OIC to Process Data Controllers’ Registration Applications in Order of Priority

The Office of the Information Commissioner (OIC) will be processing registration applications for Data Controllers in order of priority.

In a public notice published on June 2, the OIC said it is balancing the rights and interests of all people as it phases implementation of the Data Protection Act.

In the first phase, from June 1 to August 31, 2024, the OIC will process all Public Authorities and all data controllers processing personal data, inclusive of sensitive personal data or personal data related to criminal convictions. This, for an estimated 10,000 or more data subjects operating within the education, finance, health, information and communications technology (ICT), and tourism and hospitality sectors.

“Notwithstanding the above, any data controller, including sole proprietors/practitioners or operators of micro, small and medium-sized enterprises (MSMEs) across all sectors or industries, can submit their application for registration,” the public notice indicated in part.

Data controllers must have a validated data controller account to access the registration form on the ‘My OIC Portal’ on the OIC’s website, www.oic.gov.jm, and submit their registration particulars.

The OIC noted that data controllers who have not yet created their unique data controller accounts will need to do so to gain access to the registration form.

“Those data controllers who have already created their accounts and received the email from the OIC verifying this account may proceed to use the credentials provided in that verifying OIC email to access the registration form and enter their particulars,” the public notice stated.

Under the Data Protection Act, which took effect on December 1, 2023, persons holding, receiving, using, collecting or dealing with personally identifiable information of any individual are considered data controllers and must register with the OIC.