JAMAICA Law and Practice Contributed by: Samantha Moore, Marc Ramsay and Chantelle Biersay, Ramsay & Partners
Ramsay & Partners 8 Lady Musgrave Road
Kingston 5 St Andrew Jamaica Tel: +1 876 906 2616 Email: inbox@ramsayandpartners.com Web: jamaicadataprotection.com
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws The following laws and/or regulations govern data protection and privacy in Jamaica: • the Data Protection Act, 2020 (DPA); • the Data Protection Regulations, 2024 (the “Regu - lations”); and • the Data Protection (Data Controller Registration) Regulations, 2024 (the “Registration Regulations”). In Jamaica, these laws are the only set which govern data protection and privacy. Our laws do not distin - guish between federal and state, nor do we have laws that distinguish between the national and subnational, the supranational and domestic, or the general and sectoral. The DPA is extraterritorial in scope in that it applies to individuals and/or entities that are not resident or established in Jamaica but: • use equipment in Jamaica for the processing of personal data other than for the purpose of transit through Jamaica; or • process personal data of data subjects in Jamaica, and the processing activities relate to: (a) the offering of products or services to data subjects in Jamaica, irrespective of whether a payment is required; or (b) the monitoring of the behaviour of data sub - jects to the extent that their behaviour takes place within Jamaica.
Interplay Between the DPA and Other Laws Cybercrimes Act The Cybercrimes Act, 2015 supports the DPA’s secu - rity goals by criminalising unauthorised access and interference with systems and data. A data breach under the DPA may also constitute an offence under the Cybercrimes Act, for example, unauthorised access, which has the potential to cre - ate dual civil and criminal liability. The Cybercrimes Act applies to all data and is not limited to personal data. This means that it covers criminal misuse of non-personal data such as corpo - All data controllers are required to comply with the eight data protection standards set out under the DPA. These data protection standards are as follows: • Fairness and lawfulness: Personal data must be processed fairly and lawfully and must not be obtained by deception or any misleading informa - tion. • Purpose limitation: Personal data must only be obtained for a specific and lawful purpose and must not be processed in any manner incompatible with those purposes. • Data minimisation: Personal data must be ade- quate, relevant, and limited to the purpose for which it is being processed. • Accuracy: Personal data must be accurate and, where necessary, kept up to date. rate data held on IT systems. 1.2 Rights and Obligations General Principles
223 CHAMBERS.COM
Powered by FlippingBook