Identity theft and data protection

“I feel like a prisoner outside” were the words of University of Technology, Jamaica student Jevaun Peters to ‘Cliff Hughes Online’ on December 19, as he recounted his ordeal as a victim of identity theft.

In recent years, identity theft has been on the increase in Jamaica. Statistics on the prevalence of its occurrence is, however, not readily available. In the United States of America , identitytheft.org, the website of the National Council on Identity Theft Protection, recounts that there were over 5.7 million reports of fraud and identity theft, of which 1.4 million reports were of consumer identity theft to the Fair Trade Commission (FTC) in 2021. Further, identity theft cost Americans $5.8 billion in 2021.

A visit to the Jamaica Constabulary Force website in search of statistics on identity theft led to the only piece of information found on the subject, which recounted the impersonation of Superintendent Hopton Nicholson, using his name and photographs.

A similar pattern is at play in the case of Mr Peters, who, in his appeal to the public, asked that anyone who is contacted by his impersonators to make a report to the police.

Jevaun used his driver’s licence while making a purchase online. He later discovered that his identity was stolen when he began to receive calls regarding motor vehicles he had purportedly rented. As a result of his identity being stolen, Jevaun was arrested and spent eight days in the Half-Way Tree Police Station lockup. Consequently, he missed his exams at the university, and life for himself and his family has been stressful as they continue to deal with this ordeal.

JAMAICA’S EMERGING DIGITAL SOCIETY

The COVID-19 pandemic accelerated Jamaica’s adoption of e-commerce. Lockdowns as a control measure for the spread of the COVID-19 virus meant that companies who were desirous of continuing to offer their products and services to consumers, had to quickly transition and adapt to doing business digitally.

Today in Jamaica, there are several stores which operate exclusively in cyberspace, using platforms such as Instagram or e-commerce websites to reach their intended target audience. The ease of convenience which digital commerce offers also comes with its risk. Jevaun’s case brings to the fore the risk of identity theft, and, equally important, the question of how safe one’s personal data is when used digitally to make purchases.

Precisely what is identity theft? The FTC defines identity theft as the use of one’s personal and financial information without permission. Armed with your personal information, such as name, address, Tax Registration Number, credit cards, email address, phone number, etc, the impersonator can conduct business using your identity and bind you in arrangements which you know nothing of.

THE DATA PROTECTION ACT, 2020 AND ONLINE STORES

In ruminating on Jevaun’s ordeal, the question arises. Are online stores captured under Jamaica’s Data Protection Act, 2020 as data controller or processors? The answer to this question must be determined by considering the definition of data controllers under the Act, and further, data processors.

According to Section 2(1) of the Act: “data controller means any – (a) person; or (b) public authority, who, either alone or jointly or in common with other persons determines the purposes for which and the manner in which any personal data are, or are to be, processed, and where personal data are processed only for purposes for which they are required under any enactment to be processed, the person on whom the obligation to process the personal data is imposed by or under that enactment is for the purposes of this Act a data controller.

Data processor, in relation to personal data, means any person, other than an employee of the data controller, who processes the data on behalf of the data controller.”

MAKING THE CONNECTION

While the regulations to support the implementation of the Act is yet to be finalised ahead of the December 2023 timeline for the coming into force of the legislation, which would give further guidance to the operationalisation of its provisions, the definition of the data controller suggests that online stores such as the one Jevaun made his online purchase through is captured as data controllers.

The online store, in deciding that his driver’s licence was required to complete his purchase, satisfied the definition of a data controller.

Of note, the Act also further defined public authority as including companies registered under the Companies Act of Jamaica, and any other body or organisation which provides services of a public nature essential to Jamaicans. As such, assuming the online business was registered, it would automatically be captured as a data controller.

PROTECTION TO CONSUMERS

Under Section 6 of the Act, once in force, Jevaun would have a right to be informed by the data controller on whether his data is to be processed by the controller or on their behalf. Additionally, he is entitled to know why, by whom, and to whom his information is being disclosed. Such disclosures would help the consumer to keep track of their personal data and who has access to same.

Notwithstanding, you can also protect your identity by:

• Keeping personal information and documents safe and out of sight;

• Redacting personal information from sensitive documents;

• If mail is delivered to you, clear them from your mailbox in a timely manner – to include post offices;

• Use strong passwords and multifactor authentication;

• Interrogate any request for your personal information;

• Pull your credit report yearly for review and file dispute resolution, where applicable;

• Do not share personal data openly on social media.

LOOKING AHEAD

With an unknown number of businesses operating digitally, those registered and unregistered, the regulations to support the Act will be instructive in charting the way forward for compliance and protecting data subject’s rights. For sole traders and small businesses particularly, this could pose a resource challenge.

Will they be able to meet the regiments of the Act and pending regulations by having the required compliance framework in place? Will they be able to afford the systems and software aimed at securing personal data to prevent data incident and breaches? What will the oversight from the Office of the Information Commissioner look like? How will the National Identification System (NIDS), voluntary in nature, help to protect the integrity of one’s identity and assail identity theft?

These are but a few questions which will need to be answered as 2023 dawns and the Data Protection Act comes into force for Jamaica.

- Fabian E. Sanchez, JP, CIPM, Intl Dip AML, CAMS, CIRM, MBA, BBA, is a certified information privacy manager. Email feedback to AMLFundamentals@outlook.com and columns@gleanerjm.com.