Data processing bill seen as having reach beyond Jamaica
Published:Sunday | July 19, 2020 | 12:26 AM
Businesses engaged in the practice of using private information shared by customers, such as emails and telephone contact, to promote their operation, could find themselves facing fines of up to $2 million under the Data Protection Act, DPA.
The bill is still to be enacted into law.
Data protection is increasingly a hot button issue as commerce and services migrate online – a shift that gained momentum under the lockdowns to contain the COVID-19 disease.
The updated DPA, which was passed in Parliament on May 19, was delayed for nearly two years, following the departure of former portfolio minister Dr Andrew Wheatley from the Cabinet at the height of the Petrojam scandal.
The new version expands on the territory of data controllers who will be held responsible for treatment of personal data.
“I thought this was very interesting. We’ve moved from the 2017 bill which only applied to companies established in Jamaica or had servers or equipment in Jamaica. We have seen an expansion of that in the 2020 bill ... ,” said Justine Collins, an attorney with law firm Hart Muirhead Fatta, during a webinar presentation last Tuesday.
“So, for example, a Facebook or Amazon offering goods or service or a company that’s tracking persons in Jamaica, they could fall within the ambit of this act even though they are not established in Jamaica. It’s a little ambitious …,” she said.
The webinar hosted by the Jamaica Stock Exchange eCampus sought to inform business owners of their new responsibilities in the handling of personal data under the DPA, and the rights of consumers regarding the treatment of their personal information.
Personal data, according to the bill, refers to information, however stored, relating to a living individual and has been expanded to include an individual who has been deceased for less than 30 years who can be identified from the information in the possession of a data controller or a company or person who processes the information on their behalf.
The eight data protection standards covered by the bill allows for fair and lawful processing of data, which ultimately means that consent must be obtained from the individual for collection of data that would be deemed necessary for compliance with legal obligations and administrative purposes.
Section 25 of the bill, which speaks to purpose limitation, also states that data controllers can obtain personal data for one or more specified and lawful reason, but can’t utilise it for other purposes.
The remaining standard covers data minimisation, accuracy, storage limitation, compliance and security – which stipulates that data controllers must have the appropriate and technical organisation measures regarding unauthorised or unlawful processing and against accidental loss or damage of data.
The final standard is data transfer which notes that personal data of Jamaica data subjects – individuals who have given up personal information for business use – should not be transferred outside of the country unless the territory ensures an adequate level of protection for rights and freedom of data subjects in processing personal data as prescribed by the minister of science, energy and technology.
The legislation provides for a commissioner who will monitor compliance with the act, give the minister advice and promote the observance of the requirements of the statute.
Section 21 of the DPA requires that all data controllers comply with the data protection standards but should a breach take place, notice should be given to the information commissioner.
A data controller who possesses information in contravention of the data protection standards can be fined up to $2 million or imprisoned for a maximum seven years.
“As to whether the information commissioner is sufficiently empowered to exercise these powers, is a separate discussion,” Collins said.
The DPA will become law after the governor general signs the legislation and it is gazetted.