Understanding Data Protection Rights: Exploring the Impact of the DPA 2019 on Human Resources Management in Barbados

Last Wednesday, I had the honour of representing the Human Resources Management Association of Barbados (HRMAB) on the Caribbean Broadcasting Corporation’s (CBC) Morning Barbados show. The topic was the Data Protection Act (DPA) 2019 and its impact on Human Resources Management.

It’s not difficult to understand that the DPA is one of the most significant Acts that has received little national recognition. When the host and I began our discussion, it became clear that the average person has little awareness of their basic Data Protection Rights. These rights are considered fundamental and are closely related to human rights, particularly the right to privacy. This right is recognised in international human rights law, including the Universal Declaration of Human Rights (Article 12) and the International Covenant on Civil and Political Rights (Article 17), which protect individuals from arbitrary interference with their privacy.

To illustrate the general lack of awareness, one needs only to observe how many citizens sign up for raffles or membership programmes by filling out forms that disclose a lot of personal data, often without any attached Data Privacy Notice or information on where such a notice could be found. A privacy notice is a statement provided to individuals (data subjects) that explains how their personal data is collected, used, shared and protected by an organisation.

The greater offenders, I believe, are to be found in the retail and hospitality sectors, including supermarkets and hotels. These establishments use customer management systems that track a lot of personal data but have not published their Data Privacy policies.

The fact is, no rewards programme or customer profiling system should be implemented without the requisite Data Privacy Programme in place to ensure the rights of Data Subjects are safeguarded.

Whether you are a customer/client or an employee, what are your rights and how should they be respected?

The Barbados DPA 2019 enshrines several key rights for data subjects to ensure their personal data are handled with care and respect. These rights are designed to empower individuals and provide them with control over their personal information:

1. Right to Information: At the time of data collection, data subjects (whether customers or employees) must be clearly informed about how their personal data will be used. This is typically communicated through a privacy notice or on the back of an application form. Transparency is key, ensuring that individuals understand the purposes for which their data is being collected and processed. In an HR setting, the time of collection may be during a job application process.