Published in


What’s in it for me? New Citizen Rights in the Data Protection Act

At our recent Data Protection Act Town Hall, two common sentiments shared among the presenters and participants were: Too few Jamaicans understood the broad implications of this bill; and more education and engagement is needed!

At the Town Hall we had outlined four scenarios that reflect how the legislation will impact everyday citizens. Suffice to say it is highly probable that you or your organization could find yourself in at least one such scenario:

  • James a recovered drug addict who is worried about how data from his past could affect his ability to move on with his life.
  • Farmer Ricardo wants a loan from his credit union but knows the financial data being used about him is outdated.
  • Collett, a small business owner who wants to use customer data from her existing business to start a new venture.
  • Tarik is a college student with an idea for a new online dating service targeting Jamaicans.

Name: James Johnson

Scenario: James was formerly a drug addict. When he was suffering from his addiction, he received services from a local NGO, who helped him overcome his addiction and get back on his feet.

He is now trying to move on with his life, but he is worried about how the information he shared with the NGO could affect his job prospects if they were shared.

How the bill affects James:

  • With the Data Protection Act, James can request that the NGO disclose what personal data it has about him, how the data is being used, and with whom it has been shared. He can also request a copy of this data.
  • James can reject any previous consent he may have given to the NGO to use his data internally or share his data with other entities.

Name: Ricardo Brown

Scenario: Ricardo wants a loan from his credit union to expand his farming business. The credit union pulls his personal data — farmer registration information — from RADA to make loan decisions. However, Ricardo knows that he hasn’t spoken to his RADA extension officer in four years, and his data is outdated.

How the Bill affects Ricardo:

  • Ricardo can request that his credit union tell him whether they have made a decision based solely on the automated processing of data from RADA. After being notified, Ricardo has 21 days to require that they reconsider and make a new decision on another basis.
  • Ricardo can request that his credit union not make a decision solely based on automatically processing his data from RADA, and instead allow him to provide his updated data.

Name: Collett Simpson

Scenario: Collett is an entrepreneur. She previously ran a business, where she bought and sold designer sandals through her Facebook page. When her main sandals supplier migrated to Canada, she had to shut down the business.

She is now looking to start a new business providing catering services and wants to market to her previous customer base.

How the bill affects Collett:

  • Under the proposed Data Protection Act, Collett will need to update her registration information with the Information Commissioner — indicating what data she will now collect and the purpose for its usage.
  • She will also need to get consent from her customers before she can start marketing her catering service to them.
  • If members of the customer database indicate that they do not want to receive her new products or services, she should not send them marketing information for the new business.

Name: Tarik Johnson

Scenario: Tarik has an idea for a new online dating service targeting Jamaicans. He has developed a prototype for the product and is ready to test market interest with prospective customers.

How the bill affects Tarik:

  • Under the Data Protection Act, before he can begin collecting personal data from prospective customers, Tarik will need to register with the Information Commissioner providing, among other details, the specifics of the information he will be collecting for his idea and also appoint a Data Protection Officer to represent his company.
  • When signing up new customers, he will have to communicate why the data is being collected and how it will be used.
  • When deciding whether to store data in the cloud, he will have to select hosting locations that have equivalent data protections. If he wants to share their data somewhere without equivalent data protections, he will have to get the consent of his users.
  • If his service gets hacked or the data is compromised. He must notify the Information Commissioner of the compromise and potentially, all his users that their data may have been affected.

New Citizen Rights under the Data Protection Act

  1. You have the right to access your information
    Any entity that has data about you is now required to communicate to you in plain and accessible language, what personal data they have, how they use it, and who they have shared it with.
  2. The Right to Prevent the processing of your personal data if you believe it is likely to cause damage or harm to you.
    If it is inaccurate, you can change or update it.
    - If the data has been held for longer than necessary, you can prevent it from being used
    - If the data is being used for direct marketing, you can request they desist.
    - You have the right to know how automated decisions are made.
  3. The Right to request that no decision is solely based on the automatic processing of personal data.
  4. The Right to apply for a data controller to rectify any inaccuracy in any data of which he/she is the subject.




The SlashRoots Foundation is a social impact organization that designs digital tools and services to transform the relationship between Caribbean governments and their citizens.

Recommended from Medium

How Hayden AI is Securing Its Smart City Solutions: IoT Attack Surface Opportunities & Challenges

How to win the competition of Claim IDO whitelist

Every LAN may or may not be with WAN.Every WAN must be with LAN.

The Wasted Lands Official Announcement — Airdrop Campaign For Early Supporters

Economic Spying — Need of the Hour

Bring the code to your data: a federated approach for machine learning

Encrypting Google Application Default and gcloud credentials with GPG SmardCard

{UPDATE} Canasta ScorePad Hack Free Resources Generator

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Matthew McNaughton

Matthew McNaughton

Matthew is a Founding Principal of the SlashRoots Foundation. In this role he leads projects that focus on the practical applications of ICTs in development

More from Medium

Climate Change: New Zealand

New Zealand nature and climate change

“The Fall of Babel” ends a uniquely epic and comforting fantasy series

Robert L. Heilbroner