Judi-Ann Edwards | Free Wi-Fi and data protection

The introduction of free Wi-Fi on buses and at business establishments has been categorised as a cutting-edge initiative, and perhaps rightly so. It is a known fact that several businesses, from restaurants to banks, offer free Wi-Fi as a selling point to attract customers. However, these initiatives have sparked much discussion surrounding the increasing requirement to divulge personal information to access these and other services in the Digital Age.

The main concern is how the personal information will be managed, once divulged. When these bits of information sit on servers and computer systems, how are they protected, and what use is made of the information?

In this Digital Age, we are generally required to share our personal information with various persons, entities, websites and companies. It has become the norm to sign up, placing our personal information, such as name, address, credit card information, email address, next of kin, date of birth, on electronic forms.

In divulging such information, it is not expected that it will be used in a manner other than the agreed purpose, or shared without permission. Additionally, the data subjects expect that the shared data will not be used maliciously to harm their reputation. These and other vital data management issues are directly addressed by the Data Protection Bill of Jamaica.

Aim of Data Protection Legislation

The bill, which is currently before Parliament, will perhaps revolutionise data protection in Jamaica, as its objective is to "protect the privacy of certain data and for connected matters". It defines data controller as any person or public authority who processes personal data or determines the purpose or manner in which personal data is processed.

Personal data includes any expression of opinion about the individual or any intention in respect of the individual. For this reason, most institutions, such as banks, schools, government entities, will fall under the definition of data controllers, as they, in fact, process personal data of data subjects.

The bill seeks to protect the personal data of individuals by imposing certain standards on data controllers. The data controllers' failure to abide by the standards can result in criminal sanctions. The bill states that a fine or a term of imprisonment, not exceeding seven years, can be imposed on those who breach the standards.

The Seventh Standard

For the purpose of our discussion regarding cybersecurity, we will look closely at the seventh standard under the bill specifically addressing the security of the data. It states: "Appropriate technical and organisational measures shall be taken by the data controller against unauthorised or unlawful processing of personal data and against accidental loss or destruction or damage to personal data.

"The data controller shall ensure that the information commissioner is notified without any undue delay of any breach of their security measures which affect any personal data ... ."

The technical measures adopted by the entity must be commensurate with the harm that might result from the loss or destruction of data. Therefore, the more valuable or critical the data, the greater the effort should be made to secure it.

Additionally, the data controller also has a responsibility to take reasonable steps to ensure that its employees, agents or anyone processing data on their behalf adhere to the relevant security measures.

As we celebrate Cyber Awareness Month, it must be borne in mind that cybersecurity is indeed everybody's business. As we reflect on the importance of cybersecurity, all entities that collect the personal data of individuals must see themselves as stakeholders in the fight for cybersecurity; the proper management of the data means that the systems which host the personal information of their clients ought to be safe and secure.

- Judi-Ann Edwards is Crown counsel of the Cybercrime Unit, Office of the Director of Public Prosecutions. Email feedback to columns@gleanerjm.com.