Section 5 of the Jamaica Data Protection Act 2020 establishes special protections for Sensitive Personal Data + Section 7 establishes additional protections for children's data. (1) Section 5 Sensitive Personal Data Categories: (a) race or ethnic origin; (b) political opinion; (c) religious beliefs or other beliefs of a similar nature; (d) trade union membership or activities; (e) physical or mental health condition; (f) sexual orientation or sex life; (g) commission or alleged commission of any offence; (h) any proceedings + dispositions + sentences related to offences; (i) genetic data; (j) biometric data; (k) any other category Commissioner specifies. (2) Section 5(2) Lawful Basis for Sensitive Data Processing: processing PROHIBITED unless one of these conditions applies (a) Explicit Consent of data subject (specific to the sensitive data + informed); (b) Employment Law + labour law obligations including occupational health + welfare; (c) Vital Interests where data subject physically or legally incapable of consent; (d) Non-Profit Body (political + philosophical + religious + trade union) within own membership; (e) Manifestly made public by data subject; (f) Legal claims + judicial proceedings + court orders; (g) Substantial Public Interest with appropriate safeguards; (h) Preventive Medicine + Occupational Medicine + Health/Social Care under professional secrecy; (i) Public Interest in Public Health with appropriate safeguards; (j) Archival + Research + Statistics with appropriate safeguards (Section 41). (3) Section 5(3) Explicit Consent Standard: (a) higher bar than general consent; (b) specific to the sensitive data; (c) informed of consequences; (d) clear affirmative action; (e) easily withdrawable. (4) Genetic Data Specific: (a) any personal data relating to inherited or acquired genetic characteristics; (b) gives unique information about physiology + health; (c) emerging area with DNA testing + ancestry services + research biobanks; (d) heritable nature affects family members data subjects; (e) Jamaica Bioethics Council emerging guidance. (5) Biometric Data Specific: (a) personal data resulting from specific technical processing allowing or confirming unique identification (e.g. facial images + dactyloscopic data); (b) emerging area with national ID card + facial recognition + voice ID + fingerprint border; (c) Jamaica National Identification and Registration Act 2017 (struck down by Constitutional Court 2019) + replacement legislation; (d) higher accuracy + non-revocable nature concerns. (6) Health Data Specific: (a) physical or mental health; (b) medical records + diagnoses + treatments + medications + mental health; (c) Jamaica Public Health Act + Pharmaceutical Act + Mental Health Act; (d) Telemedicine emerging post-COVID; (e) FSC insurance health data overlap. (7) Section 7 Children's Data Enhanced Protections: (a) child defined as person under 18 by default (Section 2); (b) age verification required where service directed to children; (c) parental/guardian consent for processing of personal data of children under 16 (Section 7(2)); (d) consent must be given in language appropriate to child; (e) controller must take reasonable steps to verify parental consent; (f) child-friendly Privacy Notice; (g) NO behavioural advertising or profiling for marketing to children; (h) high-risk processing trigger DPIA. (8) Schools + Education: (a) Education sector specific provisions + Jamaica Ministry of Education guidelines; (b) Education records + school-based data; (c) Parental access vs child's evolving rights; (d) Online learning platforms (post-COVID); (e) Edu-tech vendor due diligence. (9) Public Sector + Sensitive Data: (a) Section 4 exemptions for national security + crime + welfare often involve sensitive data; (b) safeguards still required + Section 5 conditions; (c) Public sector accountability + transparency. (10) Penalties for Sensitive Data Violations: (a) Section 50 administrative penalties heightened for sensitive data; (b) Section 31 unauthorised disclosure - up to JMD 4M + 4 years; (c) Section 52 civil compensation includes non-material damages; (d) reputational + ethical consequences. Coordinates with EU GDPR Articles 8 + 9 + 10 + UK DPA 2018 + Convention 108+ Article 6 + EDPB Guidelines on Special Categories + Children's Code (UK ICO Age Appropriate Design Code) + Caribbean Community CRC Convention on the Rights of the Child + Jamaica Constitution Charter Section 13(3)(j) + Section 13(3)(a) + Public Health Act + Education Act + National Identification and Registration Act + Child Care and Protection Act. Jamaica DPA 2020 Sections 5 + 7 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.