Standard 1 per Section 19 + the Schedule of the Jamaica Data Protection Act 2020: Personal data shall be processed fairly + lawfully + transparently. The first of 8 Data Protection Standards establishes the foundational requirement that ALL processing must have a lawful basis + be carried out fairly toward data subjects + and be transparent in its purposes + means + and consequences. (1) Lawful Basis (Section 19) - at least one of the following must apply: (a) the data subject has given consent (subject to specific consent requirements per Sections 11 + 16 + Schedule); (b) the processing is necessary for performance of a contract to which the data subject is a party + or for steps requested by the data subject prior to entering a contract; (c) the processing is necessary for compliance with a legal obligation other than a contractual obligation to which the controller is subject; (d) the processing is necessary to protect vital interests of the data subject or another natural person (i.e. life or limb); (e) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) the processing is necessary for the purposes of the legitimate interests of the controller or a third party (except where overridden by fundamental rights and freedoms of the data subject + particularly minors). (2) Consent Requirements per Section 11 + Schedule: (a) freely given; (b) specific to defined purposes; (c) informed; (d) unambiguous indication; (e) clear affirmative action (opt-in not opt-out); (f) withdrawable at any time without detriment; (g) bundled consent (taking it or leaving it) is not freely given; (h) pre-ticked boxes + silence + inactivity do NOT constitute consent. (3) Deemed Consent per Section 11: limited circumstances where consent is deemed to have been given - (a) in the course of conducting the controller's business; (b) employee relationship; (c) financial sector regulatory requirements - subject to overriding data subject rights + Section 11(3) explicit conditions. (4) Direct Marketing Consent per Section 9: special opt-in consent required for direct marketing + including (a) clear identification of marketer; (b) easy opt-out at each communication; (c) prohibition on direct marketing to children; (d) telemarketing register provisions; (e) Section 9(7) penalty - up to JMD 4 million fine or 4 years imprisonment per offence. (5) Fair Processing requires (a) NO deception or coercion of data subject; (b) processing in accordance with reasonable expectations of data subject; (c) not detrimental to data subject's interests + fundamental rights + freedoms; (d) considerations of vulnerability (children + elderly + disability + economic vulnerability). (6) Transparent Processing requires (a) Privacy Notice at point of collection per Section 22 - identity of controller + DPO contact + purposes + lawful basis + categories + recipients + retention + rights + complaint mechanism + transfer information + automated decision-making/profiling + right to withdraw consent; (b) plain + clear language + accessible to data subject; (c) layered notice approach + just-in-time notice; (d) Privacy Notice updates + change notification + version control; (e) DPO accessible to data subjects; (f) ICO accessible to data subjects. (7) Special Categories of Personal Data per Section 5: processing of Sensitive Personal Data (race + ethnicity + political + religious + philosophical + trade union + genetic + biometric + health + sex life + sexual orientation + criminal convictions) requires (a) one of explicit consent + employment law + vital interests + non-profit + public-domain + legal claims + substantial public interest + preventive medicine + public health + archival/research/statistics; (b) Section 5(2) explicit consent for sensitive data must meet additional explicit + specific + informed requirements; (c) Sensitive Data Impact Assessment recommended. Coordinates with EU GDPR Articles 5 + 6 + 7 + 9 + 13 + 14 + UK DPA 2018 Schedule 1 + Convention 108+ + Caribbean Community Model + EDPB Guidelines on Consent + Transparency + Jamaica Telecommunications Act 2000 + FSC Cybersecurity Guidelines + BoJ Financial Inclusion Standards. Jamaica DPA 2020 Standard 1 + Section 19 + Section 5 + Section 9 + Section 11 + Section 22 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.