Standard 2 per Section 20 + the Schedule of the Jamaica Data Protection Act 2020: Personal data shall be collected only for specified + explicit + and legitimate purposes + and shall not be further processed in any manner incompatible with those purposes. (1) Purpose Specification at Collection: (a) purposes must be defined at the point of collection NOT retrospectively justified; (b) purposes documented in Records of Processing Activities (ROPA); (c) Privacy Notice (Section 22) must clearly state purposes; (d) purposes specific to processing activity not vague aggregate; (e) primary + secondary purposes distinguished. (2) Explicit Purposes: (a) NOT implicit or assumed; (b) plain language understandable to data subject; (c) NOT buried in lengthy terms of service; (d) machine-readable purpose taxonomy emerging best practice. (3) Legitimate Purposes: (a) purposes must be lawful + ethical + reasonable; (b) not contrary to Jamaican law + Constitution + Charter of Rights; (c) proportionate to means used. (4) Further Processing - Compatibility Test: (a) further processing for purposes COMPATIBLE with original is permitted; (b) compatibility test factors include (i) link between original and new purpose; (ii) context of collection + reasonable expectations of data subject; (iii) nature of data (especially sensitive); (iv) consequences for data subject; (v) safeguards including encryption + pseudonymisation; (c) further processing for INCOMPATIBLE purposes requires either (i) new lawful basis (often new consent); (ii) compliance with derogation per Section 4 + 41 (research + statistics + archival + journalism); (iii) legal obligation; (d) Section 20(2) permits further processing for archiving in public interest + scientific or historical research + statistical purposes subject to appropriate safeguards. (5) Purpose Drift Risk: (a) common business risk where data collected for purpose A is gradually used for purposes B + C + D; (b) DPIA required when scope changes; (c) re-consent often required for materially new purposes. (6) Marketing + Profiling Specific Restrictions: (a) Section 9 specific consent required for direct marketing; (b) Section 39 right to object to processing for direct marketing absolute; (c) Section 40 right to object to other processing including profiling; (d) Section 41 + 42 automated decision-making restrictions. (7) Children Specific Restrictions: (a) Section 7 enhanced protection for children's data; (b) age verification mechanisms; (c) parental consent under specific age threshold (under 18 default + 16 with regulator approval). (8) Vendor + Joint Controller Purposes: (a) processor must process only on documented instructions; (b) joint controllers must agree purposes by Section 24-26 arrangements; (c) sub-processors subject to same purpose constraints. (9) Implementation: (a) ROPA per Section 25 entries for each processing including Purpose category; (b) Privacy Notice transparency; (c) DPIA when purposes high-risk; (d) Data Classification by purpose; (e) Access Control by purpose; (f) Retention policy by purpose. (10) Penalty Risk: Standard 2 violations subject to administrative penalties per Section 50 + civil compensation per Section 52 + reputational consequences. Coordinates with EU GDPR Article 5(1)(b) + Article 6(4) + UK DPA 2018 + Convention 108+ Article 5(2)(b) + EDPB Opinion 03/2013 Purpose Limitation + OECD Privacy Guidelines + Caribbean Community Model. Jamaica DPA 2020 Standard 2 + Section 20 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.