16. Provision of registration particulars

16.—

1. A data controller who wishes to process personal data in circumstances in which registration is required under section 15(1) shall ensure that the Commissioner is provided with—

(a) the registration particulars set out in subsection (2), in relation to the data controller, and that the Commissioner is kept informed as to any changes in those particulars;

(b) a general description of the measures to be taken for the purpose of complying with section 30; and (c) in any case where—

(i) personal data are being, or are intended to be, processed in circumstances where the prohibition imposed by section 15(1) is excluded by section 15(2); and

(ii) the particulars provided under this section do not include the particulars in relation to those personal data,a statement of that fact.

2. The registration particulars are—

(a) the data controller’s name, address and other relevant contact information;

(b) if the data controller has appointed a data controller representative for the purposes of this Act, the name, address and other relevant contact information of the data controller representative;

(d) a description of the personal data being, or to be, processed by or on behalf of the data controller and the category or categories of data subjects to which they relate;

(e) a description of the purpose or purposes for which the personal data are being, or are to be, processed;

(f) a description of any recipient or recipients to whom the data controller intends, or may wish, to disclose the personal data;

(g) the names of any States or territories outside of Jamaica to which the data controller directly or indirectly transfers, or intends or may wish directly or indirectly to transfer, the personal data;

(h) where the data controller is a public authority, a statement of that fact; and

(i) such information about the data controller as may be prescribed in regulations made under subsection (3).

3. The information required under subsection (1) shall be submitted to the Commissioner in such form and manner as may be prescribed, together with such registration fee as may be prescribed, by regulations made by the Commissioner with the approval of the Minister.

4. Regulations made under subsection (3) may make provision—

(a) as to the giving of notification by partnerships or in other cases where two or more persons are the data controllers in respect of personal data;

(b) for any fee paid under subsection (3) or section 17(3) to be refunded in specified circumstances;

(d) as to the time as from which any entry in respect of a data controller is to be treated as having been made; (e) for longer or shorter periods than the period specified in section 17(3), and different periods may be prescribed in relation to different cases; (f) as to fees for supplying certified copies under section 17(4).

5. Where personal data are processed in any case where— (a) section 15(1) does not apply to the processing, by virtue of the provisions of section 15(2); and (b) the data controller has not provided the particulars specified in subsection (2), the data controller shall, if requested to do so in writing by any person, make the particulars referred to in paragraph (b) available to the person free of charge, within thirty days after receiving the request.

6. Subsection (5) shall be subject to any exemptions made thereto in regulations made under subsection (3).

7. A data controller who contravenes subsection (5) commits an offence and shall be liable upon conviction before a Parish Court to a fine not exceeding one million dollars.

8. It shall be a defence for a person charged with an offence under subsection (7) to show that the person exercised all due diligence to comply with subsection (5), and the standard of proof shall be on the balance of probabilities.

<-- Contents page