JamaicaData Protection Act, 2020, the Information Commissioner, penalties and compensation
Data Protection Act, 2020 (Act 7 of 2020), ss. 4, 44, 46-55, 61, 62, 67-69
In force since .
An enforcement supervision rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect the Information Commissioner to serve an enforcement notice requiring you to take specified steps, or to refrain from processing personal data, where the Commissioner is satisfied you have contravened a data protection standard.
- Comply with an enforcement notice, an assessment notice or an information notice from the Information Commissioner, and do not make a statement in purported compliance with one that you know, or recklessly disregard, to be false in a material respect.NIST Privacy FrameworkGV.PO-P5
- Do not knowingly or recklessly obtain, disclose or procure the disclosure of personal data without the consent of the data controller concerned, and do not sell or offer to sell personal data obtained that way.NIST Privacy FrameworkCT.PO-P1
- Compensate an individual who suffers damage by reason of your contravention of any requirement of the Act, and compensate distress where that individual also suffers damage or the contravention relates to processing for the special purposes.
- Expect a fine of up to four percent of your annual gross worldwide turnover for the preceding year of assessment where your company is convicted of an offence under the Act.
These lines are LexLint's reading of the law's text. Also read by: Office of the Information Commissioner (Jamaica) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Knowingly or recklessly obtaining, disclosing or procuring the disclosure of personal data without the data controller's consent, and selling or offering to sell personal data so obtained, are offences under section 61, liable on summary conviction in a Parish Court to a fine not exceeding JMD 5,000,000 or imprisonment not exceeding five years, and on conviction on indictment in a Circuit Court to a fine or imprisonment not exceeding ten years (s. 61(10)). Failing to comply with an enforcement notice, an assessment notice or an information notice, or making a knowingly or recklessly false statement in purported compliance with one, is an offence under section 52(1) and (2), liable on conviction in a Parish Court to a fine not exceeding JMD 1,000,000 (s. 52(4)). Where the offender is a body corporate, section 68(1) applies notwithstanding any other penalty specified in the Act and sets the fine at up to four percent of its annual gross worldwide turnover for the preceding year of assessment.
Penalty structure
Section 68(1) applies notwithstanding any other penalty specified in the Act and caps a body corporate's fine for any offence under the Act at four percent of its annual gross worldwide turnover for the preceding year of assessment, with section 68(2) directing the court to weigh the estimated economic cost to consumers and users, the economic benefit the body corporate derived, how long the contravention continued and the number and severity of its other offences under the Act. The fixed sums the Act states for particular offences bind a natural person: JMD 5,000,000 or five years on summary conviction under sections 61(10) and 19(5), JMD 2,000,000 or two years under section 21(2), JMD 2,000,000 or six months under section 18(3), and JMD 1,000,000 under section 52(4), with an unspecified fine available on conviction on indictment. The Commissioner has no power to impose an administrative fine, only to offer a fixed penalty in the prescribed amount under section 62 for the offences that section names.
- Rule
- Turnover pct only
- As of
- Currency
- JMD
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Office of the Information Commissioner
Settledness
- As of
- Guidance link
- https://www.oic.gov.jm/faq/will-data-controller-who-does-not-comply-requirements-act-be-penalized
- Guidance body
- Office of the Information Commissioner (Jamaica)
- Open questions
- What standard of care is 'all such care in all the circumstances as was reasonably required' under section 69(3) of the Data Protection Act, 2020, for a data controller to defeat an individual's claim for compensation?
What it reaches
Obligation class
Prohibition, Reporting
Applicability criteria
- As of
- Combinator
- Any of
- Criteria
- The data controller is established in Jamaica, or in any place where Jamaican law applies by virtue of international public law, and the personal data are processed in the context of that establishment (section 3(1)(a)).
- The data controller, though not established in Jamaica, uses equipment in Jamaica for processing the personal data otherwise than for the purpose of transit through Jamaica (section 3(1)(b)(i)).
- The data controller, though not established in Jamaica, processes personal data of a data subject who is in Jamaica, and the processing relates to offering products or services to data subjects in Jamaica or to monitoring their behaviour within Jamaica (section 3(1)(b)(ii)).
What it makes you log
Logging duty
The Commissioner may serve an enforcement notice (section 44), an assessment notice requiring the controller to direct the Commissioner to documents and equipment on its premises (section 47), and an information notice for information about the processing and its documentation (section 49), with entry and inspection under a warrant (section 55 and the Third Schedule). These are the regulator's own powers, exercised at its discretion, and none names a record the regulated party must keep, so no record duty is found. No scope clause is stated in the cited provisions.
- Kind
- None
- As of
What this law does
Section 4 establishes for the purposes of the Act an office to be known as the Information Commissioner, a body corporate that performs the functions the Act confers on it.
Where the Commissioner is satisfied that a data controller has contravened, or is contravening, any of the data protection standards, the Commissioner may serve an enforcement notice requiring specified steps within a specified time or requiring the controller to refrain from processing, and may also serve assessment notices and information notices and exercise the powers of entry and inspection in the Third Schedule.
An individual who is, or believes themselves to be, directly affected by processing may ask the Commissioner to assess whether it is carried out in compliance with the Act. Failing to comply with an enforcement notice, an assessment notice or an information notice, or making a knowingly or recklessly false statement in purported compliance with one, is an offence under section 52 carrying a fine of up to JMD 1,000,000 on conviction in a Parish Court.
Section 61 makes it an offence to knowingly or recklessly obtain, disclose or procure the disclosure of personal data without the consent of the data controller concerned, or to sell or offer to sell personal data so obtained, liable on summary conviction to a fine not exceeding JMD 5,000,000 or imprisonment not exceeding five years and on conviction on indictment to a fine or imprisonment not exceeding ten years.
Section 68(1) provides that notwithstanding any other penalty specified in the Act, a body corporate that commits an offence under the Act is liable to a fine not exceeding four percent of its annual gross worldwide turnover for the preceding year of assessment.
Section 69 entitles an individual who suffers damage by reason of a data controller's contravention of any requirement of the Act to compensation from that data controller, and to compensation for distress where the individual also suffers damage or the contravention relates to processing for the special purposes.
Proceedings for an offence under the Act may be instituted only by the Director of Public Prosecutions, or by the Commissioner with the Director's consent, and a person aggrieved by a decision of the Commissioner other than one of those notices may appeal to the Appeal Tribunal. The enforcement, penalty and compensation provisions in this row have been in force since , the day the Government of Jamaica confirmed as the Act's implementation date.
Section 4, establishing the Information Commissioner, had already come into operation on under an earlier appointed-day notice covering the Commissioner's institutional set-up.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .