Data defence delay

The regulatory body responsible for Jamaica’s national data protection regime has said it will require another two years before it is in a position to fully enforce the Data Protection Act (DPA), which was passed by Parliament in 2020.

Established under the DPA, the Office of the Information Commissioner (OIC) is responsible for overseeing the use of personal data and addressing breaches as outlined in the law.

During a meeting of Parliament’s Public Accounts Committee (PAC) this week, Information Commissioner Celia Barclay, who fielded questions from committee members, said that, based on a number of challenges, the OIC would not be in a position to fully enforce the DPA until 2028.

She told committee members that, for enforcement to be effective, it was critical to have the required framework in place.

As it relates to the OIC, she said there was still work to be done before the entity could fully exercise the powers granted to it by law, including building staff capacity.

Responding to queries in a submission to the PAC, the OIC said it was significantly constrained by human resource challenges affecting its ability to attract, recruit and retain suitable staff to fill its current structure.

According to the OIC, it had an approved interim structure of 23 posts that did not include certain key support areas and positions. It noted that many of the posts were generally unattractive and uncompetitive because the compensation was, in most cases, not commensurate with the scope of work or expected performance levels.

In October 2025, the Ministry of Finance and the Public Service approved an additional eight posts for the OIC, bringing the total complement to 31 and addressing some of the key areas that were previously missing.

The regulator said recruitment is under way to fill both existing vacancies and the newly established posts.

The OIC also said it requested and received funding in its 2026-2027 budget allocation to engage an organisational development specialist to assist with a restructuring exercise aimed at creating a fit-for-purpose structure for the office.

The agency further complained about the “untenable physical environment” in which staff were required to work due to “unhealthy and rising temperatures within the office”.

In preparation for full enforcement of the law, the OIC said it also requires the necessary information and communications technology infrastructure to operate efficiently in carrying out its mandate.

Additionally, Barclay said the agency must have the necessary arrangements in place to facilitate coordination with other entities involved in the enforcement framework.

She indicated that stakeholders such as the Jamaica Constabulary Force would need to be educated about the provisions of the DPA, particularly as they relate to criminal offences. In addition, mediators involved in dispute resolution would need training to handle matters involving data subjects and data controllers.

“Persons are pushing for enforcement and the easiest thing would be to bring the section in, but the question would be, then what?”

At the same time, the information commissioner told lawmakers that registration for data processors would resume towards the end of September this year. The process has been suspended since December 1, 2025.

Barclay said that, among other things, the OIC is upgrading its systems to facilitate online payment of registration fees.

She added that, notwithstanding the suspension of the registration process, companies and individuals handling personal data remain obligated to comply with the law governing the protection of personal information.

editorial@gleanerjm.com