Hosted by the Office of the Privacy Commissioner for Bermuda (PrivCom), the 45th Global Privacy Assembly annual meeting takes place at the Hamilton Princess & Beach Club in Bermuda from Sunday 15 October to Friday 20 October 2023. We are delighted to welcome the GPA to our corner of the world with Sunday’s opening panel, zooming in on data protection and privacy in the Caribbean region.
What are the data protection and privacy laws in Bermuda, the Bahamas, Barbados, or Jamaica? What are the experiences of the local regulators? These are some of the topics addressed by the 45th GPA’s introductory panel.
In conjunction with Privacy Commissioner for Bermuda Alexander White, Stewart Dresner (Chief Executive) and Laura Linkomies (Editor) of Privacy Laws & Business (PL&B) have developed the concept of the first panel of this year’s GPA. The session will feature interventions from the Data Protection Commissioners for Barbados and the Bahamas, or a representative of the Bermuda Government’s PATI/PIPA Unit, to name just a few.
The panelists have been handpicked and the panel designed to provide a round-up of the data protection and privacy laws and issues in the Caribbean; to raise awareness of, compare and contrast the laws and legal issue, including the differences between the jurisdictions; and to share experiences from new data protection and privacy authorities in small jurisdictions, as well as from organisations on any compliance challenges they face. This promises to be an exciting introduction to the GPA that will set the tone not only of the welcome reception, but the whole event. It is surely a panel not to be missed.
To further whet your appetite, let us give you a general background on data protection and privacy in the Caribbean.
The Caribbean region consists of numerous countries and territories, including a number of British Overseas Territories (BOTs), each with its own legal framework. To date, many countries in the Caribbean have established data protection authorities or regulatory bodies responsible for enforcing data protection and privacy laws, investigating breaches, and providing guidance to organisations and individuals. According to PL&B, the region now has 24 out of 32 jurisdictions with general purpose privacy laws.
As for the Caribbean Community (CARICOM), its own data protection and privacy rules provide for the protection of individuals’ privacy and personal information and organisations’ legal obligations to do so. The implementation by the CARICOM Secretariat of a privacy and data protection framework supports the objectives of the organisation’s respect for individuals’ fundamental human right to privacy and demonstrates the Secretariat’s preparedness to protect the individual whilst having regard to the relevant exemptions.
Data protection and privacy laws in the different Caribbean jurisdictions vary by country, territory, and size. However, many share a set of common principles and are influenced by international data protection and privacy standards, laws, and regulations, such as by the European Union's General Data Protection Regulation (GDPR), which many of them are inspired by or modelled after. These regulations and laws generally include principles such as proportionality/ data minimisation, purpose limitation, data integrity, responsibility, fairness, lawfulness, and transparency. There are other overarching principles that can be highlighted, such as individuals’ rights, sensitive personal information, data processing requirements, cross-border data transfers, and security measures.
Data protection laws in the Caribbean typically grant individuals certain rights over their personal information, including the right to access their personal information and the right to have their personal information corrected, blocked, erased, or destroyed. Some of these jurisdictions provide additional protections for sensitive categories of personal information, such as race/ethnicity, national origin, sex and sexual orientation, health, genetic or biometric information and others.
Data protection laws often require organisations in the Caribbean that collect and use personal information to implement appropriate security measures to protect personal information from unauthorized access, disclosure, alteration, or destruction. Organisations that collect and process personal information are often required to obtain individuals’ consent before they collect their information. They must also have a lawful basis for processing personal information, and may need to notify both regulatory authorities and individuals of data breaches.
Some Caribbean countries may have restrictions on transferring personal information outside of their jurisdiction. Organisations may have to ensure that data transferred to other countries meets specific requirements for protection. Additionally, Caribbean countries such as Jamaica may have sector-specific data protection laws or regulations that apply to telecommunications, financial services, or other industries.
Do you like the sound of the above? And there’s more. Check out the full agenda!
Don’t miss this once in a lifetime opportunity and register for the GPA annual meeting here!
If you are interested in sponsoring the event, a coffee break or lunch, please contact us for details regarding sponsorship packages at 543-7748 or PrivCom@privacy.bm.