The new requirements, which will come into effect on April 2, will be imposed under the Data Protection (Privacy of Personal Information) Act, one of three laws passed by legislators in 2003 to facilitate the development of e-government and e-commerce in the country.
In addition to the legislation the government recently announced the appointment of George E. Rodgers as the first Data Protection Commissioner.
Mr. Rodgers explained in an interview with the Bahama Journal that the overarching purpose of the new data protection regime, effected through the 30 sections and two schedules of the Data Protection Act [DPA], is to ensure that public and private sector entities maintain proper standards in the collection, use and disclosure of personal information.
Specifically, the DPA mandates that personal data must be collected by means which are both lawful and fair in the particular circumstances; that the information must be accurate and where necessary kept up to date; that it be kept only for specified and lawful purposes and that the personal information shall be adequate, relevant and not excessive in relation to the purpose for which it is taken and kept.
Additionally, the Act requires that personal data shall not be kept longer than is necessary; and that it must be kept secure to avoid unauthorised or unlawful use, accidental loss or damage.
Section 17 of the DPA empowers the Commissioner to prohibit the transfer of personal data from The Bahamas to another country if the destination country does not provide protection equivalent to that required by the DPA.
Section 8 of the Act provides that any individual who makes a written request to a data controller has a right to be informed by the data controller whether the data kept by the controller include personal information relating to the individual.
Further, the section stipulates that the individual has a right to be supplied with a copy of any such data and an explanation, if necessary, of any of the information which may not be clear.
Individuals making such requests are to be supplied with the information within 40 days.
Data controller is defined by the Act as "a person who, either alone or with others, determines the purposes for which and the manner in which any personal data are, or are to be, processed."
Another aim of the DPA is to enable residents to put a stop to unwanted direct marketing.
Following a written request from a concerned or aggrieved individual for the data controller to cease using the information in question for direct marketing, the data controller is required to erase, or discontinue using for direct marketing, all data that was kept for that purpose.
A key exception to the right of access, however, is that persons will not have a right to be supplied with their personal information if it is being kept for the purpose of preventing, detecting or investigating an offence or breach of agreement; apprehending or prosecuting offenders; or assessing or collecting any tax.
A collateral benefit of the new data protection regime, Mr. Rodgers said, is that it is expected to help increase The Bahamas’ profile as an international commercial centre.
"The Bahamas led the region in providing such comprehensive protection of this very fundamental human right to privacy," he said.
"Of course that generated interest within the international data industry in The Bahamas as a preferred jurisdiction for locating data services… If we can put these rules in place and the international community is happy with what we do then they could look to us as a jurisdiction for registering their data protection mechanisms."
The new data protection commissioner said in the weeks ahead he plans to visit religious and civic groups, trade unions and other organisations to educate them about the DPA and its specific requirements.
The Ministry of Finance encouraged officials in all public and private sector entities to read and familiarise themselves with the Act which can be viewed on the www.bahamas.gov.bs website.
Autor(en)/Author(s): Darrin Culmer
Quelle/Source: The Bahama Journal, 12.03.2007
