Lawyer makes business case for data protection law
Published:Wednesday | October 25, 2017 | 12:00 AMMcPherse Thompson
The enactment of a Jamaican data protection law introduced under a bill in Parliament earlier this month, while creating a regulatory burden, could open up opportunities for investments in data processing in Jamaica, according to Grace Lindo, a lawyer with expertise in technology.
It would also allow Jamaica to join the ranks of just two other Caribbean countries with the capacity to attract investors in data centres, said the lawyer, who is a commercial, intellectual property and technology partner at Nunes, Scholefield, DeLeon & Company.
Data transfers between countries has been increasing at an alarming rate and are now beyond the scope of law enforcement and regulatory coordination, said Lindo.
"For instance, data is now transferred by social media apps which do significant processing on personal data to allow third parties - cookies - to specifically target users," said the technology lawyer.
"Those advertisements on the item you 'googled' are not appearing by coincidence. Some jurisdictions have become very serious about where their citizens' data are transferred and processed. The European Union has led the way on this and has been 'certifying' other jurisdictions to which their citizens' data are sent," she said.
Lindo pointed to a ruling by the European Union Court of Justice which upheld a Spanish data protection agency decision that data about individuals held by Google must be deleted on request. The court held that allowing access to personal details through search engines indefinitely was incompatible with EU data protection directives.
The ruling followed a Spanish man's complaint that an auction notice of his repossessed home on Google's search results infringed his privacy.
Referring to the opportunities for data processing in Jamaica, Lindo said: "And when I say data processing, I mean more than business processing centres, but also data centres."
She cited, for instance, Amazon Web Services, which has been eyeing Trinidad & Tobago for a data centre for some time. Data centres help in localisation of Web or cloud services to allow for speed in an increasingly cloud-based industry, Lindo said.
"My hope is that Jamaica will become equally attractive with the passing of this law," she said. "The Bahamas and Trinidad & Tobago are perhaps the only Caribbean countries with data protection laws at this time."
The lawyer said Jamaica's data protection legislation may well increase the costs on businesses, as it will require companies to create carefully crafted privacy policies for collection of personal information - demographic, biometric and even facial information in the form of photographs - whether electronic or not; and it will require expenditures to maintain up-to-date technology to prevent breaches.
"Companies will need to have compliance officers who will be data protection officers, and there will need to be annual reporting, and an annual fee is payable to a new regulator called the information commissioner," she said.
"The most significant shift is that data breaches - which occur whether by hacking or employee breaches - and other offences under the act could attract significant fixed penalties, up to 10 per cent of the annual gross income of the company."
There is initial concern regarding the wording of the legislation regarding the penalties, but "hopefully the language will become more objective and the act amended" through the Ministry of Science, Energy & Technology's stakeholder review process, she said.
The Financial Gleaner asked the Ministry whether it was amenable to adjustments, but the minister and officers au fait with the matter were unavailable for comment.
Lindo notes that one of the fundamental changes with the law is restriction on the use of automated data processing, which will put a check on the use of artificial intelligence to make decisions that affect people's lives.
"There are some exemptions, but the law now requires some human input in decision-making," she said, noting that some of the exemptions might include financial institutions, for example, in decision-making on loans.