JamaicaData Protection Act, 2020, transfer of personal data outside Jamaica
Data Protection Act, 2020 (Act 7 of 2020), s. 31 (the eighth standard)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Do not transfer personal data to a State or territory outside of Jamaica unless that State or territory ensures an adequate level of protection for the rights and freedoms of data subjects.NIST Privacy FrameworkCT.PO-P2
- Assess adequacy on the nature of the personal data, the State or territory of origin and of final destination, the purposes and period of the intended processing, the law and international obligations of the receiving State or territory, any enforceable codes of conduct there, and the security measures applied to the data.NIST Privacy FrameworkID.DE-P2
- Rely on a case in section 31(4), such as the data subject's consent or the necessity of the transfer for a contract with the data subject, only where that case actually applies, or transfer on terms of a kind the Information Commissioner has approved.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 31 forbids transferring personal data to a State or territory outside Jamaica unless it ensures an adequate level of protection, lists the matters to weigh, the cases in which the standard does not apply (consent, contract, public interest, legal claims, vital interests, a public register, terms or authorization from the Commissioner, national security) and the Minister's power to prescribe adequate territories. It makes the controller assess adequacy and rely on a listed case, but states no duty to keep, show or produce a record of the assessment or the transfer. No scope clause is stated in section 31.
- Kind
- None
- As of
What this law does
The eighth standard is that personal data shall not be transferred to a State or territory outside of Jamaica unless that State or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
Adequacy is assessed in all the circumstances of the case, having regard in particular to the nature of the personal data, the State or territory of origin of the information and of its final destination, the purposes and the period of the intended processing, the law in force and the international obligations of the State or territory in question, any relevant enforceable codes of conduct, and the security measures taken in respect of the personal data there.
The standard does not apply where the data subject consents to the transfer, where the transfer is necessary for a contract with the data subject or for a contract made at the data subject's request or in their interests, for reasons of substantial public interest, for legal proceedings, legal advice or the establishment or defence of legal rights, to protect the data subject's vital interests, where the data is part of a public register open to inspection, or where the transfer is made on terms of a kind approved by the Commissioner, and the Minister may prescribe circumstances in which those cases do not hold.
The Act has been in force since , the day the Government of Jamaica confirmed as the Act's implementation date.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .