaint, the head of the organization concerned andNo. 13

Data Protection

2011

51

any affected party shall be given the opportunity tomake representations to the Commissioner, but none isentitled to—(a) be present during;(b) have access to; or(c) comment on,
representations made to the Commissioner by any otherperson.
86. Every director and officer of a corporation shall Duties of directors
take reasonable care to ensure that the corporation
complies with—(a) this Act and the regulations made thereunder;and(b) any Orders imposed by the Commissioner or
his delegate.
PART VCONTRAVENTION AND ENFORCEMENT
87. A person who wilfully obstructs the Information Obstruction
Commissioner or any other person acting for or under
the direction of the Commissioner in the course ofcarrying out an audit or an investigation, commits anoffence.
88. (1) A person who makes a request for access to or False andcorrection of personal information under false misleadingstatements
pretences, commits an offence.
(2) A person who wilfully makes a false statement
to mislead or attempts to mislead the Commissioner inthe performance of his functions under this Act, commits
an offence.
89. A person who fails to comply with an order of the Failure to comply
with an order
Commissioner, commits an offence.
90. A person who contravenes the provisions of Violation of whistleblowing provisions
section 99, commits an offence.

52

No. 13

Offence for notcomplying withmandatory code of
conduct

91. Where a person to whom a mandatory code of
conduct applies under section 74 fails to comply withsuch mandatory code of conduct, he commits an offence.

Contravention of Act

Data Protection

2011

92. (1) A person who wilfully discloses personal
information in contravention of this Act, commits anoffence.
(2) A person who collects, stores or disposes of
personal information in a manner that contravenes thisAct commits an offence.

Breach of obligationsof confidentiality

Offences by directors
and officers

Penalties

93. A person who breaches the confidentiality
obligations established by section 25, commits anoffence.
94. Where a corporation commits an offence under
this Act, any officer, director or agent of the corporation
who directed, authorized, assented to, or participated in
the commission of the offence is a party to and commits anoffence and is liable to the punishment provided for theoffence.
95. (1) A person who commits an offence under thisAct is liable upon—(a) summary conviction, to a fine of not more thanfifty thousand dollars or to imprisonment for aterm of three years; and(b) conviction on indictment, to a fine of not
more than one hundred thousand dollars or
to imprisonment for a term of not more than
five years.
(2) Where the offence under this Act is committed
by a body corporate, the body corporate shall be liable
upon—(a) summary conviction, to a fine of two
hundred and fifty thousand dollars; and(b) conviction on indictment, to a fine of five
hundred thousand dollars.

No. 13

Data Protection

2011

96. (1) Where a corporation contravenes any of the Penalties forprovisions of this Act, the Court may impose a fine of up corporations
to ten per cent of the annual turnover of the enterprise.
(2) In imposing a fine under subsection (1), theCourt shall take into account—(a) the estimate of the economic cost of thecontravention to the consumers, users of theservices in question or any other person
affected by the contravention;(b) the estimate of the economic benefit of thecontravention to the enterprise;(c) the time for which the contravention is ineffect if continuing;(d) the number and seriousness of any othercontraventions, if any, committed by the
corporation; and(e) any other matter the Court may consider
appropriate in the circumstances.
PART VIMISCELLANEOUS
97. The Minister may order a public body or a Costs of audit
corporation to pay the costs reasonably incurred in theperformance of an audit pursuant to sections 20 and 21.
98. (1) The Court shall have jurisdiction to hear and Jurisdiction of the
Court
determine—(a) applications by the Information Commissioner
for any Order which the Court considers
appropriate to facilitate the enforcement ofany provisions of this Act; and(b) upon application by the Information
Commissioner,
cases
involving
any
contravention of the provisions of this Act
and make such appropriate Orders in
relation thereto.

53

54
Whistle-blowing
protection

Regulations

No. 13

Data Protection

2011

99. An employer whether or not a public body, shallnot dismiss, suspend, demote, discipline, harass orotherwise disadvantage an employee or deny that
employee a benefit, because—(a) the employee acting in good faith, and on thebasis of reasonable belief has—(i) notified the Commissioner that theemployer or any other person has
contravened or is about tocontravene this Act;(ii) done or stated the intention of
doing anything that is required to
be done in order to avoid having
any person contravene this Act; or(iii) refused to do or stated the intentionof refusing to do anything that is incontravention of this Act; or(b) the employer believes that the employee will
do anything described in paragraph (a).
100. (1) The Minister may make Regulations for the
purpose of—(a) prescribing anything required to beprescribed under this Act; and(b) giving effect to the provisions of this Act.
(2) Regulations made under this section shall be
subject to negative resolution of Parliament.

Chap. 22:02 amended

101. The Freedom of Information Act is amendedin—(a) section 4—(i) by inserting after the definition of“applicant” the following definitions:“ “decision of a public authority”
means the refusal of a publicauthority to grant access toan official document or the
failure of a public authority
to comply with section 15
or 16(1) herein;

No. 13

Data Protection

2011“Information Commissioner”
means the person appointed
pursuant to section 8 of
the Data Protection Act;”;(ii) by deleting the definition of “personal
information” and substituting thefollowing definition:“personal information” has themeaning assigned to it in
the Data Protection Act;”;(iii) in the definition of “publicauthority”—(A) in paragraph (j), by deleting
the word “or”;(B) by inserting after thewords “control;” the word“or”;(C) byinsertingafterparagraph (k) the following
new paragraph:“(l) the Office ofInformation
Commissioner asappointed under
section 7 of theData Protection
Act.”;(b) section 23(1) in paragraph (d), by deleting
the words “High Court for judicial” andsubstituting the words “Information
Commissioner for”;(c) section 30, by deleting subsections (1), (2)and (3) and substituting the following
subsections:“ (1) A document is an exempt
document if its disclosure under this Act
would involve the disclosure of personal
information in a manner inconsistent
with the Data Protection Act.

55

56

No. 13

Data Protection(2) The provisions of subsection (1)shall not apply to a request by anindividual for his own personal
information, which request shall betreated as a request under the Data
Protection Act.
(3) here a request by a person otherthan a person referred to in subsection(2) is made to a public body for accessto a document containing personal
information, the public body shallproceed in accordance with the Data
Protection Act in deciding whether togrant access to such request.”;(d) section 36, by deleting subsection (1) andsubstituting the following subsection:“(1) Where a document (whether or
not it is one to which access has been
given under this Act) contains
personal information of an individual
and that individual believes that the
information is inaccurate, he shallproceed, and the public body shalladdress the matter in accordance withsection 57 of the Data Protection Act.”;(e) section 38A—(i) in subsection (1), by deleting
the word “Ombudsman”
wherever it occurs andsubstituting the word
“ I n f o r m a t i o n
Commissioner”;(ii) in subsection (2), by deleting
the word “Ombudsman”
and substituting the words,“ I n f o r m a t i o n
Commissioner”; and2011

No. 13

Data Protection

2011(iii) by deleting subsection (3) andsubstituting the following subsection:“(3) The
decisionsoftheInformation Commissioner on issues
relating to this Act shall be binding on
Public Bodies.”; and(iv) by inserting after subsection (3) the
following new subsection:“(4) The Court shall havejurisdiction to hear and determine
applications by the Information
Commissioner for any Order which the
Court
considers appropriate tofacilitate the enforcement of any
provisions of this Act.;”(f) section 39, by repealing subsection (3); and(g) section 40, in—(i) subsections (1) and (2), by deleting
the words “The Minister” wherever
they occur and substituting thewords “The Information Commissioner”;and(ii) subsection (3)(d), by deleting theword “Ombudsman” and substituting
the word “Commissioner”.

57

58

No. 13

Data Protection

2011

SCHEDULEPART A(Section 8)
FORM OF OATH (AFFIRMATION) FOR INFORMATION COMMISSIONER
I, A. B. having been appointed Information Commissioner doswear by ……….....… (solemnly affirm) that I bear true faith andallegiance to Trinidad and Tobago and will uphold the Constitution
and the law, that I will conscientiously, impartially and to the bestof my knowledge, judgement and ability discharge the functions of
my office and do right to all manner of people after the laws andusages of Trinidad and Tobago without fear or favour, affection or
ill-will.
PART B(Section11)
FORM OF OATH (AFFIRMATION) FOR DEPUTY INFORMATIONCOMMISSIONER
I, A. B. having been appointed Deputy Information
Commissioner do swear by …....……… (solemnly affirm) that I beartrue faith and allegiance to Trinidad and Tobago and will uphold
the Constitution and the law, that I will conscientiously, impartiallyand to the best of my knowledge, judgement and ability discharge
the functions of my office and do right to all manner of people after
the laws and usages of Trinidad and Tobago without fear or favour,affection or ill-will.

No. 13

Data Protection

2011

Passed in the House of Representatives this 11th day
of February, 2011.

Clerk of the House

Passed in the Senate this 23rd day of May, 2011.

Clerk of the Senate

Senate Amendments agreed to by the House ofRepresentatives on this 3rd day of June, 2011.

Clerk of the House

59