Growth & Jobs | Data Protection Act will protect J’cans, experts insist

Twenty-four-year-old Shirley Jackson (not her real name) was recently diagnosed with COVID-19. She contracted the disease while working at a business process outsourcing (BPO) centre in Jamaica.

The former customer service agent has since recovered from the disease after almost two months in a government-run quarantine facility. Now in better health, she is job hunting, and she is worried that her recent health challenges may pose a threat to future employment given the stigma associated with the virus.

Once the Jamaica Data Protection Act (JDPA) (2020), which was recently passed by the Houses of Parliament, is gazetted and has undergone its two years transitional period, Karen and many persons in a similar situation will not have to worry about their personal health records affecting future employment as the Act will protect their privacy.

Dr Sean Thorpe, professor and head of the School of Computing and Information Technology at the University of Technology, Jamaica said that while it is essential to make it clear that data protection can in no way be an obstacle to saving human lives, it is equally crucial to reaffirm that the exercise of human rights, and, notably, the rights to data privacy and protection, are still applicable.

“Arguably, this violation of a person’s basic right to privacy under these circumstances, is [protected] under the Data Protection Act,” he said.

BENEFIT FOR PUBLIC

Anthony Robinson, a certified information privacy manager and group data protection officer (DPO) at The Jamaica National Group, pointed out that members of the public stand to benefit greatly from the legislation.

He explained that the legislation defines the general principles for the processing of the personal data of an individual, provides for transparent oversight, and enables entities in the public and private sectors to strengthen their protection of personal data.

Robinson posits that this is based on two core aspects of the JDPA (2020). They are the legal rights over their personal data that persons will enjoy and the principles on how personal data is to be used or processed by organisations.

“The JDPA (2020) benefits us by creating a legal environment that protects how personal data is used by organisations,” he said.

“[The] JDPA will provide each person in Jamaica with specific rights that allow them to understand and determine how their personal data is used by organisations. This is the first time that individuals in Jamaica will have specific legal rights related to their personal data and how that data is used by organisations,” he said.

Robinson said that persons may choose at any time to exercise their rights and that organisations will have a specific time within which to respond. However, if organisations fail to respond in time, or if the individual is not satisfied with their responses, then they may express their concerns to the DPO at the relevant organisation or to the appointed information commissioner, the regulator for the JDPA.

Turning to the clause of the legislation, which speaks to the principles that govern how personal data is processed by organisations, Robinson said that the JDPA clearly defines eight standards or principles on which processing of personal data is to be based.

“Organisations must follow those standards to lawfully process personal data.These new legal rights and standards now provide the public with a significant degree of information and control over how their personal data is processed by organisations. This is all new in Jamaica,” Robinson said.

ENSURE OBEDIENCE TO LAW

He pointed out that the JDPA requires organisations that process personal data to ensure that they obey the law.

“The JDPA also makes it much easier for us to find out what organisations do with our personal data. We now have a legal right to know. We simply need to ask the organisation for that information. Data protection international best practice suggests that some of that information should be made available on the organisations’ websites,” he said.

Robinson explained that while an individual’s consent is required for the legal processing of personal data, the JDPA, like other modern data-protection laws, provides for exceptions so that organisations may process personal data where it is reasonable to expect that they should do so.

Those exceptions, he said, are clearly defined. In that way, the JDPA seeks to strike a balance between the rights of the individual and the needs of society to have organisations operating smoothly yet within the law.

“The Jamaica National Group is committed to increased accountability to our customers and employees,” said Robinson. “That increased accountability includes how we process personal data. Accordingly, we embrace data protection and the JDPA as being consistent with our ongoing commitment to our customers and employees.”