JAMAICA Law and Practice Contributed by: Samantha Moore, Marc Ramsay and Chantelle Biersay, Ramsay & Partners
Due Diligence With respect to due diligence, the acquiring entity should ensure that the target company is compli - ant with its legal obligations under the DPA such as registration with the Information Commissioner and appointment of a DPO. The acquiring entity should ensure that the target company has implemented certain policies to ensure compliance with the DPA, which include but are not limited to privacy policy, incident response policy, retention policy and BYOD policy. Lastly, the acquiring entity should ensure that the target company has implemented certain technical and organisational measures to prevent unauthorised access and/or disclosure of personal data such as access controls, VPNs, anti-virus software and secu - rity cameras. Change of Control The DPA requires data controllers to register with and notify the Information Commissioner of their process - ing activities. This includes providing organisational details and notifying it of changes such as a change of control of the data controller. Notifications Under the DPA, data controllers are required to be transparent about processing and provide privacy notices to data subjects. In the event that the acquir - ing entity intends to process personal data for new purposes beyond those originally disclosed by the tar - get company, updated notices may need to be issued and fresh consent obtained where consent was the original basis. Post-Closing Integration After closing, the acquiring entity typically must: • update privacy notices and public disclosures to reflect the new data controller’s identity and pur - poses; • align data inventories and processing records across the combined organisation; and • ensure ongoing compliance with the DPA.
background checks and the ongoing processing of personnel information. When processing employee data, employers must ensure that the data is processed in accordance with the eight data protection principles as outlined under the DPA. These principles are as follows: • Fairness and lawfulness: Employers may monitor employee activities (time tracking, system use, security monitoring) only in circumstances where it is necessary and justified, and employees must be informed of this monitoring. Monitoring must not be excessive, continuous or intrusive. • Purpose limitation: Processing of employees’ data must be limited to employment-related purposes. • Data minimisation: Employers may collect personal data from prospective applicants but only what is necessary for recruiting or assessing suitability (eg, CV details, contact info, background checks). • Accuracy: Employers should collect only data nec - essary for HR, payroll, benefits and legal compli - ance, and keep it accurate and up to date. • Storage limitation: Employees’ data must not be held for longer than needed, and employers are encouraged to implement retention policies which are to be shared with employee. • Rights of data subject: Personal data must be processed in accordance with the rights of the employees. • Implementation of technical and organisational measures: Employers should implement BYOD policies, IT policies and remote work arrangements which should be incorporated in the workplace. • Cross-border transfers: Personal data of employ - ees must not be transferred to a State or territory outside of Jamaica unless that State or territory ensures an adequate level of protection for the rights and freedoms of the data subjects in relation
to the processing of employees. 4.4 Data Protection in M&A
The DPA does not have specific provisions which govern M&A and asset deals in Jamaica. The general privacy principles as set out under the DPA would be applicable.
231 CHAMBERS.COM
Powered by FlippingBook