JAMAICA Law and Practice Contributed by: Samantha Moore, Marc Ramsay and Chantelle Biersay, Ramsay & Partners
Where the Information Commissioner is satisfied that a data controller has contravened, or is contravening, any of the provisions under the DPA, the Information Commissioner may commence proceedings against the data controller. Proceedings may also be triggered where a data subject has filed a complaint with the Information Commissioner against a data controller. Guidelines issued by the Information Commissioner pursuant to the DPA would be binding in practice. 1.8 Enforcement Proceedings and Fines How an Enforcement Action or Investigation is Initiated Any person who believes his/her rights under the DPA have been violated can lodge a complaint with the Information Commissioner, which would then trigger an investigation by the Information Commissioner. The Information Commissioner may commence an investigation on its own initiative in circumstances where there is reason to suspect non-compliance by a data controller (for example, a serious breach, public interest concerns, or patterns of misconduct). Investigations may also be triggered through referrals or media reports. Enforcement Notices If the Information Commissioner has reasonable grounds for believing that a data controller is non- compliant with the DPA, the Information Commis - sioner has the power to issue an enforcement notice to such data controller. This enforcement notice may require the data controller to cease processing, cor - rect practices, or take specific steps to comply with the DPA. The enforcement notice typically sets a com - pliance deadline by which the data controller must act. Information and Assessment Notices The Information Commissioner has the power to issue information notices which would require data control - lers to produce certain documents or evidence related to compliance. This would also give the Information Commissioner the power to inspect the data control - lers’ premises, books, etc.
A request may also be made to the Information Com - missioner by or on behalf of any individual who is, or believes himself/herself to be, directly affected by any processing of personal data for an assessment as to whether it is likely or unlikely that the processing has been, or is being, carried out in compliance with the DPA. Notice of Investigation When an investigation begins, the Information Com - missioner will typically provide formal notice to the data controller that an inquiry has been opened. The notice should explain the scope of the investiga - tion, the alleged non-compliance and any documenta - tion required. Response Timelines The DPA generally requires data controllers to respond to the Information Commissioner requests within specified timeframes. For example, data controllers are required to respond to data subject access requests within 30 days from the date of the request. Available Sanctions and Remedies Where a body corporate commits an offence under the DPA, the body corporate may be liable to a fine not exceeding 4% of its annual gross worldwide turno - ver of that body corporate for the preceding year of assessment in accordance with the Income Tax Act, 1955 (as amended). Individuals who commit an offence under the DPA may also be subject to severe fines up to a maximum of JMD5 million (approx. USD31,100) and/or imprison - ment up to a maximum of ten years. In calculating the amount of monetary penalties, the courts will take into account: • the estimated economic cost to consumers, users of the services concerned and any other persons, of the contravention giving rise to the offence; • the estimated economic benefit derived by the body corporate from the commission of the offence;
228 CHAMBERS.COM
Powered by FlippingBook