Jamaica Gleaner posted an article on August 5, 2020, authored by Courtney Bailey, which educated the public about the standards in the Jamaica Data Protection Act. Below are some key highlights:
- The data protection standard is considered as established under the recently passed Data Protection Act 2020.
- Data controllers will generally inform data subjects of the purposes for processing personal data by use of privacy notices, terms and conditions, and consent forms.
- A data controller would contravene the second standard in any circumstances in which personal data are processed for purposes other than what was specified.
- “The third standard is that personal data shall be adequate, relevant, and limited to what is necessary for the purposes for which they are processed,” Section 26 states.
- Data controllers will need to strike a balance by obtaining enough information to ensure their data processing results are accurate, while at the same time not obtaining more information about the data subject than is needed.
- This means that many firms will need to re-examine standard forms which they presently use to collect personal data, to see if all the information requested is needed to satisfy the purposes specified for collecting the data.
- This could include a monthly process to identify out-of-date or incorrect data by, for example, automated requests to data subjects to provide accurate information, such as by regular emails to data subjects requesting that they log in to customer databases to check and update information.
- The DPA provides that the fourth standard is not contravened where the inaccuracy is derived from information supplied to the data controller by the data subject or a third party, and the data controller has taken reasonable steps to ensure the accuracy of the personal data.
Reference(s):