Understanding Data Protection in Anguilla

Law Governing Data Protection in Anguilla?

All data-related protections come from Part 8 of the Electronic Transactions Act.

This Part includes two sections:

1.    Section 31 – Data Protection

2.    Section 32 – Pseudonyms

These sections provide the basic legislative framework, but they are extremely limited in terms of implementation without supporting regulations.

Basis for a Data Protection System

Section 31 gives the Governor in Council the authority to create regulations that would set standards for processing personal data. These standards could address important areas such as:

1. protecting individuals’ privacy
2. allowing data controllers or processors to voluntarily register to certain standards
3. creating a public register of who has registered
4. setting different rules for data from different countries

The Act also defines key terms such as “personal data,” “data controller,” “data processor,” and “processing.” These definitions are similar to those used in modern privacy laws around the world and could support a future regulatory framework.  However, the key issue is that no regulations have ever been implemented.

As a result, although the Act authorizes a data protection framework, none of the intended standards actually exist in practice, despite ongoing and prior discussions on the matter.

Challenge to Impose Criminal Penalties

Section 31 also sets out penalties for data controllers or processors who register to any future standard and then fail to comply with it. These penalties include:

1. a fine of up to EC $50,000
2. up to 6 months’ imprisonment
3. daily fines for ongoing non-compliance

But because no regulations exist unitl today, there are challenges that practitioners may face to trigger the penalties.

Use of Pseudonyms

Section 32 deals with the use of pseudonyms by information security service providers. It allows these providers to use something other than their real signature when providing services. The Act also allows for regulations to be created on this subject.  However, again, none have been implemented.

Reality of Data Protection in Anguilla

In the absence of a specific data-protection regime in Anguilla, there is no local compliance framework currently in force; however, internationally recognized data-protection standards remain applicable as guiding principles for organizations and individuals operating in the jurisdiction.

Modern privacy laws are often seen as essential infrastructure for digital growth. Unlike some other Caribbean islands, Anguilla does not have a Data Protection Commissioner or similar oversight body until today.

Despite the challenges, Anguilla has the beginnings of a data protection structure within the Electronic Transactions Act.  It is anticipated that the necessary regulations will be implemented creating and effective operational data protection law.

As global expectations for privacy continue to rise, Anguilla may eventually need to adopt either:

1. a full Data Protection Act, or
2. comprehensive regulations under the existing Act.

For now, the island remains in a position where the potential for a data protection regime exists, but the important pieces needed to activate it are being worked on. Considering that many island jurisdictions are following international guidelines, there is a general trend toward the regulation of data-protection matters.

Without prejudice to the above, the approach we recommend and generally apply is to align with internationally accepted privacy and data-protection standards.

Article provided by INPLP members: Keesha Fleming Lake and Virginia Cervieri (Cervieri Monsuarez, Anguilla)

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)