Using AI under Jamaica's Data Protection Act: a practical guide

Jamaica’s Data Protection Act 2020 was written as a general data protection law, but it is the main binding rule for AI in Jamaica. Any AI system that takes in, analyses or produces personal data about customers, employees or citizens is processing personal data, and the Act’s standards and rights apply to it. This guide sets out what that means in practice.

Automated decisions

Section 12 is the Act’s rule on decisions made by machines. It covers decisions that significantly affect a person and are based solely on processing by automatic means to evaluate them, such as their performance at work, creditworthiness, reliability or conduct. A person can tell the controller in writing not to take such decisions about them. Where the controller takes one without such a notice, it must tell the person as soon as reasonably practicable, and the person has 30 days to require it to reconsider or decide again on a different basis. Decisions authorised by law or taken in the course of a contract are exempt where they grant the person’s request or their interests are safeguarded. Our page on section 12 sets out the rule in full.

The practical consequence is that every AI system that scores, ranks or screens people needs a known answer to two questions. Is a person genuinely involved before the decision takes effect? And if not, how will the organisation tell people, and handle a reconsideration request within 30 days? Section 6 also lets a person ask for the logic involved in such a decision, so the organisation needs to be able to explain how each system reaches its outputs.

The annual data protection impact assessment

Section 45 is unusual. Rather than requiring an impact assessment only for high-risk projects, it requires each data controller to submit a data protection impact assessment to the Commissioner every calendar year, within 90 days after the year ends, covering all personal data in its custody or control. The Commissioner can specify by Gazette notice which classes of data or controllers the duty applies to.

The prescribed content is a description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of the risks to people’s rights and freedoms, and the measures to address them. For AI, that means each system should appear with its purpose, the data it uses, the risks it creates (accuracy, bias, security and automated decisions among them) and the safeguards in place. An organisation that keeps an AI impact assessment for each system, following the approach in our guide to running an AI impact assessment, has most of the annual submission ready.

Registration and the data protection officer

Data controllers must register with the Office of the Information Commissioner, and the Act prohibits processing without registration. The OIC’s website currently says registration is temporarily paused for the current registration year while it updates its system, and that it will announce when registration reopens.

Under section 20, a controller that is a public authority, processes sensitive personal data or data about criminal convictions, processes personal data on a large scale, or falls within a class the Commissioner prescribes must appoint a data protection officer and notify the Commissioner of their contact details. The data protection officer monitors compliance independently, and is the natural owner for the privacy side of AI governance.

Breaches and AI incidents

Section 21 requires a controller to report any contravention of the data protection standards, and any security breach that affects or may affect personal data, to the Commissioner within 72 hours of becoming aware of it. The report covers the facts, the categories and numbers of people and data affected, the mitigation measures, the consequences and the data protection officer’s details. The controller must also notify each affected person. The OIC accepts breach reports through an online form.

AI creates new routes to a breach, such as an assistant that reveals another customer’s details, staff pasting personal data into an unapproved tool, or a vendor’s model exposing inputs. Plan for them in the same incident process, following our guide to responding to an AI incident.

Transfers out of Jamaica

Many AI services are hosted abroad. The eighth standard, in section 31, says personal data may not be transferred to a state or territory outside Jamaica unless it ensures an adequate level of protection for the rights and freedoms of data subjects, judged in all the circumstances. Before adopting an AI service, find out where it processes and stores data and what the contract says about safeguards. Our guide to vendor and third-party AI risk covers the questions to ask.

Penalties

A controller that processes personal data in contravention of the standards, or fails to make a required report, commits an offence, punishable on summary conviction by a fine of up to J$2 million or up to two years’ imprisonment. Section 68 allows a fine of up to four per cent of a body corporate’s annual gross worldwide turnover for the preceding year of assessment.

Where to start

1. List your AI systems, including AI inside software you already use, with the personal data each uses and the decisions it touches. Our guide to building an AI system register covers the fields.
2. Flag automated decisions that significantly affect people, and decide how notice and reconsideration will work.
3. Fold AI into the annual impact assessment, with a risk and safeguard entry for each system.
4. Check transfers for every AI service hosted outside Jamaica.
5. Add AI to the incident process, so a breach through an AI system reaches the 72-hour report.

Aicura’s register, assessments, incident tracking, vendor records and policies support this work. Aicura gives support and guidance for your own judgement and your advisers’, and it does not decide how the Act applies to you.