ISSN 1728-5445 SERIES STUDIES AND PERSPECTIVES 94 ECLAC SUBREGIONAL HEADQUARTERS FOR THE CARIBBEAN Creating an enabling environment for e-government and the protection of privacy rights in the Caribbean A review of data protection legislation for alignment with the General Data Protection Regulation Amelia Bleeker Thank you for your interest in this ECLAC publication ECLAC Publications Please register if you would like to receive information on our editorial products and activities. When you register, you may specify your particular areas of interest and you will gain access to our products in other formats. www.cepal.org/en/publications ublicaciones www.cepal.org/apps ECLAC - Studies and Perspectives series-The Caribbean No. xxx Trade integration and production sharing... 1 94 Creating an enabling environment for e-government and the protection of privacy rights in the Caribbean A review of data protection legislation for alignment with the General Data Protection Regulation Amelia Bleeker This document was prepared by Amelia Bleeker, Associate Programme Management Officer of the Caribbean Knowledge Management Centre (CKMC) of the Economic Commission for Latin America and the Caribbean (ECLAC) subregional headquarters for the Caribbean. The views expressed in this document, which has been reproduced without formal editing, are those of the author and do not necessarily reflect the views of the Organization. United Nations publication ISSN: 1728-5445 (electronic version) ISSN: 1727-9917 (print version) LC/TS.2020/126 LC/CAR/TS.2020/4 Distribution: L Copyright (c) United Nations, 2020 All rights reserved Printed at United Nations, Santiago S.20-00657 This publication should be cited as: A. Bleeker, “Creating an enabling environment for e-government and the protection of privacy rights in the Caribbean: a review of data protection legislation for alignment with the General Data Protection Regulation”, Studies and Perspectives series-ECLAC Subregional Headquarters for the Caribbean, No. 94 (LC/TS.2020/126- LC/CAR/TS.2020/4), Santiago, Economic Commission for Latin America and the Caribbean (ECLAC),2020. Applications for authorization to reproduce this work in whole or in part should be sent to the Economic Commission for Latin America and the Caribbean (ECLAC), Publications and Web Services Division, [email protected]. Member States and their governmental institutions may reproduce this work without prior authorization but are requested to mention the source and to inform ECLAC of such reproduction. ECLAC - Studies and Perspectives series-The Caribbean No. 94 Creating an enabling environment... 3 Contents Abstract ................................................................................................................................................ 5 Introduction ......................................................................................................................................... 7 I. Background ............................................................................................................................... 9 A. Data protection, sharing and the development of e-government in the Caribbean ............ 9 B. The right to privacy in the digital age ................................................................................ 11 C. International and regional instruments and frameworks protecting the right to privacy .... 13 D. Key features of and interplay between data protection, sharing and related laws ............. 15 E. The European Union’s General Data Protection Regulation (GDPR) .................................. 18 1. Material and territorial scope ..................................................................................... 18 2. Key protections and features of the GDPR ................................................................. 19 3. Facilitating data flows and trade between EU and Caribbean countries ..................... 22 4. Last word on data protection? ................................................................................... 24 F. Research methodology ..................................................................................................... 25 II. Analysis of data protection legislation of select Caribbean countries.................................... 27 A. Overall findings ................................................................................................................. 27 B. Antigua and Barbuda ......................................................................................................... 28 1. Areas of non-alignment with the GDPR .....................................................................29 2. Main findings ............................................................................................................. 30 3. Summary of recommendations ................................................................................. 34 C. The Bahamas .................................................................................................................... 35 1. Areas of non-alignment with the GDPR ..................................................................... 35 2. Main findings ............................................................................................................. 37 3. Summary of recommendations ................................................................................. 42 D. Barbados ........................................................................................................................... 43 1. Areas of non-alignment with the GDPR ..................................................................... 43 ECLAC - Studies and Perspectives series-The Caribbean No. 94 Creating an enabling environment... 4 2. Main findings ............................................................................................................. 44 3. Summary of recommendations .................................................................................46 E. Belize ................................................................................................................................ 47 1. Areas of non-alignment with the GDPR ..................................................................... 47 2. Main findings .............................................................................................................49 3. Summary of recommendations ................................................................................. 53 F. Cayman Islands ................................................................................................................. 54 1. Areas of non-alignment with the GDPR ..................................................................... 54 2. Main findings ............................................................................................................. 56 3. Summary of recommendations .................................................................................60 G. Jamaica ............................................................................................................................. 61 1. Areas of non-alignment with the GDPR ..................................................................... 61 2. Main findings .............................................................................................................62 3. Summary of recommendations ................................................................................. 67 III. Recommendations.................................................................................................................. 69 A. Align national data protection legislation with the GDPR in order to guarantee privacy rights, support e-government and facilitate cross-border data flows and sharing ............. 69 B. Facilitate public and private sector information sharing through creating clear guidance and incentives for sharing ............................................... 72 C. Ensure data protection legislation adequately balances the right to privacy with press freedoms and freedom of expression................................................................ 73 D. Enable effective domestic and cross-border enforcement of Caribbean data protection laws through cooperation and adequate resourcing of supervisory authorities....... 75 E. Introduce independent oversight and safeguards to limit exercise of broad exemptions and exceptions to data protections .................................................. 77 Bibliography ....................................................................................................................................... 79 Annex ................................................................................................................................................. 83 Annex 1 .............................................................................................................................................. 84 Studies and Perspectives-The Caribbean Series: issues published. ......................................................89 Tables Table 1 Data protection, sharing and related legislation of Caribbean countries and territories .... 15 Table 2 Key features and protections in the General Data Protection Regulation (GDPR) ...... 19 Table 3 Alignment of selected data protection laws with the GDPR ....................................... 28 Table 4 Alignment of Antigua and Barbuda’s legislation with the GDPR ................................29 Table 5 Alignment of the Bahamas’