How to avoid a personal data

• February 26 2020
• http://www.jamaicaobserver.com/business-observer/how-to-avoid-a-personal-data_188018

The recent inadvertent disclosure of personal data at some major financial institutions in Jamaica has signalled the need for organisations to take a very robust approach to the way in which they handle the personal data of customers. Organisations may face significant penalties and fines for failing to properly handle the personal data of its customers in a safe, secure, and confidential manner.

Under the Banking Services Act, there is a general duty of confidentiality or secrecy imposed upon employees and agents of financial institutions as it relates to customer information. Any employee or agent of a financial institution who unlawfully divulges or reveals any information regarding a customer account commits a criminal offence under the Act and may be liable to a fine of up to $7.5 million or to imprisonment for a term not exceeding five years.

Likewise, a personal data breach under the European Union's General Data Protection Regulation (GDPR) may result in a company being liable to a fine of up to €20 million or four per cent of its global annual turnover whichever is higher. Just recently, Marriott International was found to be in breach of the GDPR due to the negligent exposure of the personal records of approximately 339 million guests. Marriott International was fined a total sum of £99 million by the UK's data protection regulator.

What is distinct about the GDPR is that it is extraterritorial in scope, in that, it applies to any organisation which processes personal data of EU citizens by offering goods or services to EU citizens, irrespective of whether the organisation is located within or outside the EU. Financial institutions in Jamaica would therefore be caught by the GDPR once they provide financial services to an EU citizen and collect their personal data.

Organisations should also be mindful of the data protection obligations under the impending Data Protection Act, 2017 which is expected to be passed in Jamaica in a few months. Based on the provisions of the latest draft of the Act, a personal data breach under the Act can result in an organisation being liable to a fine of up to 10 per cent of its annual gross income. A director, manager, secretary, or other similar officer of the organisation may also be held personally liable for failing to comply with their data protection obligations under the impending Act. Additionally, any person who can prove that they have suffered some sort of damage from the breach would be entitled to compensation from the organisation under the Act.

In light of the severity of the fines and penalties which organisations may face, it is important that certain best practices be adopted in order to minimise the risks of a personal data breach. Having regard to the applicability of the GDPR to some organisations as well as the provisions under the Data Protection Act, 2017, the following best practices may be useful.