JamaicaData Protection Act, 2020, conditions for processing sensitive personal data
Data Protection Act, 2020 (Act 7 of 2020), ss. 2(1), 24
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Biometric, Consent
- Audit expectation
- none
What it requires
- Do not process genetic data, biometric data, health data or any other sensitive personal data unless at least one condition in section 24 is met in addition to a condition in section 23.
- Treat a photograph or other facial image, finger print, palm print, iris scan, retina scan, vein pattern, gait, signature, keystroke pattern or voice that allows unique identification of an individual as biometric data, and therefore as sensitive personal data.
- Obtain the data subject's consent in writing before processing their sensitive personal data on the consent condition, and stop processing on that condition once the consent is withdrawn.
- Do not process sensitive personal data for medical purposes unless you are a health professional or a person who owes an equivalent duty of confidentiality.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 2(1) defines sensitive personal data and biometric data, and section 24 sets the conditions for processing sensitive personal data, the first being that the data subject consents in writing. A consent required to be given in writing is a condition of processing and the section does not say the controller must keep, show or produce a record of it. The medical-purposes condition and the other conditions state no record. No scope clause is stated in the cited provisions.
- Kind
- None
- As of
What this law does
Sensitive personal data is personal data consisting of genetic data or biometric data, filiation or racial or ethnic origin, political opinions or philosophical, religious or similar beliefs, trade union membership, physical or mental health or condition, sex life, or an alleged offence by the data subject and any proceedings for it.
Biometric data is any information relating to the physical, physiological or behavioural characteristics of an individual which allows for the unique identification of the individual, and the definition names the photograph or other facial image, finger print, palm print, iris scan, retina scan, blood type, height, vein pattern and eye colour among the physical characteristics and gait, signature, keystrokes and voice among the behavioural ones.
Section 24 permits processing sensitive personal data only where at least one condition in that section is met in addition to a condition in section 23, and the first of those conditions is the data subject's consent in writing.
The other conditions include an employment or social security right or obligation, protection of vital interests where consent cannot be obtained, legitimate activity of a not-for-profit body acting for its members with appropriate safeguards, data the data subject has deliberately made public, legal proceedings or advice, the administration of justice, fraud prevention through an anti-fraud organisation, medical purposes undertaken by a health professional or a person owing an equivalent duty of confidentiality, and equality of opportunity monitoring by racial or ethnic origin.
A data subject may at any time withdraw consent to the processing of sensitive personal data in respect of that data subject. Section 24's conditions for processing sensitive personal data have been in force since , the day the Government of Jamaica confirmed as the Act's implementation date.
The section 2 definitions this row also draws on, including the definition of biometric data, had already come into operation on under an earlier appointed-day notice covering the Information Commissioner's institutional set-up.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .