The Jamaica Data Protection Act 2020 establishes a comprehensive penalty regime spanning criminal + civil + and administrative penalties. (1) Section 50 Administrative Penalties: (a) imposed by Commissioner; (b) UP TO JMD 10 MILLION per violation; (c) considerations - nature/gravity/duration + intentional/negligent + mitigation measures + responsibility level + previous infringements + cooperation + categories of data + manner came to attention + effect + other factors; (d) Per-violation cumulation possible; (e) tiered approach typical; (f) issued by Penalty Notice per Section 49; (g) Appeal to Tribunal + High Court. (2) Section 31 Unauthorised Disclosure + Use - Criminal Offence: (a) knowingly or recklessly without consent of controller (i) obtains + discloses + procures disclosure; (ii) sells + offers for sale; (b) UP TO JMD 4 MILLION FINE + 4 YEARS IMPRISONMENT; (c) on summary conviction OR indictment; (d) Director + officer liability for corporate offences. (3) Section 32 Failure to Register + Provide Information: (a) failure to register per Section 16; (b) failure to provide information when notified; (c) UP TO JMD 2 MILLION FINE + 2 YEARS IMPRISONMENT; (d) Continuing offence accumulating per day. (4) Section 33 Unauthorised Re-identification: (a) re-identifying de-identified personal data without consent; (b) UP TO JMD 4 MILLION FINE + 4 YEARS IMPRISONMENT; (c) Recognised that de-identification not absolute. (5) Section 31(2)/32(2)/33(2) Defences (Reasonable Care): (a) reasonable care defence - person took all reasonable precautions and exercised all due diligence; (b) due diligence defence; (c) burden on accused; (d) corporate due diligence systems essential. (6) Section 52 Civil Compensation: (a) data subject right to compensation; (b) material damage (financial loss + property + medical); (c) non-material damage (distress + anxiety + reputational); (d) burden of proof on data subject (lighter under Section 52 vs general civil); (e) joint and several liability of joint controllers + controller-processor; (f) limitation - 3 years from awareness; (g) Class action possible per Civil Procedure Rules; (h) Litigation funding emerging. (7) Director + Officer Liability per Section 31(3): (a) corporate offences attributable to director + officer who consented + connived + neglected; (b) personal criminal liability; (c) corporate veil pierced; (d) D and O insurance considerations; (e) Indemnification limits; (f) Personal financial exposure. (8) Cumulative Penalty Exposure: (a) administrative + criminal + civil typically separate; (b) double jeopardy considerations for criminal; (c) administrative penalty does not bar civil claim; (d) settlement strategies; (e) reputational damages typically uninsurable. (9) Risk Management Framework: (a) Penalty Risk Assessment - quantify exposure; (b) Insurance - Cyber + Privacy + D and O; (c) Compliance Investment - prevention < remediation < penalty; (d) Incident Response Plan - reduce per-incident impact; (e) Privacy Impact - reduce probability; (f) Vendor Risk - cascade liability via Section 26 contracts; (g) Indemnification + Limitation of Liability in customer contracts. (10) Board + Senior Management Accountability: (a) Tone-at-the-top; (b) Risk Appetite Statement + Privacy Risk Tolerance; (c) Quarterly Privacy Reporting to Board; (d) Annual Privacy Risk Review; (e) Audit Committee oversight; (f) ESG reporting including privacy; (g) Investor + Lender + Insurer scrutiny. Coordinates with EU GDPR Articles 82-84 + UK DPA 2018 + Convention 108+ + Jamaica Charter of Fundamental Rights and Freedoms 2011 + Jamaica Civil Procedure Rules + Limitation Act + Companies Act 2004 Director Duties + Insurance Act + FSC Cybersecurity Guidelines + Risk Management ISO 31000 + Crisis Management + Communications Strategy. Jamaica DPA 2020 Sections 31-33 + 50 + 52 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.