Data Protection Laws and Data Transfer

Panopticon published an article on August 11, 2020, titled “My Data Went to the Caribbean. Jamaica? No, It Went of its Own Accord”. Here’s a summary:

  • The GDPR can be a tool to try and force the Home Office to allow a deported overstayer with a lengthy criminal record back into the UK to conduct an in-person appeal.
  • In the Johnson v Secretary of State for the Home Department, Mr. Johnson had been deported to Jamaica and was required to appeal to the first-tier Tribunal of the UK but he didn’t wish to do so.
  • He wanted to be permitted to enter the UK to make his appeal and notified the FTT that he didn’t consent to give oral evidence by video link and electronic transfer of the hearing bundle to the British High Commission in Jamaica.
  • Various arguments under the GDPR were raised in support of his position that was rejected by the FTT. The lead judge declined to determine whether the data processing was in the scope of EU law or not and noted that both the FTT and the Home Office were controllers of the Appellant’s data which included special category data under Articles 9 and 10.
  • The Appellant’s position was primarily characterized as an exercise of the right to object under Article 21 GDPR which was encompassed within the exception. The exceptions could be applied to permit the Appellant’s objection but the issue about whether the Appellant’s right to erasure remained. It was assured that the data transferred would be destroyed after seven days.
  • Although the transfer was justifiable under Article 49(1)(e) GDPR, there is the fact that a transfer solely to the British High Commission in Jamaica was not an international transfer because the data never left British officials’ control.
  • Article 46 would apply to the facts of the case as adequate safeguards were in place in the particular transfer and the risk was low but in other cases, the interpretation can be subject to complex limitation based on consular and diplomatic premises, where the degree of protection might vary.



Contributed by Racquel Bailey from Jamaica. Racquel is a member of our Women in InfoSec Caribbean (WISC) initiative on Discord. WISC is a non-profit initiative supporting Caribbean women and girls to develop a career in Information Security. Learn more about WISC at

Previous Article

Many T&T companies do not report cyber crime

Next Article

Data Privacy requires a culture to support it

Related Posts