JAMAICA Law and Practice Contributed by: Samantha Moore, Marc Ramsay and Chantelle Biersay, Ramsay & Partners
Right not to be subject to automated decision- making A data subject has the right to request that a data controller does not make any decision which would significantly affect him/her solely on the basis of the results of automated processing. These decisions include matters relating to the evaluation of the data subject’s work performance, creditworthiness, reliabil - ity or conduct. Compliance Checklist Below is a detailed checklist of the “to dos” for organi - sations under the DPA. Registration and record-keeping All data controllers are required to register with the Information Commissioner before processing per - sonal data. Data controllers must pay the prescribed registration fee and annual maintenance fee to keep the registration active. Data controllers are also required to provide and main - tain detailed processing records, including: • data controller’s name/contact details; • description of personal data processed; • categories of data subjects; • purpose(s) of processing; and • recipients of personal data (including transfers abroad). Data protection impact assessment Unless otherwise indicated by the Information Com - missioner, data controllers are required to annually submit to the Information Commissioner a data pro - tection impact assessment (DPIA) in respect of all personal data in the custody or control of the data controller. Data Protection Officer (DPO) Data controllers that fall within any of the following categories are required to appoint a DPO: • data controllers that are public authorities; • data controllers that process or intend to process sensitive personal data or data relating to criminal convictions;
• data controllers that process personal data on a large scale; and • data controllers that are designated by the Infor - mation Commissioner as requiring a DPO. Compliance with data protection standards All data controllers must comply with the eight data protection standards as outlined in the DPA. These standards are discussed above. Breach notification All data controllers are required to report any security breach in respect of the data controller’s operations which affects or may affect personal data to the Infor - mation Commissioner within 72 hours after becoming aware of the breach. Data controllers are also required to report any secu - rity breach to each data subject whose personal data has been affected by such breach within 72 hours after becoming aware of the breach. Incident and breach management Data controllers are required to maintain records of breaches and any remedial actions taken. 1.3 Special Categories of Personal Data Conditions for Processing Sensitive Personal Data The DPA stipulates that sensitive data must not be processed unless at least one of the following condi - tions has been met: • the data subject has consented in writing to the processing of the personal data; • the processing is necessary for the purposes of exercising or performing any right or obligation which is conferred, or imposed, by law on that data controller in connection with employment or social security benefits; • the processing is necessary: (a) in order to protect the vital interests of the data subject or another individual, in any case where: (i) consent cannot be given by or on behalf of the data subject; or (ii) the data controller cannot reasonably be expected to obtain the consent of the data subject, the data controller having
225 CHAMBERS.COM
Powered by FlippingBook