Solution to SIPP's problems
Recently, there was a public outrage when news broke that people's private information was floating on the Internet for all to see. It wasn't just private information that you hide from your neighbours, but critical information such as Tax Registration Number (TRN), histories, debt and sensitive documents that if they were to get into the wrong hands and be used in a malicious manner, it could potentially cripple a business.
It was all there for Dick, Tom, Jack, and Harry to see. When most persons found out that that information was available, they went to check out the records of some of their favourite people, ironically, abusing the same system they bemoaned was faulty.
With the increased development of technology, many private and public companies have sought to use it to radically change how they do business; after all, the more information that is available (that passes the integrity test), the better it is for those persons who depend on it to make critical business decisions. Up until recently, when people found their information online on a search engine established through the Security Interests in Personal Property (SIPP) Act last year, many did not fully appreciate how powerful information is, and more important, that information collection methods have far gone passed one directly passing on information to businesses or partners.
The intent of the Act is greatly appreciated and it is a shame that it was only passed last year, however the glaring issues that confront us on the administrative side have to be addressed, because it makes absolutely no sense to use legislation to fix a problem and the said legislation in turn creates another problem. The beauty about this piece of legislation, however, is that people will have access to information that has integrity and one can be rest assured that a business associate is not using a non-traditional asset that has already been put up in a priory agreement to enter into another. Regrettably, since the issue broke, the industry, investment and commerce minister has had to order a suspension of the services until a solution can be found.
There are very practical solutions that can be implemented by the said ministry that will still allow the legislation to work in a manner in which it was intended to, while protecting the citizens and businesses of Jamaica from potential fraudsters or simply, people who have nothing to do with the information that they seek to obtain. The suggestion has been thrown around that a set of approved financial institutions should be identified, and they are the ones who should have access to the information from the search engine. That suggestion would work if people only did businesses with financial institutions.
The more pragmatic solution to this problem is in part legislation-based but, to a large extent information technological. The government should look to use access codes as a mechanism to allow those persons who have legitimate reasons to access the information. It would be the same search engine, but one would be limited to having access to a particular record for a specified amount of time. Each person or business will have an account and the account holder would be responsible for granting and revoking access to the information, therefore only people who are known the account holder will have access to the information. Each person would be registered by the account holder and a unique code generated. This is separate and apart from those who upload information to the registry which would be controlled on the side of the government.
There would be the concern of how one can guarantee that the access code will not be shared. Truth is, there are no guarantees, but there are strategies to minimise the chances of illegitimate persons using an authentic access code to look up information. There could be a log section where account holders are notified by, but not limited to email whenever their information has been accessed from a specific Internet protocol (IP). The location and other particulars which would be contained in the e-mail and from that, one could monitor the accesses. Therefore one could realise very quickly if the same access code is being used by a hundred different computer systems to do a search.
The solution however, would have to be complemented by an improvement in the ICT Act and by the passage of a Privacy Bill which would speak specifically to information handling and other particulars that the government would need to implement to ensure that people's information is protected by the best available mechanisms. It would speak to the obligation to the citizens in the event that information is lost, stolen or distorted.
It is not beyond the Jamaican system to have an efficient registry that respects the need of all, however, law makers need to spend some more time looking at legislations, obtaining enough expert advice and implement those legislation with the thought in mind that the world we are living in is no in longer 1950s when most of them were already born.