Data Protection Act, 2011, Commissioner, contravention and enforcement

Sections 7 to 18 establish the Office of the Information Commissioner as a body corporate, provide for the appointment, tenure, removal, remuneration and oath of the Commissioner and up to two Deputy Commissioners, and give the Commissioner powers to audit and investigate compliance, order a public body or organisation to cease a contravening practice, authorise data matching, make orders on fee reasonableness and compliance with the General Privacy Principles, and publish compliance guidelines.

Section 10 gives the Commissioner functions including promoting codes of conduct, disseminating information about the Act, monitoring compliance, cooperating with counterparts in other jurisdictions, researching privacy issues, flagging a body's failure to meet the Principles or Part III or Part IV, publishing compliance reports, and reviewing privacy impact assessments.

Section 25(1) bars the Commissioner and anyone acting under the Commissioner's direction from disclosing information obtained in performing their duties, and section 28 requires the Commissioner to publish a list of countries with comparable safeguards for personal information.

All of these provisions, together with the rest of Part I, came into force on 6 January 2012, so Trinidad and Tobago currently has an operating Information Commissioner with these powers and functions, even though the Parts the Commissioner would chiefly enforce, Part III and Part IV, are not yet proclaimed.

Not commenced within Part II are the designation of inspectors (section 19), the Commissioner's power to audit or enquire pursuant to Part III (section 20) or Part IV (section 21), privileged information (section 24), the exceptions to the Commissioner's confidentiality obligation (section 25(2) and (3)), and the Commissioner's annual report to Parliament (section 27).

Part V, sections 87 to 96, would make it an offence to obstruct the Commissioner, make a false statement, fail to comply with a Commissioner order, violate the whistle-blowing protection, breach a mandatory code of conduct, wilfully disclose or unlawfully collect personal information in contravention of the Act, or breach the Commissioner's own confidentiality obligation under section 25, and would penalise an individual offender with a fine of up to $100,000 or five years' imprisonment on indictment and a body corporate with a fine of up to $500,000 on indictment or up to ten percent of annual turnover.

Part V is not shown as commenced: section 1(2) does not name it among the provisions brought into force on 6 January 2012, so none of the Act's offences or penalties currently apply, and a contravention of the General Privacy Principles, including the confidentiality obligation in section 25(1) that already binds the Commissioner's own office, cannot presently be prosecuted under this Act.