THE HAGUE – Curaçao's system for protecting personal data falls significantly short of international standards and lacks effective independent oversight, according to a warning issued by the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP).
In advice submitted to the Dutch State Secretary for Justice and Security, the watchdog expressed serious concerns about privacy protection in the Caribbean parts of the Kingdom, including Curaçao, Aruba, and Sint Maarten. According to the AP, the differences between data protection standards in the Caribbean countries and those in the European Netherlands are so significant that stricter monitoring of cross-border data transfers is becoming necessary.
"Patchwork" of Privacy Laws
The Dutch privacy regulator described the legal framework governing personal data protection in the Caribbean part of the Kingdom as a "patchwork."
According to the AP, not only do Curaçao, Aruba, and Sint Maarten provide a lower level of protection than exists under European Dutch legislation, but there is also a lack of effective supervision by independent authorities responsible for enforcing privacy laws.
The watchdog stated that oversight and enforcement in these countries are effectively "non-existent," raising concerns about the protection of personal information belonging to citizens, businesses, and government agencies.
Concerns Over Council of Europe Convention
The warning comes as the Kingdom prepares to approve the revised Convention 108+ of the Council of Europe, an international treaty designed to establish a high and comparable standard of personal data protection across participating countries.
While the AP supports the implementation of the convention, it fears that the legislation needed to enforce the treaty in the Caribbean countries may take years to materialize. As a result, significant gaps in privacy protection could remain in place even after the treaty is formally adopted.
According to the authority, the delay could undermine the goal of creating a consistent level of protection throughout the Kingdom.
Impact on Government and Business
The AP warns that the issue is not merely theoretical.
As long as Curaçao and the other Caribbean countries do not offer a level of protection equivalent to that of the European Netherlands, the transfer of personal data between the different parts of the Kingdom remains legally sensitive.
This affects not only private companies but also government institutions that regularly exchange personal information, including law enforcement agencies, prosecutors, and judicial authorities.
The regulator noted that data transfers should only occur when adequate legal safeguards are in place and when individuals have enforceable rights and access to effective legal remedies if their privacy rights are violated.
Increased Monitoring Planned
In response to the situation, the Dutch Data Protection Authority announced that it intends to intensify its supervision of international data flows involving the Caribbean countries of the Kingdom.
The organization believes closer oversight is necessary until stronger privacy protections and enforcement mechanisms are established.
The AP also urged the Dutch government and the governments of Curaçao, Aruba, and Sint Maarten to work together to achieve a comparable level of privacy protection throughout the Kingdom.
Opportunity for Reform
According to the watchdog, the implementation of Convention 108+ presents an important opportunity to address existing shortcomings and modernize privacy legislation across the Caribbean countries.
The authority stressed that significant interests are at stake, including the protection of citizens' personal information, the legal certainty of cross-border data exchanges, and the ability of government agencies to cooperate efficiently while respecting privacy rights.
The warning is likely to increase pressure on policymakers in Curaçao and the other Caribbean countries to strengthen data protection legislation and establish independent supervisory mechanisms capable of enforcing privacy standards in line with international norms.