Processes personal data, in Jamaica

Data Protection Act, 2020 (Act 7 of 2020), s. 31 (the eighth standard) · Read the law's page

• Do not transfer personal data to a State or territory outside of Jamaica unless that State or territory ensures an adequate level of protection for the rights and freedoms of data subjects.
• Assess adequacy on the nature of the personal data, the State or territory of origin and of final destination, the purposes and period of the intended processing, the law and international obligations of the receiving State or territory, any enforceable codes of conduct there, and the security measures applied to the data.
• Rely on a case in section 31(4), such as the data subject's consent or the necessity of the transfer for a contract with the data subject, only where that case actually applies, or transfer on terms of a kind the Information Commissioner has approved.

Data Protection Act, 2020 (Act 7 of 2020), ss. 2(1), 24 · Read the law's page

• Do not process genetic data, biometric data, health data or any other sensitive personal data unless at least one condition in section 24 is met in addition to a condition in section 23.
• Treat a photograph or other facial image, finger print, palm print, iris scan, retina scan, vein pattern, gait, signature, keystroke pattern or voice that allows unique identification of an individual as biometric data, and therefore as sensitive personal data.
• Obtain the data subject's consent in writing before processing their sensitive personal data on the consent condition, and stop processing on that condition once the consent is withdrawn.
• Do not process sensitive personal data for medical purposes unless you are a health professional or a person who owes an equivalent duty of confidentiality.

Data Protection Act, 2020 (Act 7 of 2020), ss. 21(2)-(5), 30(1)(b), (4)-(5) · Read the law's page

• Report any security breach in respect of your operations which affects or may affect personal data, and any contravention of the data protection standards, to the Information Commissioner within 72 hours of becoming aware of the breach or contravention, in the prescribed form and manner.
• Notify the Information Commissioner without undue delay of any breach of your security measures which affects or may affect personal data.
• Notify each data subject whose personal data is affected by the breach, upon becoming aware of the breach or having reason to become aware of it, of the nature of the breach, of the measures taken or proposed to address it, and of your data protection officer's contact information, in the form, manner and time prescribed.
• Set out in the report to the Information Commissioner the facts of the breach, its nature including the categories and number of data subjects and the type and number of personal data concerned, the measures taken or proposed to mitigate it, its consequences, and your data protection officer's contact information.
• Engage a data processor only where it gives sufficient guarantees as to the reporting of security breaches to you, under a written contract binding it to obligations equivalent to your own.
• Expect the Information Commissioner, on receiving your report, to serve an enforcement notice or to direct you to tell affected data subjects what the Commissioner thinks fit about the breach and the measures addressing it.

Data Protection Act, 2020 (Act 7 of 2020), ss. 3, 14-20, 21(1), 22, 23, 25-30, 45 · Read the law's page

• Register with the Office of the Information Commissioner before processing personal data, and keep your registration particulars in the register the Commissioner maintains.
• Appoint a representative established in Jamaica if you are not established there but process the personal data of data subjects in Jamaica to offer them goods or services or to monitor their behaviour.
• Have at least one condition under section 23 for every processing operation, such as the data subject's consent, the performance of a contract, a legal obligation, or a legitimate interest that is not outweighed by the data subject's rights and freedoms.
• Give the data subject your identity, the identity of your data protection officer, the purposes of the processing, the recipients you contemplate disclosing to, the expected retention period and the legal authority for seeking the data, before you first process it.
• Obtain personal data only for one or more specified and lawful purposes, and do not further process it in a manner incompatible with those purposes.
• Hold no more personal data than is adequate, relevant and limited to what is necessary for the purpose, keep it accurate and up to date, and do not keep it for longer than that purpose requires.
• Take appropriate technical and organisational measures, including pseudonymisation and encryption, against unauthorised or unlawful processing of personal data and against its accidental loss, destruction or damage.
• Engage a data processor only under a written contract under which it acts on your instructions alone and carries obligations equivalent to your own security measures.
• Appoint a qualified data protection officer with no conflict of interest if you are a public authority, process sensitive personal data or data relating to criminal convictions, or process personal data on a large scale, and give the Commissioner that officer's name and contact information.
• Submit a data protection impact assessment covering all personal data in your custody or control to the Information Commissioner within 90 days after the end of each calendar year.

Data Protection Act, 2020 (Act 7 of 2020), ss. 4, 44, 46-55, 61, 62, 67-69 · Read the law's page

• Expect the Information Commissioner to serve an enforcement notice requiring you to take specified steps, or to refrain from processing personal data, where the Commissioner is satisfied you have contravened a data protection standard.
• Comply with an enforcement notice, an assessment notice or an information notice from the Information Commissioner, and do not make a statement in purported compliance with one that you know, or recklessly disregard, to be false in a material respect.
• Do not knowingly or recklessly obtain, disclose or procure the disclosure of personal data without the consent of the data controller concerned, and do not sell or offer to sell personal data obtained that way.
• Compensate an individual who suffers damage by reason of your contravention of any requirement of the Act, and compensate distress where that individual also suffers damage or the contravention relates to processing for the special purposes.
• Expect a fine of up to four percent of your annual gross worldwide turnover for the preceding year of assessment where your company is convicted of an offence under the Act.

Data Protection Act, 2020 (Act 7 of 2020), ss. 5-11 and 13 · Read the law's page

• Answer a data subject's written access request promptly and in any event before the end of 30 days, saying free of charge whether you process their personal data and describing that data, the purposes of the processing and the recipients.
• Give the data subject, on payment of the prescribed fee, their personal data in an intelligible form together with any information you hold as to its source, or, where technically feasible, transmit it to another data controller in a structured, commonly used and machine-readable format.
• Identify in writing, within 30 days of the request, the provision you rely on where you refuse to disclose personal data to the data subject.
• Give a written statement within 21 days to a person who requires you to cease processing that causes substantial unwarranted damage or distress, saying whether you will comply and, where you will not, why.
• Determine within 30 days of a rectification request whether the personal data is inaccurate, correct it where it is, and give notice to the individual and to everyone the data was disclosed to in the preceding twelve months.
• Do not process personal data for direct marketing unless the data subject consents or is your customer, and do not approach the same data subject for that consent more than once.
• Carry in every direct marketing communication the identity of the sender and an address or other contact details the recipient can use to ask that the communication cease.