JAMAICA Law and Practice Contributed by: Samantha Moore, Marc Ramsay and Chantelle Biersay, Ramsay & Partners
Additionally, the DPA stipulates that personal data can be processed for research purposes so long as the following conditions are met: • the personal data must not be processed to sup - port measures or decisions with respect to particu - lar individuals; and • the personal data must not be processed in such a way that substantial damage or substantial distress is, or is likely to be, caused to any data subject. In Jamaica, we are not familiar with the European Health Data Space Regulation, nor do we have simi - lar laws. 1.5 Processing of Personal Data in the Context of Artificial Intelligence In Jamaica, we have not yet implemented specific requirements or guidance regarding the use of per - sonal data in AI systems or models. Likewise, Jamai - ca does not yet have a comprehensive AI regulatory regime. 1.6 Data Breach Requirement A data controller is required to report any security breach in respect of the data controller’s operations that affects or may affect personal data to the Informa - tion Commissioner within 72 hours of becoming aware of the breach. The notice must include: • the facts surrounding the security breach; • a description of the nature of the security breach, including the categories, the number of data subjects concerned, and the type and amount of personal data concerned; • the measures taken or proposed to be taken to mitigate or address the possible adverse effects of the breach; • the consequences of the breach; and • the name, address and other relevant contact infor - mation of the data controller’s DPO. The notice must be submitted via the Information Commissioner’s online portal. A data controller is also required to report any secu - rity breach to each data subject whose personal data has been affected by such breach within 72 hours
of becoming aware of the breach. The notice must include: • the nature of the security breach; • the measures taken or proposed to be taken to mitigate or address the possible adverse effects of the breach; and • the name, address and other relevant contact infor - mation of the data controller’s DPO. Please note that as the DPA was only recently imple - mented, the investigative arm of the Information Com - missioner has not yet been fully established. Addi - tionally, the provisions under the DPA which give the Information Commissioner certain enforcement pow - ers are not yet in effect. In Jamaica, mass data privacy litigation is not com - mon. 1.7 Regulators The Information Commissioner is the regulatory body which is designated to enforce the DPA and handle complaints, investigations, penalties and compliance. The main powers, duties and responsibilities of the Information Commissioner include: • monitoring compliance with the DPA and any regu - lations made thereunder; • providing advice to the relevant Minister on any matter relating to the operation of the DPA or oth - erwise for the protection of personal data; • promoting the observance of the requirements under the DPA and the following of good practice by data controllers; • disseminating information to the public about the operation of the DPA and about good practice, and advising persons about any of those matters; • preparing and disseminating guidelines under the DPA; and • intervening as a party in any proceedings before a court, in respect of any matter concerning the processing of personal data or the enforcement of any provision of the DPA, other than proceedings for the prosecution of an offence.
227 CHAMBERS.COM
Powered by FlippingBook