Education
Understanding Data Subject Rights Under Barbados' Data Protection Act 2019: A Comprehensive Overview
In light of recent data breaches, it is crucial to understand data subject rights under Barbados' Data Protection Act. This article highlights the importance of compliance and outlines the key rights individuals have concerning their personal information.
5 min read
Originally published by barbadostoday.bb (opens in new tab)
In light of several high-profile data breaches recently reported by regional businesses, it is essential to re-emphasise or enlighten those who may be unaware of their rights as data subjects, particularly when companies hold their personally identifiable information. Even with Barbados’ Data Protection Act 2019 in place, a concerning number of companies still fall short in fulfilling their compliance and responsibility mandates under this law.
This shortfall is evident in basic aspects such as websites failing to clearly articulate their privacy policies, or customer application forms not outlining their data protection policies or adequately disclosing the data rights of their customers. This gap in compliance not only exposes these businesses to risks but also jeopardises the security of their data subjects.
Since the Data Protection Act went into force on March 31, 2021, there has been an intensified focus on cybersecurity, a key compliance element of the Act. However, complying with the Data Protection Act is about much more than just cybersecurity.
The main objective of the Data Protection Act is to establish a strong and effective system dedicated to safeguarding personal data in Barbados. It aims to protect the privacy and security of an individual’s personal information, regulating how it is collected, processed, stored, and shared.
The Act aligns with international data protection standards and provides clear guidelines for both individuals and organisations, promoting the responsible handling of personal information. It defines specific rights for data subjects as well as obligations for data controllers and processors. The aim is to balance the privacy rights of individuals with the operational needs of businesses and organisations.
Let’s delve into the key rights it upholds. Here are the six most important ones:
-
The Right to be Informed: Data subjects are entitled to know how their personal data is being collected and used, including rectification of personal data as well as erasure of personal data.
-
The Right of Access: Individuals have the privilege of accessing their personal data and any supplementary information held about them.
-
The Right to Rectification: Data subjects can have any inaccurate personal data corrected or completed if it’s incomplete.
-
The Right to Erasure: Commonly referred to as the ‘right to be forgotten’, this allows individuals to request the deletion of their personal data.
