Is your data protected?

Jamaica has finally joined the list of countries that has data protection legislation but our Data Protection Act will not fully come into effect until December 01, 2023.  While our data protection act fully comes into effect next month, our right to protection of our data and information already exists in our Constitution under the right to privacy.

What is the big deal about data?

You might have heard the expressions “Data is the new gold” and “Data is the new oil.” This is because data forms a big part of new services and products which are heavily data driven. For example, your fitness watch would not be of any use if it was not designed to collect your biometric data. Depending on the type of fitness watch you have, you can look at the back and see the sensors which record your biometric data. You may recall that the compulsory collection and storage of biometric data was a core issue in the debate regarding the constitutionality of the National Identification and Registration Act.

A key feature of streaming apps is being able to identify trending shows or movies; this is not possible without collecting, and analyzing (that is processing) the data of you, and several other users. This falls into the category of big data.  On a more individual level, the same streaming app might recommend movies to you based on what you have previously watched. This is only possible because the app is tracking your behaviour on the app; collecting data about your preferences. From this example alone, you can see the value of data to revenue generation.

There is a difference between data and information. Using oil as a reference, “…like oil, data is valuable, but if unrefined, it cannot really be used. It has to be changed into gas, plastic, chemicals, etc. to create a valuable entity that drives profitable activity. So, must data be broken down, analysed for it to have value.”-Clive Humby, Data Scientist

This means, data is raw and unorganized facts, while information is organized data which can be used for decision making, identification, analysis among other things.

Personal Data

Our Data Protection Act only covers personal data with special attention given to sensitive personal data. The idea behind our legislation is to protect personal data relating to a living individual, or a deceased person up to 30 years after death.

How do you know if you have personal data on someone? The information on its own, or when considered with other information you have, or information you are likely to obtain, will enable you to identify the living, or deceased person.

Who is in Charge?

The Office of the Information Commissioner falls under the Ministry of Science, Energy, Telecommunications and Transport. Apart from monitoring compliance with the data protection act, the Information Commissioner is responsible for issuing guidelines to be followed by data controllers. The current Information Commissioner is Celia Barclay and the Deputy Commissioner is David Grey.

Penalties

There are various offences which arise from non-compliance which may result in fines, or terms of imprisonment.

Though data controllers were given two years to make the necessary changes to their operations to meet the requirements of the Act, there still seems to be a general sense ill-preparedness. The Act is very detailed and this article has not highlighted critical provisions such as the data protection standards a data controller would need to understand, in order to assess the compliance readiness of is operations. Data controllers also need to familiarize themselves with the rights of individuals, and the associated obligations on the data controller.

Hopefully by December 01, many of the public’s common concerns such as privacy in the work place will be alleviated.

Until next time, stay safe.