12 October 2017
The Minister of Science, Energy and Technology, Andrew Wheatley, tabled, on 3 October 2017, a bill for the Data Protection Act, 2017 (‘the Bill’) in Parliament. If passed, the Bill would apply to data controllers established in Jamaica or in any place where Jamaican law applies by virtue of international public law, and to data controllers not established in Jamaica but that use equipment in the country for processing data, so long as not merely for transit purposes. The Bill contains a list of definitions of key concepts such as biometric data, consent, genetic data, health record, personal data and sensitive personal data; and provisions on data subjects’ rights.
Nicole Foga, Managing Partner at Foga Daley, told DataGuidance, “The Bill was tabled on 3 October 2017 and the first Jamaican newspaper article on the Bill was published on 6 October 2017, so it is highly probable that most companies are unaware that the Bill has been tabled and would, therefore, not yet have had the opportunity to review its contents […] While it is arguably premature to speculate on compliance levels, undoubtedly companies that are used to doing a lot of transactional business with companies in Europe and North America will already be familiar with data protection requirements. It is anticipated that the passage of this legislation will be welcomed by businesses whose trading partners were reluctant to do business in Jamaica due to the absence of a data protection legal framework.”
The Bill would prohibit data controllers from processing personal data if they have not registered with the Information Commissioner (‘the Commissioner’), and lists the information that would need to be provided when requesting registration. It also stipulates an annual registration fee. In addition, data controllers would be required to appoint a data protection officer (‘DPO’), who would need to be ‘appropriately qualified’ and whose appointment could not constitute a conflict of interest with respect to his/her other duties. The Bill also provides some of the functions the DPO would be expected to have, including assisting data subjects in the exercise of their rights and notifying the controller if the DPO believes the latter has contravened data protection law.
CARIFORUM entered into an Economic Partnership Agreement with the EU in October 2008, which included as one of its requirements that signatory countries ensure an adequate level of [data protection]
Foga continued, “It has been recognised since the liberalisation of Jamaica’s telecommunications market in 2000 that Jamaica needed data protection legislation as an important pillar in establishing a modern ICT framework. This is reflected in the Government of Jamaica’s 2011 ICT Policy, which states the need for an appropriate legal and regulatory framework that inter alia ‘addresses issues such as data/privacy protection and the criminal misuse of data.’ Additionally, Jamaica and 14 other members of the Caribbean Forum of the African, Caribbean and Pacific Group of States (‘CARIFORUM’), entered into an Economic Partnership Agreement with the EU in October 2008, which included as one of its requirements that signatory countries ensure an adequate level of [data protection].”
The Bill also sets out a series of standards data controllers must comply with when processing personal data, including the prohibition on transferring data outside of Jamaica unless the recipient country has an adequate data protection framework or one of the listed exemptions can be met. A data controller who processes personal data in contravention of any of the data protection standards or provisions could be subject to fines or imprisonment of up to seven years. Moreover, the Bill provides for the liability of body corporates and their directors, and compensation for individuals who suffer damage as a result of a data controller’s infringement of their legal obligations.
Foga concluded, “We have not yet had the opportunity to review in depth the 114-page Bill, but on a preliminary analysis, it would appear to cover the most pertinent issues and we certainly look forward to the debate on the adequacy of the legislative provisions and the public education campaign that will be necessary to raise the awareness of Jamaicans.”
Rachael Nelson-Daley | Privacy Analyst