Fairness of Processing

5. (1) In determining whether personal data is processed fairly, regard is to be had to the method by which it is obtained, including in particular whether any person from whom the personal data is obtained is deceived or misled as to the purpose or purposes for which the personal data is to be processed.

(2) Subject to subsection (3), personal data is to be treated as having been obtained fairly if the personal data consists of information obtained from a person who is

(a) authorised by or under any enactment to supply the data; or

(b) required to supply by the data any convention or other instrument imposing an international obligation on Barbados.

(3) Personal data is not to be treated as processed fairly unless

(a) in the case of data obtained from the data subject, the data controller ensures so far as practicable that the data subject has, is provided with, or has readily available to him, the following information:

(i) the identity of the data controller;

(ii) where a data controller has nominated a representative for the purposes of this Act, the identity of that representative;

(iii) the purpose or purposes for which the data is intended to be processed; and

(iv) any further information which is necessary, having regard to the specific circumstances in which the data is or is to be processed, to enable processing in respect of the data subject to be fair; and

(b) in any other case, the data controller ensures so far as practicable that, before the relevant time or as soon as practicable after that time, the data subject is provided with, or has readily available to him, the information specified in subparagraphs (i) to (iv) of paragraph (a).

(4) For the purposes of subsection (3)(b), “the relevant time” means

(a) the time when the data controller first processes the data; or

(b) in a case where at that time disclosure to a third party within a reasonable period is envisaged,

(i) if the data is in fact disclosed to such a person within that period, the time when the data is first disclosed;

(ii) if within that period the data controller becomes, or ought to become aware that the data is unlikely to be disclosed to such a person within that period, the time when the data controller does become, or ought to become, so aware; or

(iii) in any other case, the end of that period.