JamaicaData Protection Act, 2020, rights of data subjects
Data Protection Act, 2020 (Act 7 of 2020), ss. 5-11 and 13
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Consent, Disclosure
- Audit expectation
- none
What it requires
- Answer a data subject's written access request promptly and in any event before the end of 30 days, saying free of charge whether you process their personal data and describing that data, the purposes of the processing and the recipients.NIST Privacy FrameworkCT.DM-P1
- Give the data subject, on payment of the prescribed fee, their personal data in an intelligible form together with any information you hold as to its source, or, where technically feasible, transmit it to another data controller in a structured, commonly used and machine-readable format.NIST Privacy FrameworkCT.PO-P3
- Identify in writing, within 30 days of the request, the provision you rely on where you refuse to disclose personal data to the data subject.NIST Privacy FrameworkCT.PO-P3
- Give a written statement within 21 days to a person who requires you to cease processing that causes substantial unwarranted damage or distress, saying whether you will comply and, where you will not, why.NIST Privacy FrameworkCT.PO-P3
- Determine within 30 days of a rectification request whether the personal data is inaccurate, correct it where it is, and give notice to the individual and to everyone the data was disclosed to in the preceding twelve months.NIST Privacy FrameworkCT.DM-P3NIST Privacy FrameworkCM.AW-P5
- Do not process personal data for direct marketing unless the data subject consents or is your customer, and do not approach the same data subject for that consent more than once.NIST Privacy FrameworkCT.PO-P1
- Carry in every direct marketing communication the identity of the sender and an address or other contact details the recipient can use to ask that the communication cease.NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CT.DM-P3Data elements can be accessed for alteration.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 5 to 13 give the data subject rights of access, to prevent processing, to object to direct marketing and to have inaccuracies rectified, with response periods of 21 or 30 days and a written statement or notice in some cases. They state response and notice duties, and none makes the controller keep, show or produce a record. No scope clause is stated in the cited provisions.
- Kind
- None
- As of
What this law does
On a written request a data subject is entitled to be told free of charge whether personal data of which they are the data subject is being processed, and to be given a description of that data, of the purposes of the processing and of the recipients or classes of recipients to whom it may be disclosed.
On payment of the prescribed fee the data subject may also have the data communicated in an intelligible form with any available information as to its source, or, where technically feasible, transmitted to another data controller in a structured, commonly used and machine-readable format.
A data controller shall comply with a request under section 6 promptly and, in any event, before the end of the period of thirty days, and must inform the individual in writing of a refusal and the provision relied on within thirty days after receiving the request.
An individual may require a data controller to cease or not to begin processing that causes substantial unwarranted damage or distress, or that rests on incomplete, irrelevant, unlawful or over-retained data, and the data controller must answer in writing within twenty-one days.
Section 13 requires a data controller that receives a rectification request to determine within thirty days whether a rectification is required, to amend, block, erase or destroy the data where it is, and to give notice of the rectification to the individual and, so far as reasonably practicable, to everyone the data was disclosed to in the preceding twelve months.
Section 10 bars processing personal data for direct marketing unless the data subject consents or is a customer of the data controller who was given a free and informal opportunity to object at collection and in each marketing communication. The Act has been in force since , the day the Government of Jamaica confirmed as the Act's implementation date.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .