Q: What is data protection?
A: Data protection is framework of laws, regulations, policies and procedures that aim to govern the processing of personal data and sensitive personal data including the protection of such data from unauthorized access, and relates to the use, retention, disclosure, alteration or destruction of such information.
Q: What law governs data protection in Jamaica?
A: The Data Protection Act 2020 (“DPA”).
Q: Who is a Data Controller?
A: A Data Controller is any person or public authority who, alone or jointly or in common with another, determines the purposes for which and the manner in which personal data are, or are to be, processed. Where personal data are required to be processed under any law, the person on whom the obligation to process the personal data is imposed by or under that law is a Data Controller.
Q: Who is a data subject?
A: A data subject is a named or otherwise identifiable individual who is the subject of personal data that is being processed by a Data Controller.
Q: What categories of data is covered by the DPA?
A: The DPA covers personal data and sensitive personal data of a data subject. Personal Data refers to information (however stored) relating to a living individual or an individual who has been deceased for less than 30 years, that can directly or indirectly identify the data subject. It includes expressed opinions about the individual and any indicated intentions of the data controller or another person toward that individual.
Sensitive Personal Data is special category of personal data of a data subject such as:
- genetic data or biometric data;
- filiation, racial, or ethnic origin;
- political opinions, philosophical beliefs, religious beliefs or other beliefs of a similar nature;
- membership in any trade union;
- physical or mental health or condition;
- sex life; or
- the alleged commission of any offence by the data subject or any proceedings for any offence alleged to have been committed by the data subject.
Q: What body regulates and supervises data protection in Jamaica?
A: The Office of the Information Commissioner (OIC). The duties of the OIC include monitoring compliance with the DPA and disseminating information to the public regarding the operation of the DPA as well as guidelines for good practice.
Q: Who is required to register with the Office of the Information Commissioner (OIC)?
All Data Controllers are required to register with the OIC prior to processing any personal data of a data subject.
Q: Is registration with the OIC a one-time requirement?
A: No, a Data Controller must renew its registration annually with the OIC.
Q: Who is required to appoint a Data Protection Officer?
A: A Data Controller who:
- is a public authority;
- processes or intends to process sensitive personal data or data relating to criminal convictions;
- processes personal data on a large scale; or
- falls within a class prescribed by the Information Commissioner by notice in the Gazette
is required to appoint a Data Protection Officer.
Q: What are the 8 data protection standards?
A: The DPA outlines 8 Data Protection Standards which are based on the following principles:
- Fairness and Lawfulness
- Purpose Limitation
- Data Minimization
- Accuracy
- Storage Limitation
- Rights of the Data Subject
- Implementation of Technical and Organizational Measures; and
- Cross-border transfers.
Q: Does the DPA apply to entities who are not established in Jamaica?
A: The DPA applies to entities who are not established in Jamaica if they:
- uses equipment in Jamaica for processing the personal data otherwise than for the purpose of transit through Jamaica; or
- processes personal data, of a data subject who is in Jamaica, and the processing activities are related to—
- the offering of products or services to data subjects in Jamaica, irrespective of whether a payment of the data subject is required; or
- the monitoring of the behaviour of data subjects as far as their behaviour takes place within Jamaica.
Such entities must appoint a representative established in Jamaica for the purposes of the DPA.
