JamaicaData Protection Act, 2020, automated decision-taking
Data Protection Act, 2020 (Act 7 of 2020), ss. 6(2)(d) and 12 (automated decision-taking)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Stop basing a decision that significantly affects a person solely on the automatic processing of their personal data used to evaluate matters such as performance at work, creditworthiness, reliability or conduct, once that person gives you written notice.
- Inform a person as soon as is reasonably practicable where you took such a decision without having received that notice, and give them a written statement within 30 days of the steps you will take where they require you to reconsider it.
- Explain to the data subject, on payment of the prescribed fee, the logic involved in automatic processing that is or is likely to be the sole basis for a decision significantly affecting them.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Section 12 lets an individual require that no significant decision be based solely on automatic processing, makes the controller tell the individual when such a decision was taken, and requires a written statement of the steps it will take if the individual asks for reconsideration; section 6(2)(d) gives a right to be told the logic involved. These are notices and explanations to the individual, and no provision makes the controller keep, show or produce a record of the decision. No scope clause is stated in the cited provisions.
- Kind
- None
- As of
What this law does
Section 12 entitles an individual at any time, by notice in writing, to require a data controller to ensure that no decision significantly affecting them is based solely on the processing by automatic means of personal data used to evaluate matters such as their performance at work, creditworthiness, reliability or conduct.
Where such a decision is taken without that notice the data controller must inform the individual as soon as is reasonably practicable, the individual may then require reconsideration or a fresh decision within thirty days, and the data controller must give a written statement of the steps it intends to take within thirty days of that notice.
Section 6 also entitles a data subject, on payment of the prescribed fee, to be informed of the logic involved in automatic processing that has constituted or is likely to constitute the sole basis for a decision significantly affecting them. The Act has been in force since , the day the Government of Jamaica confirmed as the Act's implementation date.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .