31. The eighth standard

31.—

1. The eighth standard is that personal data shall not be transferred to a State or territory outside of Jamaica unless that State or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

2. For the purposes of subsection (1), an adequate level of protection is one which is adequate in all the circumstances of the case, having regard in particular to—

(a) the nature of the personal data;

(b) the State or territory of origin of the information contained in the personal data;

(d) the purposes for which and the period during which the personal data are intended to be processed;

(e) the law in force in the State or territory in question;

(f) the international obligations of that State or territory;

(g) any relevant codes of conduct or other rules which are enforceable in that State or territory (whether generally or by arrangement in particular cases); and

(h) any security measures taken in respect of the personal data in that State or territory.

3. The eighth standard does not apply to a transfer falling within any of the cases specified in subsection (4), except in such circumstances and to such extent as the Minister may prescribe after consultation with the Commissioner.

4. The cases referred to in subsection (3) are, where—

(a) the data subject consents to the transfer;

(b) the transfer is necessary—

(i) for the performance of a contract between the data subject and the data controller; or

(ii) for the taking of steps at the request of the data subject with a view to the data subject entering into a contract with the data controller;

(c) the transfer is necessary for the conclusion or performance of a contract, between the data controller and a person other than the data subject, which—

(i) is entered into at the request of the data subject;

(ii) is in the interests of the data subject;

(d) the transfer is necessary for reasons of substantial public interest; (e) the transfer—

(i) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings);

(ii) is necessary for the purpose of obtaining legal advice; or

(iii) is otherwise necessary for the purpose of establishing, exercising, or defending, legal rights;

(f) the transfer is necessary in order to protect the vital interests of the data subject;

(g) the transfer is part of the personal data on a public register and any conditions subject to which the register is open to inspection are complied with by any person to whom the personal data are or may be disclosed after the transfer;

(h) the transfer is made on terms (which may include contractual terms) that are of a kind approved by the Commissioner as ensuring adequate safeguards for the rights and freedoms of data subjects;

(i) the transfer has been authorised by the Commissioner as being made in such a manner as to ensure adequate safeguards for the rights and freedoms of data subjects;

(j) the transfer is necessary for the purposes of national security or the prevention, detection or investigation of crime.

5. The Minister may prescribe, by order published in the Gazette—

(a) circumstances in which a transfer is to be taken for the purposes of subsection (4)(d) to be necessary for reasons of substantial public interest;

(b) circumstances in which a transfer which is not required by or under an enactment is not to be taken for the purposes of subsection (4)(d) to be necessary for reasons of substantial public interest; and

(c) the States and territories which shall be taken to have an adequate level of protection within the meaning of subsection (2).

6. For the purposes of subsection (5)(c)—

(a) a State or territory having an adequate level of protection as described in that subsection shall be included in the order only if such inclusion is necessary for the fulfilment of Jamaica’s international obligations; and

(b) the order may provide for such conditions and restrictions as may be applicable under the international obligation concerned.

7. Where any question arises as to whether a transfer may be made to a State or territory, other than a State or territory included in an order made under subsection (5)(c), the matter shall be determined by the Commissioner, who shall issue a notice stating—

(a) the relevant public authority with responsibility for the protection of personal data in the State or territory concerned;

(b) the Commissioner’s determination as to the adequacy of the level of protection (within the meaning of subsection (2)) in the State or territory concerned; and

(c) where the Commissioner determines that the level of protection is not adequate, the extent to which the Commissioner considers that the level of protection is not adequate.

<-- Contents page