Standard 6 per Sections 37-43 + the Schedule of the Jamaica Data Protection Act 2020: Personal data shall be processed in accordance with the rights of data subjects under this Act. The sixth Data Protection Standard establishes comprehensive data subject rights closely modelled on EU GDPR + UK DPA 2018 + Convention 108+. (1) Section 37 Right of Access (Subject Access Request - SAR): (a) right to confirmation whether personal data being processed; (b) right to copy of personal data; (c) right to supplementary information (purposes + categories + recipients + retention + rights + sources + automated decision-making); (d) response within 30 calendar days + extension up to 60 days for complex requests; (e) free for first request per year - reasonable fee for additional or excessive; (f) Section 37(8) refusal grounds limited - manifestly unfounded + excessive + frequency disproportionate. (2) Section 38 Right of Correction (Rectification): (a) right to correct inaccurate data; (b) right to complete incomplete data; (c) 30-day response SLA; (d) notification to recipients of correction; (e) reasoned refusal + appealable. (3) Section 39 Right of Erasure (Right to be Forgotten): (a) right to erasure on grounds of (i) no longer necessary; (ii) consent withdrawn; (iii) objection upheld; (iv) unlawful processing; (v) legal obligation; (vi) child consent revocation; (b) 30-day response SLA; (c) notification to recipients; (d) restrictions per legal preservation + public interest + freedom of expression + Section 41 archival. (4) Section 40 Right to Object: (a) right to object to processing including profiling for (i) public interest task; (ii) legitimate interests; (b) controller MUST stop unless compelling legitimate grounds OR for establishment/defence of legal claims; (c) absolute right to object to direct marketing including profiling; (d) absolute right to object to scientific/historical research/statistical that does not involve public interest task. (5) Section 41 Right of Restriction: (a) right to restrict processing where (i) accuracy contested; (ii) processing unlawful but data subject opposes erasure; (iii) controller no longer needs but data subject requires for legal claims; (iv) objection pending review; (b) restricted data can only be stored + other processing requires consent or legal claim. (6) Section 42 Right to Data Portability: (a) right to receive personal data in structured + commonly used + machine-readable format; (b) right to transmit to another controller; (c) applies where processing based on consent or contract + carried out by automated means; (d) does NOT apply to processing for public interest task; (e) NOT to the right or freedoms of others. (7) Section 43 Right Not to Be Subject to Automated Decision-Making and Profiling: (a) right not to be subject to decision based SOLELY on automated processing (including profiling) which produces legal effects concerning him/her or significantly affects; (b) exceptions - explicit consent + contract performance + legal authorisation with safeguards; (c) MANDATORY safeguards including (i) human intervention; (ii) ability to express views; (iii) ability to contest decision; (d) NO solely automated decisions based on sensitive data (Section 5) except explicit consent or substantial public interest; (e) Jamaica AI Strategy alignment + emerging guidance. (8) Subject Rights Mechanism Requirements: (a) DSAR portal + verification; (b) Identity verification proportionate to risk; (c) Workflow + ticketing + SLA tracking; (d) Audit trail of requests + decisions + actions; (e) Downstream propagation; (f) DPO oversight + escalation; (g) OIC appeal; (h) Court action under Section 52. (9) Children Specific: (a) Section 7 enhanced rights; (b) Parental + guardian intervention; (c) Age-appropriate communication; (d) Special consideration for age-of-consent. (10) Penalties: (a) Section 50 administrative penalties for failure to enable rights; (b) Section 52 civil compensation for material/non-material damage; (c) JMD 10 million administrative ceiling. Coordinates with EU GDPR Articles 12-22 + UK DPA 2018 Part 3 + Convention 108+ Article 9 + ISO/IEC 27701 + EDPB Guidelines on Data Subject Rights + Jamaica Section 22 Privacy Notice + Section 24-26 Processor Contracts + Section 50-52 Penalties. Jamaica DPA 2020 Standard 6 + Sections 37-43 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.