Mon | Oct 3, 2022

ECJ selling voters’ data

• Electoral authority granting private entities paid access to ID database • Attorneys split on whether agreements breach the law

Published:Sunday | March 27, 2022 | 12:10 AMTyrone Reid - Associate Editor – Investigations
A voter ID specimen used by the ECJ.
A voter ID specimen used by the ECJ.

Attorney-at-law Dr Lloyd Barnett.
Attorney-at-law Dr Lloyd Barnett.

Attorney-at-law Chukwuemeka Cameron.
Attorney-at-law Chukwuemeka Cameron.

The Electoral Commission of Jamaica (ECJ) has been granting privately owned credit bureaus and other financial institutions paid verification access to the island’s voter identification database with the country’s information commissioner admitting...

The Electoral Commission of Jamaica (ECJ) has been granting privately owned credit bureaus and other financial institutions paid verification access to the island’s voter identification database with the country’s information commissioner admitting that her office is not yet in a position to determine whether this is in breach of legislation.

The ECJ, which is charged with protecting the electoral process from the immediate direction, influence and control of the Government, stores personal data for approximately 1.96 million Jamaicans on the voters’ list.

It has made approximately $300,000 between 2019 and 2021 under two contracts with credit bureaus, providing an online service for the authentication of voter ID cards, with data restricted to that presented on the cards, said the ECJ. Almost $1 million was made from eight financial institutions under similar arrangements over the same period.

“CreditInfo and CRIF were granted non-exclusive access to the voter identification card database via electronic means to verify the authenticity of a voter identification card presented to them by the owner. The credit bureaus will pay the agreed fee each time they access the voter identification card database ... ,” the ECJ confirmed to The Sunday Gleaner, adding that intellectual property rights of the cards and any underlying technology remains owned by the commission.

“The database utilised is an extract containing only elector ID card information as reflected on the ID card and requires the elector to have presented their ID card authorising the verification of the authenticity of said card,” it added.

According to the ECJ, the first credit bureau contract was inked with CreditInfo in January 2017 and the other with CRIF Information Bureau Jamaica Limited in May 2019.

“One credit bureau [contract] has been renewed and the other is in the process of being renewed. The commission, of which the director of elections is a member, approved the arrangement after the necessary due diligence was carried out,” the ECJ said, although it also appears that the existence of these contracts was not revealed to the nation’s Parliament, to which the ECJ reports.

Authenticating the voter ID card

When asked whether the Parliament was aware of the arrangements, the ECJ stated: “These are service arrangements for authenticating the voter ID card which falls under the purview of the Electoral Commission.”

Sunday Gleaner sources have revealed that under one of the contracts, the credit bureau was charged $50 per enquiry in the first year and $100 per enquiry in the second year.

There are concerns that the contacts could be in breach of the island’s Data Protection Act – which, among other things, guards against unlawful disclosure of a person’s biometric data, including physical characteristics such as the photograph or other facial image or other biological attributes.

Our news team has also ascertained that at least one credit bureau has been giving credit-granting institutions, such as banks and credit unions, access to the ECJ database as well as another hosted by Tax Administration Jamaica for them to validate voter IDs and driver’s licences.

The ECJ did not respond to questions as to whether this was a breach of the contracts it signed with the credit bureaus. In previous written responses to The Sunday Gleaner, the ECJ said it was not aware of any breach by the credit bureaus.

However, Information Commissioner Celia Barclay told The Sunday Gleaner that her yet-to-be-fully-functional office is unable to make a determination as to whether the legislation has been violated at this time.

“It’s a new office. The act was passed in 2020. And, as you are aware, I was appointed in December [2021] and it takes time to build out a team and put everything in place. We need policies, procedures, systems, staff [and] resources just like any other office of Government. We are starting from zero,” she told The Sunday Gleaner.

Added Barclay: “The regulations are still in the process of being considered and drafted. It will take some time also before those are passed and promulgated. Until then, we are limited in what we are able to do and the extent to which we are able to fulfil our mandate.”

She added that Office of the Information Commissioner is only now able to carry out public awareness and sensitisation exercises, but made it clear that once it becomes fully operational, it would be able to examine matters of this nature.

“If there is a breach of the legislation, it is our job to investigate it and, if necessary, prosecute, and in prosecuting, we would do so with the assistance of the director of public prosecutions.

“In so far as the ECJ holds personal data that is protected by the Data Protection Act, then any breach is something that could be reported to the office when it is fully operational and be investigated and treated with as necessary,” Barclay said.

Attorney-at-law Chukwuemeka Cameron believes the ECJ is breaching voters’ constitutional right to privacy as well as the tenets of the Data Protection Act.

“The first data processing standard is that processing must be lawful and fair. Lawful, in this instance, means that the citizens’ elector ID card should only be processed for the purposes of giving effect to the objectives stated in the law – safeguarding the democratic foundations of Jamaica by enabling eligible electors to elect, through free and fair elections, their representatives to govern Jamaica,” he told The Sunday Gleaner.

“If an elector ID card is being processed for any other purpose outside of the stated objective, it is unlawful. Providing commercial authenticating services is not in furtherance of the stated objective,” added Cameron, who is also CEO of Design Privacy, a consultancy firm specialising in compliance with privacy laws.

“Assuming the processing was lawful, the second part of the data processing standard requires the processing be fair. The Electoral Commission has a duty to inform the elector of the manner in which they are processing their data by way of a privacy notice that is prescribed by the law. In essence, members of the public should be able to view a public document to have most of the questions you have asked answered,” said Cameron.

The attorney added that given the quantity and quality of personal data being processed by the ECJ, he would believe it was moving to acquire the requisite domain expertise to comply with the Data Protection Act and respect the right to informational privacy.

However, Dr Lloyd Barnett, one of Jamaica’s leading constitutional lawyers, does not believe the ECJ is breaking the law.

“Based on what they have said, there is no breach. It depends on what’s made available. You need the supervision to make sure that the contract has sufficient protective provisions, and secondly, that the system being used doesn’t allow for any leakage of any information that’s unnecessary or improper. I don’t know whether or not these safeguards have been put in, but they are necessary because the act requires certain standards that must be maintained. There is a distinction between personal information and certain biometric data that are sensitive such as fingerprints,” said Barnett.

But Barnett, who is also chairman of Citizens Action for Free and Fair Elections, believes contracts of this nature should be revealed to Parliament.

“I haven’t examined that carefully, but I would think that full disclosure to Parliament is an appropriate approach. I would recommend it,” he said.

When contacted, Science, Energy and Technology Minister Daryl Vaz, under whose ministry the Office of the Information Commissioner falls, directed The Sunday Gleaner to the ministry’s acting permanent secretary. Several calls to her mobile number went unanswered.

“Based on what you’re telling me, obviously, I need to get more information, but based on the concerns of the lawyer, that’s something that needs to be looked into right away,” Vaz said.

Income earned by ECJ from credit bureaus

2019 – $8,750

2020 – $80,900

2021 – $201,200