Enforcement Provisions of Data Protection Act to Be Fully Activated

Measures are being taken to ensure that enforcement provisions of the Data Protection Act will be fully activated and to further place the Office of the Information Commissioner (OIC) on a path to becoming a technically capable, enforcement-ready national data protection authority.

The Data Protection Act, passed in 2020, established the framework for how personal data in Jamaica is collected, used, and protected. It created the Office of the Information Commissioner (OIC) as the country’s national data protection regulator.

Minister without Portfolio with responsibility for Science, Technology and Special Projects, Dr. the Hon. Andrew Wheatley, provided details on the measures, during his contribution to the 2026/27 Sectoral Debate in the House of Representatives on June 2.

“We have the law. What we have not yet done is fully enforce it. There is a structural reason for this. The OIC was established with an interim organisational structure that was not adequate for the full scope of its regulatory mandate – functional areas unprovided for, staffing below the required level, and key officers without the specialised technical training that compliance oversight demands,” the Minister said.

“The OIC has worked with what it has, building the framework and running a growing public awareness programme. But awareness without enforcement is not regulation. It is education. The Government has heard what the OIC has said and we have acted,” Dr. Wheatley stated.

To this end, he said the OIC’s full requested budget for this financial year has been approved, noting that that approval unlocks the resources the Office needs to begin the restructuring work that has been long overdue.

In addition, an OIC Data Protection Working Group has been formally constituted and mandated, bringing together the technical expertise, legal knowledge, and operational capacity required to guide the restructuring of the Office and to accelerate its readiness for full enforcement. “That work is under way now,” he said.

On the matter of the Data Protection Oversight Committee, he said members have been selected and the approval process is in its final stages.

“I will be candid about the delays. The legislation requires the Committee include a retired High Court Justice, a well-intentioned provision that in practice created a significant bottleneck. Finding a willing and qualified retired Justice proved far more difficult than the law assumes, and I want to signal to this House that this warrants legislative review,” he said.

He noted that the current formulation places the timeliness of a critical governance appointment at the mercy of a very small pool of eligible candidates.

“With the budget secured, the Working Group active, and the Oversight Committee appointment in its final stages, the OIC is now on a clear path to becoming what it was always designed to be – a fully functioning, technically capable, enforcement-ready national data-protection authority,” the Minister said.

“And when that authority is in place, the enforcement provisions of the Data Protection Act will be activated. Data controllers will register, comply, and be held accountable. Jamaicans who trust organisations with their personal data have a right to expect that trust to be protected, not just in law but in practice,” he said.

He said data is the infrastructure of the 21st century. “Just as we would not tolerate a foreign power owning our roads or our water supply, we cannot be passive consumers of our own national data. Data sovereignty – Jamaica’s right to control, govern, and benefit from the data generated within our borders – is not a technical concept. It is a national security and national development imperative,” he reasoned.