Jamaica

Issued by the Chief Justice, this Practice Direction applies to all proceedings before the Supreme Court of Judicature, the Revenue Court, and both divisions of the Gun Court, and governs the use of generative AI tools by attorneys-at-law, parties, and self-represented litigants.

It requires a declaration, in a prescribed form, whenever any part of a document submitted to the Court was prepared with the assistance of generative AI, and requires that such content be thoroughly reviewed, verified, and approved before submission. It prohibits using generative AI to draft or alter affidavits or witness statements, to generate expert evidence, or to create material intended to be tendered into evidence unless the Court authorises it.

Submitting inaccurate, fictitious, or misleading generative-AI content can lead the Court to refuse the document, disregard the submission, or make a costs order, and non-compliance may constitute contempt of court or lead to referral to the General Legal Council's Disciplinary Committee.

Section 21(3) requires a data controller to report to the Commissioner, in such form and manner as shall be prescribed, any contravention of the data protection standards and any security breach in respect of the data controller's operations which affects or may affect personal data, within seventy-two hours after becoming aware of the contravention or security breach.

The report must set out the facts surrounding it, a description of its nature including the categories and number of data subjects concerned and the type and number of personal data concerned, the measures taken or proposed to mitigate or address its possible adverse effects, its consequences, and the name, address and contact information of the data controller's data protection officer.

Section 21(5) requires the data controller, upon becoming aware of or having reason to become aware of the contravention or breach, to notify each data subject whose personal data is affected of its nature, of the measures taken or proposed to mitigate or address its possible adverse effects, and of the data protection officer's contact information.

That notification is to be given in such form and manner, and within such time, as shall be prescribed, and the Act states no period of its own for it. The seventh standard separately requires appropriate measures to ensure that the Commissioner is notified, without any undue delay, of any breach of the data controller's security measures which affect or may affect any personal data.

The same standard requires a data controller using a data processor to choose one that gives sufficient guarantees as to the reporting of security breaches to the data controller, and to bind it by written contract to obligations equivalent to the controller's own. On receiving a report the Commissioner may serve an enforcement notice or direct the data controller to give affected data subjects such information about the contravention or breach as the Commissioner thinks fit.

Failing to make a report or notification required by section 21(3) or (5) is an offence under section 21(2). The Act is in force: it reached its appointed day under the Appointed Day Notice gazetted in 2023, the mechanism its own commencement clause leaves to a notice published in the Gazette, and no notice stating the day itself has been located.

The Act reaches a data controller established in Jamaica whose processing is carried out in the context of that establishment, and a controller established elsewhere that uses equipment in Jamaica or processes the personal data of a data subject who is in Jamaica in connection with offering goods or services to, or monitoring the behaviour of, data subjects in Jamaica, and a controller in the second class must appoint a representative established in Jamaica.

Section 15 prohibits a data controller from processing personal data unless its registration particulars are included in the register maintained by the Information Commissioner.

The first standard requires personal data to be processed fairly and lawfully and permits processing only where at least one condition in section 23 is met, such as the data subject's consent, the performance of a contract, a legal obligation, or a legitimate interest of the data controller that is not outweighed by the data subject's rights.

Fair processing also requires the data subject to be given the identity of the data controller and of its data protection officer, the purposes of the processing, the recipients contemplated, the expected retention period and the legal authority for seeking the data.

The second standard limits personal data to one or more specified and lawful purposes and bars further processing in a manner incompatible with those purposes, and the third, fourth and fifth standards require the data to be adequate, relevant and limited to what is necessary, to be accurate and up to date, and to be kept no longer than the purpose requires.

The seventh standard requires appropriate technical and organisational measures, including pseudonymisation and encryption, against unauthorised or unlawful processing and against accidental loss or destruction, and allows processing by a data processor only under a written contract under which the processor acts on the data controller's instructions alone and carries equivalent obligations.

Section 20 requires a public authority, a data controller processing sensitive personal data or data relating to criminal convictions, and a data controller processing personal data on a large scale, to appoint a qualified data protection officer who is free of any conflict of interest and monitors compliance in an independent manner.

Section 45 requires a data controller to submit a data protection impact assessment covering all personal data in its custody or control to the Commissioner within 90 days after the end of each calendar year.

The eighth standard is that personal data shall not be transferred to a State or territory outside of Jamaica unless that State or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

Adequacy is assessed in all the circumstances of the case, having regard in particular to the nature of the personal data, the State or territory of origin of the information and of its final destination, the purposes and the period of the intended processing, the law in force and the international obligations of the State or territory in question, any relevant enforceable codes of conduct, and the security measures taken in respect of the personal data there.

The standard does not apply where the data subject consents to the transfer, where the transfer is necessary for a contract with the data subject or for a contract made at the data subject's request or in their interests, for reasons of substantial public interest, for legal proceedings, legal advice or the establishment or defence of legal rights, to protect the data subject's vital interests, where the data is part of a public register open to inspection, or where the transfer is made on terms of a kind approved by the Commissioner, and the Minister may prescribe circumstances in which those cases do not hold.

The Act is in force: it reached its appointed day under the Appointed Day Notice gazetted in 2023, the mechanism its own commencement clause leaves to a notice published in the Gazette, and no notice stating the day itself has been located.

On a written request a data subject is entitled to be told free of charge whether personal data of which they are the data subject is being processed, and to be given a description of that data, of the purposes of the processing and of the recipients or classes of recipients to whom it may be disclosed.

On payment of the prescribed fee the data subject may also have the data communicated in an intelligible form with any available information as to its source, or, where technically feasible, transmitted to another data controller in a structured, commonly used and machine-readable format, and may be informed of the logic involved in automatic processing that has constituted or is likely to constitute the sole basis for a decision significantly affecting them.

A data controller shall comply with a request under section 6 promptly and, in any event, before the end of the period of thirty days, and must inform the individual in writing of a refusal and the provision relied on within thirty days after receiving the request.

Section 12 entitles an individual at any time, by notice in writing, to require a data controller to ensure that no decision significantly affecting them is based solely on the processing by automatic means of personal data used to evaluate matters such as their performance at work, creditworthiness, reliability or conduct.

Where such a decision is taken without that notice the data controller must inform the individual as soon as is reasonably practicable, the individual may then require reconsideration or a fresh decision within thirty days, and the data controller must give a written statement of the steps it intends to take within thirty days of that notice.

An individual may require a data controller to cease or not to begin processing that causes substantial unwarranted damage or distress, or that rests on incomplete, irrelevant, unlawful or over-retained data, and the data controller must answer in writing within twenty-one days.

Section 13 requires a data controller that receives a rectification request to determine within thirty days whether a rectification is required, to amend, block, erase or destroy the data where it is, and to give notice of the rectification to the individual and, so far as reasonably practicable, to everyone the data was disclosed to in the preceding twelve months.

Section 10 bars processing personal data for direct marketing unless the data subject consents or is a customer of the data controller who was given a free and informal opportunity to object at collection and in each marketing communication. The Act is in force: it reached its appointed day under the Appointed Day Notice gazetted in 2023, the mechanism its own commencement clause leaves to a notice published in the Gazette, and no notice stating the day itself has been located.

Section 4 establishes for the purposes of the Act an office to be known as the Information Commissioner, a body corporate that performs the functions the Act confers on it.

Where the Commissioner is satisfied that a data controller has contravened, or is contravening, any of the data protection standards, the Commissioner may serve an enforcement notice requiring specified steps within a specified time or requiring the controller to refrain from processing, and may also serve assessment notices and information notices and exercise the powers of entry and inspection in the Third Schedule.

An individual who is, or believes themselves to be, directly affected by processing may ask the Commissioner to assess whether it is carried out in compliance with the Act. Failing to comply with an enforcement notice, an assessment notice or an information notice, or making a knowingly or recklessly false statement in purported compliance with one, is an offence under section 52 carrying a fine of up to JMD 1,000,000 on conviction in a Parish Court.

Section 61 makes it an offence to knowingly or recklessly obtain, disclose or procure the disclosure of personal data without the consent of the data controller concerned, or to sell or offer to sell personal data so obtained, liable on summary conviction to a fine not exceeding JMD 5,000,000 or imprisonment not exceeding five years and on conviction on indictment to a fine or imprisonment not exceeding ten years.

Section 68(1) provides that notwithstanding any other penalty specified in the Act, a body corporate that commits an offence under the Act is liable to a fine not exceeding four percent of its annual gross worldwide turnover for the preceding year of assessment.

Section 69 entitles an individual who suffers damage by reason of a data controller's contravention of any requirement of the Act to compensation from that data controller, and to compensation for distress where the individual also suffers damage or the contravention relates to processing for the special purposes.

Proceedings for an offence under the Act may be instituted only by the Director of Public Prosecutions, or by the Commissioner with the Director's consent, and a person aggrieved by a decision of the Commissioner other than one of those notices may appeal to the Appeal Tribunal.

The Act is in force: it reached its appointed day under the Appointed Day Notice gazetted in 2023, the mechanism its own commencement clause leaves to a notice published in the Gazette, and no notice stating the day itself has been located.

Sensitive personal data is personal data consisting of genetic data or biometric data, filiation or racial or ethnic origin, political opinions or philosophical, religious or similar beliefs, trade union membership, physical or mental health or condition, sex life, or an alleged offence by the data subject and any proceedings for it.

Biometric data is any information relating to the physical, physiological or behavioural characteristics of an individual which allows for the unique identification of the individual, and the definition names the photograph or other facial image, finger print, palm print, iris scan, retina scan, blood type, height, vein pattern and eye colour among the physical characteristics and gait, signature, keystrokes and voice among the behavioural ones.

Section 24 permits processing sensitive personal data only where at least one condition in that section is met in addition to a condition in section 23, and the first of those conditions is the data subject's consent in writing.

The other conditions include an employment or social security right or obligation, protection of vital interests where consent cannot be obtained, legitimate activity of a not-for-profit body acting for its members with appropriate safeguards, data the data subject has deliberately made public, legal proceedings or advice, the administration of justice, fraud prevention through an anti-fraud organisation, medical purposes undertaken by a health professional or a person owing an equivalent duty of confidentiality, and equality of opportunity monitoring by racial or ethnic origin.

A data subject may at any time withdraw consent to the processing of sensitive personal data in respect of that data subject. The Act is in force: it reached its appointed day under the Appointed Day Notice gazetted in 2023, the mechanism its own commencement clause leaves to a notice published in the Gazette, and no notice stating the day itself has been located.

Section 3(1) makes it an offence to knowingly obtain, for oneself or another person, any unauthorised access to a program or data held in a computer. Section 2(4) defines access as without authorisation whenever the person is not themselves entitled to control the access and does not have the consent of a person who is so entitled, without requiring that the person defeat a technical security measure, a broader trigger than Kenya's or several other jurisdictions' formulations.

Section 3(3) tiers the offence by forum and repeat conduct: on summary conviction before a Resident Magistrate, a fine not exceeding JMD 3,000,000 or imprisonment not exceeding three years for a first offence, rising to JMD 4,000,000 or four years where damage is caused, and JMD 5,000,000 or five years for a second or subsequent offence; on indictment before a Circuit Court, imprisonment alone up to seven, ten, or fifteen years across the same three tiers, with the fine left unspecified.

Section 15 lets the sentencing court, in the same criminal proceedings, order the convicted person to pay compensation to anyone who suffered loss from the offence, without prejudice to any other cause of action the victim may separately have; this is a court-ordered ancillary remedy rather than a freestanding civil claim. This Act repealed and replaced the Cybercrimes Act, 2010.

Section 52 excepts fair dealing with a literary, dramatic, musical, or artistic work for the purposes of research or private study from copyright infringement. Section 53 separately excepts fair dealing with a protected work for the purposes of criticism or review, and fair dealing with a protected work other than a photograph for the purpose of reporting current events, provided the dealing is accompanied by a sufficient acknowledgement.

Section 3(3A), inserted into the base 1993 Act by the Copyright (Amendment) Act, 1999 (Act 29 of 1999), s. 3, provides that copyright subsisting in a literary work that is a compilation does not extend to the works, data, or other material the compilation comprises, and does not affect any copyright that may separately exist in that underlying material. The Act's marginal citation identifies the inserting amendment but does not itself state that amendment's own commencement date.

Jamaica accordingly protects a compilation's selection and arrangement as a literary work but confers no sui generis database right of the kind the EU recognises; the word "database" does not appear anywhere in the Act.

Section 6(8) provides that copyright protection does not extend to an idea, concept, process, principle, procedure, system, or discovery or things of a similar nature, so a bare fact or news item, as such, is never a protected work under Jamaican law whichever outlet reports it first.

Section 53(1)(b) separately lets a person deal fairly with a protected work, other than a photograph, for the purpose of reporting current events without infringing copyright, so long as the dealing is accompanied by a sufficient acknowledgement of the work and its author.