TAJ to seek guidance as Office of the Information Commissioner disputes DPA block

The Tax Administration Jamaica (TAJ) says it will be seeking “guidance” from the country’s data protection regulator, which has contradicted its claim that the law blocks the release of the names of owners of two properties it is leasing.

The TAJ told The Sunday Gleaner on April 2 that provisions in the Data Protection Act (DPA), which it declined to provide, barred it from disclosing who owns a property in Annotto Bay, St Mary, and another in Mandeville, Manchester.

An Auditor General’s Department’s report triggered public outrage in March after revealing that the TAJ spent almost $400 million to lease two buildings that remained unoccupied up to August last year.

In a statement dated April 18, the Office of the Information Commissioner (OIC), which is the regulator under the DPA, sought to make it clear that the DPA cannot be used to frustrate transparency.

“Mere disclosure of the name(s) of companies contracted by any person or entity, whether a government agency or within the private sector, would not be a breach of the DPA,” declared the agency headed by attorney Celia Barclay.

TAJ responded on Friday, following the publication of the OIC’s position.

“TAJ, however, takes careful note of the release and the contents therein of the Office of the Information Commissioner … and will engage the OIC to seek further guidance on this matter and will act accordingly,” it said.

However, in its statement on Friday, TAJ disclosed that it was relying on Section 2 of the DPA as it aims “to secure the confidentiality of personal data which may be in the possession of entities (including Government authorities)”.

That section details how certain terms in the law should be interpreted. The TAJ pointed to ‘personal data’, which the legislation defines as information (however stored) that relates to a living individual or an individual who has been deceased for less than thirty years, “who can be identified from that information alone or from that information and other information in the possession of, or likely to come into the possession of, the data controller”.

The section says the personal data “includes any expression of opinion about that individual and any indication of the intentions of the data controller or any other person in respect of that individual”.

“TAJ construed this to mean that any piece of information, either by itself or combined with other information, that can be used to identify a natural person is prohibited from disclosure or may only be disclosed in accordance with section 22 of the Data Protection Act which prescribes the attendant data protection standards,” the agency said.

Public interest

TAJ’s statement did not address Section 23, which creates several conditions under which it can process personal data, one of which is where the processing is “necessary for the administration of justice, for the exercise of any functions conferred by or under any enactment; or for the exercise of any other functions of a public nature exercised in the public interest”.

Other enactments that compel the release the information include the Constitution, which gives the public the right to receive and disseminate information, and the Access to Information Act, which gives members of the public “a general right of access to official documents held by public authorities”.

Attorney and expert in data protection law Chukwuemeka Cameron said the question to be asked is whether the subject of The Sunday Gleaner’s request is an individual or a legal entity. The DPA would apply in the case of an individual.

“The fact that individuals associated with the company may be identified does not act as a constraint, especially when the information is available in a public register such as one maintained by the Registrar of Companies (Companies Office of Jamaica),” he said.

He argued further that in instances where a public request relates to an individual, determining whether to release the information requires an assessment of whether it is fair to do so and whether the person “has a reasonable expectation of privacy, especially in the context of public contracts and engagements with government entities”.

“When individuals or companies enter into contracts with the Government, particularly under public procurement processes, the expectation of privacy naturally adjusts to the context. Public procurement processes are inherently designed to promote integrity, engender public confidence, and, importantly, foster transparency,” argued Cameron, who is the founder of consulting firm Design Privacy.

He said those objectives are laid out clearly “to ensure that activities involving public spending are open to scrutiny by the public to safeguard against corruption and enhance trust in public institutions”.

“Given this framework, one could argue that there is a diminished expectation of privacy for entities or individuals entering into government contracts. This is because such processes require a level of openness to achieve their intended goals of transparency and public accountability. Therefore, when entities engage in public contracts, especially where public funds are involved, the details of these contracts – including the identities of the contracting parties – generally should be accessible to the public to scrutinize and evaluate the fairness and appropriateness of governmental procurement,” Cameron said.

According to the lawyer, the TAJ’s “withholding … might not conform to the expectations” under the DPA and the transparency principles underpinning government procurement “unless justified by other specific and overriding privacy concerns directly linked to identifiable individuals”.

The Office of the Information Commissioner has argued that the DPA “does not protect information relating specifically to entities or organisations, whether public or private and whether registered or unincorporated”.

Unlawfully disclosed

“The act therefore does not prevent any entity from identifying a company with which it does business or providing information relating to the nature of that business as long as any personal data in the possession of either or both organisations is not unlawfully disclosed.”

The OIC explained that under the data protection law, individuals, private entities and public authorities are required to handle people’s personal data, including sensitive personal data, responsibly and securely “in keeping with data processing standards which promotes trust and transparency”.

Jamaica Labour Party Member of Parliament and junior minister Dr Norman Dunn has confirmed that one of his companies leased the St Mary property to the TAJ.

The AuGD said there was no evidence that he interfered in the process.

The TAJ falls under the Ministry of Finance and the Public Service, of which Dr Nigel Clarke is the minister.

jovan.johnson@gleanerjm.com