Columns

Public engagement on Data Protection Bill needed before it's too late

By Amanda Quest

Thursday, July 19, 2018

Print this page Email A Friend!


The proliferation of digital technologies, media and devices has seen (personal) data become one of the most valuable currencies in the digital knowledge economy. Copious volumes of personal data are exchanged across a wide array of virtual, electronic, and traditional platforms by the second, so that our personal data can be more easily accessed now than ever before. This increased ease of access gives rise to the possibility of that data being used for nefarious purposes, which can, in turn, cause substantial loss and/or damage — financially, reputationally, and otherwise — to individuals.

Breaches of data systems are ubiquitous occurrences, and recent high-profile incidents involving the hacking of databases containing large stores of personal data across the globe have underscored the importance of prioritising data protection, security, and privacy in an increasingly digital age. As such, the establishment of robust regulatory frameworks within which individuals may be guaranteed greater control over their personal data, effective protection against the misappropriation and misuse of their personal data, as well as against unjustifiable intrusions upon their right to privacy within the digital arena is now, more than ever, an absolute imperative.

For this reason, the recent tabling of a Bill entitled 'An Act to Protect the Privacy of Certain Data and for Connected Matters' is both a timely and welcome step in the right direction. The Data Protection Bill was modelled on the European Union's General Data Protection Regulation, which came into force on May 25, 2018 after being adopted three years earlier and, once passed, will become Jamaica's first comprehensive privacy law.

In addition to giving Jamaicans more control over when and for what purposes their personal data are collected, stored and processed, the Data Protection Bill (once promulgated) should assuage — at least to some extent — certain concerns surrounding the purported inadequacy of existing privacy-related laws, which mostly apply at the sectoral level. The Bill also introduces various penalties for non-compliance that range from monetary fines to imprisonment.

When considering who the Data Protection Bill seeks to regulate (and in relation to what), it arguably stands to affect how virtually everyone — from the small cookshop owner to the start-up entrepreneur, or independent contractor to the large conglomerate — conducts business and provides services in Jamaica. Business aside, however, the Bill also stands to have very real implications for the average citizen by virtue of the new data privacy rights it creates for “data subjects” with respect to the collection, storage and processing of their personal data, as well as the obligations it imposes on “data controllers” who will determine how that personal data will be processed.

While the Data Protection Bill creates new data privacy rights which, crucially, seek to accord to Jamaicans a greater level of autonomy in determining how their personal data are used, as currently drafted, it induces anxieties about certain adverse consequences that are likely to flow from the practical application of some of its provisions. A few such concerns were highlighted at the recently staged data protection town hall event which was organised by a group of non-government organisations (including the SlashRoots Foundation and Jamaicans for Justice) seeking to increase public awareness about certain aspects of the Bill, as well as the implications it will have when enacted for diverse segments of the society.

At present, some of the critical issues raised by the Bill relate, among other things, to:

1. the broad-ranging and ostensibly unqualified powers of the Information Commissioner's Office, which itself appears to be beyond regulation by reason of its designation as a body corporate under the Bill;

2. the potentially chilling effects that certain clauses of the Bill are likely to have on freedom of expression, freedom of the press and media publications;

3. the onerous nature of certain obligations imposed by the Bill in relation to data controllers, which is likely to make compliance inordinately difficult for small- and medium-sized enterprises;

4. the categorical exemption of government entities from certain punitive sanctions for non-compliance with the Bill; and

5. the absence of an unequivocal redress mechanism for breaches of data privacy rights.

Insufficient public dialogue and engagement

Notwithstanding the far-reaching ramifications that the Data Protection Bill will have for virtually everyone in the country (individuals and entities alike), albeit to varying extents and in different ways, much of the discussion about it has been, in important respects, quite exclusive. This is to say that public engagement and discussion around the Bill have been woefully inadequate.

Currently, the Data Protection Bill is before a joint select committee of Parliament, which was convened to review its provisions. The committee has, in accordance with standard protocol, welcomed public feedback on the Bill. While submissions have been made by specific stakeholders (including, among others, civil society and the Press Association of Jamaica), their perspectives on the matter cannot be seen as wholly representative of those of the general public — many of whom do not seem to have a sound awareness of how they will be personally affected when this Bill is passed.

Within this context, it is deeply concerning that no meaningful efforts appear to have been made at the governmental level to proactively engender public interest in and engagement with a Bill of such enormous import. The recent staging of the town hall event was a laudable effort on the part of civil society to encourage public interest in and dialogue about the Bill. However, this should not be seen as absolving the Government of its positive obligation to take strong leadership in actively engaging and stimulating public interest in issues that will have far-reaching implications for the citizenry.

It would be highly unfortunate if Jamaicans were to only begin coming to terms with the seriousness of the issues at stake after this Bill is passed, or while it is being debated in Parliament, as was the case with the controversial National Identification System Act, referred to popularly as NIDS, which was passed last year amidst much furore and is now the subject of a constitutional challenge in the Supreme Court.

Certainly, there are differences between the present situation and the circumstances that surrounded the promulgation of the NIDS Act. Yet, the key takeaway remains the same: robust public consultation, education and engagement around issues of legislative import should be a central component of any law-making process. This should ideally involve concerted efforts (fundamentally at the governmental level) to stimulate public interest in and engagement with issues having demonstrable implications for the general public.

The potential of the Data Protection Bill to alter the way in which we interact and engage with both State and private entities alike, in both commercial and other contexts, should never be underestimated. Personal data, as the minister of science and technology recently pointed out, is serious business. It is therefore critical that the Government gets serious about promoting meaningful public engagement with the Data Protection Bill before and not only after it is passed.

Amanda Quest is a law student and freelance researcher with an interest in human rights issues. Send comments to the Observer or amandajdquest@gmail.com

ADVERTISEMENT




POST A COMMENT

HOUSE RULES

1. We welcome reader comments on the top stories of the day. Some comments may be republished on the website or in the newspaper � email addresses will not be published.

2. Please understand that comments are moderated and it is not always possible to publish all that have been submitted. We will, however, try to publish comments that are representative of all received.

3. We ask that comments are civil and free of libellous or hateful material. Also please stick to the topic under discussion.

4. Please do not write in block capitals since this makes your comment hard to read.

5. Please don't use the comments to advertise. However, our advertising department can be more than accommodating if emailed: advertising@jamaicaobserver.com.

6. If readers wish to report offensive comments, suggest a correction or share a story then please email: community@jamaicaobserver.com.

7. Lastly, read our Terms and Conditions and Privacy Policy



comments powered by Disqus
ADVERTISEMENT

Poll

ADVERTISEMENT
ADVERTISEMENT

Today's Cartoon

Click image to view full size editorial cartoon
ADVERTISEMENT