Jamaica Adopts a Post-GDPR Data Privacy Law

Abstract

Jamaica's Data Protection Act 2020, is the fifteenth data privacy law in the Caribbean. Not yet in force, it provides for a transitional period of two years. The Jamaican Information Commissioner, once appointed, should be influential in the region. It is influenced strongly by the European Union’s General Data Protection Regulation (GDPR) of 2018, including in providing for extra-territorial jurisdiction, and in limiting data exports through the concept of ‘adequacy’. All data controllers must comply with eight numbered ‘Standards’, one of which includes compliance with the various ‘Rights of the Data Subjects’. The Act also imposes four types of higher obligations, above the ‘Standards’, on some controllers in relation to some processing. These include registration, controls on specified processing, data protection officers (DPOs) and data protection impact assessments (DPIAs). The Act’s enforcement is based on three types of notices by the Commissioner, which can then lead to offences, administrative penalties, or compensation. The terminology and procedures are somewhat unusual, but the enforcement mechanisms are substantial. This is a remarkably strong post-GDPR data privacy law. Of the nearly 20 features of the EU’s GDPR that are relevant to countries outside the EU, and are stronger than the 1995 Data Protection Directive, only a handful are missing from explicit inclusion in Jamaica’s law: data protection by design and default; demonstrable accountability of controllers; direct liability for processors; requirements to cooperate with other DPAs; and rights of public interest groups to take representative actions. The exemptions from the Act may prove to be unreasonably broad. It remains to be seen whether fines of up to 4% of corporate turnover will be genuinely dissuasive when administered by courts, and whether significant compensation awards will be made.