Grace period granted as new data protection law takes effect

The legislation, which was passed in 2020, is poised to transform the way organisations manage personal data, including the collection, storage, utilisation, disclosure, and disposal.

Entities, particularly those that process personal information on a daily basis, are required to implement measures to ensure the safety, security, and confidentiality of the data that they handle, and failure to do so could result in them facing harsh penalties, including hefty fines.

These entities include public authorities, financial and educational institutions, health and security services providers, processors of sensitive personal data, among others.

Under the new law, these organisations or individuals, defined as data controllers, are required to be registered with the Office of the Information Commissioner (OIC) effective December 1, and pay an annual fee.

They are also obligated to appoint a responsible individual, such as a Data Protection Officer (DPO) to oversee the controller’s compliance with the Act.

Persons or organisations that process personal data without registering with the OIC could face sanctions.

Recognising that some local entities will not be ready to implement the data security measures on December 1, the Government has granted a six-month grace period for them to register with the OIC.

“The plan is for December 1 to start the registration process and, over time, we will give companies some time to comply,” said Minister with responsibility for Skills and Digital Transformation, Senator, Dr. the Hon. Dana Morris Dixon, at a recent post Cabinet press briefing.

She noted that “we will definitely communicate as we move along when it becomes compulsory for all the [data] controllers to be registered and when the regime in relations to sanctions will be in place and effective.”

“So, December 1 is really just the start of our journey on this road which Jamaica cannot, not be on, especially considering what is happening globally. Protecting people’s privacy is a right and that is what this data protection is all about,” Dr. Morris Dixon added.

The OIC is encouraging persons who have been implementing the necessary organisational and technical measures to comply with the Data Protection Act, and are ready to register, to begin the process today by visiting its official website at www.oic.gov.jm.

The OIC is responsible for monitoring compliance with the Act and attendant regulations, as well as advising the Government on matters relating to data protection; disseminating information to the public in relation to the operation of the Act; and preparing and distributing guidelines that promote good practices to be adhered to by data controllers.

The Information Commissioner aims to create a robust regulatory regime, which will foster stakeholder buy-in, while ensuring the quick and effective investigation of complaints and prosecution of contraventions.