Understanding Jamaica's Data Protection Act

WEBVTT
00:00:07.371 --> 00:00:15.249
Welcome to we Can Solve this, a podcast where we break down issues and provide solutions based on research and best practices.
00:00:15.249 --> 00:00:20.402
We hope that the ideas shared here help to build thriving communities wherever you are.
00:00:20.402 --> 00:00:35.968
Our guest today is Trevor Forrest, and Trevor is an IT practitioner with over three decades of experience, particularly recognized for his experience in cybersecurity, digital transformation and artificial intelligence.
00:00:35.968 --> 00:00:54.054
His career has been marked by a steadfast dedication to elevating ICT standards within both the private and public sectors, where he has been instrumental in designing and evaluating a multitude of ICT projects and digital transformation strategies.
00:00:54.054 --> 00:01:06.611
As the founder of 876 Technology Solutions since 2006, mr Forrest has been at the forefront of advocating for open source technology in the Caribbean.
00:01:06.611 --> 00:01:24.513
His company is committed to aiding organizations in their digital transformation journeys, offering services that range from strategic planning to the implementation of cutting edge technologies like blockchain, big data analytics and cloud based solutions.
00:01:24.513 --> 00:01:29.352
Trevor, it's an absolute joy to be sitting and having this conversation with you.
00:01:29.352 --> 00:01:31.908
Welcome to we Can Solve this.
00:01:31.908 --> 00:01:33.063
How are you doing today?
00:01:33.305 --> 00:01:34.087
I'm doing great.
00:01:34.087 --> 00:01:35.706
Thank you so much for having me.
00:01:35.706 --> 00:01:38.293
I'm really happy to be here.
00:01:38.978 --> 00:01:39.200
Awesome.
00:01:39.200 --> 00:01:53.073
So we're going to have an easy conversation about a big topic, and what I'd love for us to do in this conversation is to really break down and simplify the Data Protection Act.
00:01:53.073 --> 00:01:57.543
Okay, and I really would like us to look at a few things.
00:01:57.543 --> 00:02:05.153
Trevor, what is this thing called the Data Protection Act and who does it apply to, you know?
00:02:05.153 --> 00:02:10.028
Does it apply only to big companies, you know, or to the little man on the street?
00:02:10.028 --> 00:02:17.508
So why don't we start off the conversation with what is the Data Protection Act?
00:02:18.090 --> 00:02:18.330
Okay.
00:02:18.330 --> 00:02:30.414
So to explain the Data Protection Act, because you know, when you talk about legislation and laws, it's not something that a lot of people gravitate to.
00:02:30.414 --> 00:02:54.454
It's not sexy discussion act as a bone, and why it's important is to look at it from the standpoint of where we are now, how we function, especially how we function in this digital age that we're in.
00:02:54.454 --> 00:03:12.733
So one of the things that has happened to us over the past 20 to 30 years is we've seen an increased use and creation of data right in electronic form.
00:03:13.375 --> 00:03:13.816
Trevor.
00:03:13.816 --> 00:03:15.080
What do you mean by data?
00:03:15.620 --> 00:03:17.122
Ah, very good question.
00:03:17.122 --> 00:03:51.159
So any information and I'm going to use a word that I know you have a problem with, right, Right, but any information that is in digital form or non-digital form that we look at, we read, we store, we save, Anything of that kind of nature that has information in it that is stored, collected, saved, deleted or whatever, that's really what data is Got you, Okay?
00:03:51.159 --> 00:03:58.114
So everybody comes into contact with some form of data, right?
00:03:58.114 --> 00:04:06.991
So if it is that you're using your mobile phone, the numbers that you have in your mobile phone represent data.
00:04:08.221 --> 00:04:17.492
If you go to an office and you take a paper out of a filing cabinet, what's on that paper can be viewed as data, right?
00:04:17.492 --> 00:04:35.245
If you go to, let's say, your hairdresser and she says listen, you know, I kind of want to run my business efficiently, so to do that I need to make sure I make appointments so that when you get here you don't have to wait, and so on.
00:04:35.245 --> 00:04:48.053
So here's what I want you to do Give me your name, your number and your email address so that I can contact you and let you know when's the best time to come, what she's collecting is data Right.
00:04:51.142 --> 00:04:57.093
So everybody comes into contact with data at some point in time or another.
00:04:57.093 --> 00:05:04.148
It goes from the most sophisticated individual technically to the simplest of individuals.
00:05:04.148 --> 00:05:24.134
So if you think about, let's say, your mechanic, when he's fixing your car, he has to know how to replace a particular part and that part is maybe in your car, maybe your tires, your wheels and so on.
00:05:24.134 --> 00:05:30.829
Well, they need to know what size tires to use, they need to know what size bolts and that kind of stuff.
00:05:30.829 --> 00:05:34.771
So all of that is stored in some book somewhere.
00:05:34.771 --> 00:05:54.879
Now, the mechanic may not have the book sitting beside him, but that information that gives him the knowledge to perform that particular task is stored in a book, whether it's digital or paper, and all of that is viewed as data.
00:05:55.420 --> 00:06:04.233
So what you're saying is that you know we have access to more data slash information now than we did, say, 40 years ago.
00:06:04.394 --> 00:06:08.440
Absolutely Okay.
00:06:08.440 --> 00:06:09.245
Because what?
00:06:09.245 --> 00:06:10.290
And the figures are staggering?
00:06:10.290 --> 00:06:28.545
Because the amount of data that we create in a single year in, let's say, 2024, is more than the amount of data that was created, like, in an entire decade back in the 30s.
00:06:28.545 --> 00:06:38.935
So in one year, we create more data than an entire decade back in what you look at as a non-digital age, right?
00:06:38.935 --> 00:06:47.791
And what that does now is it causes data to have a whole lot of value.
00:06:47.791 --> 00:06:49.795
Huh, right?
00:06:49.795 --> 00:06:52.689
And you might ask well, how does data have value?
00:06:53.379 --> 00:07:09.370
Well, a lot of us and let's talk in terms that many people understand a lot of us spend a lot of time online, whether it is we're shopping at Amazon or we're on social media.
00:07:09.370 --> 00:07:14.728
You know Instagram, facebook, tiktok, whichever one you're using.
00:07:14.728 --> 00:07:25.747
So, in functioning in those spaces, whether we know it or not, we're providing a lot of information.
00:07:25.747 --> 00:07:28.468
So, let's say you go on Amazon and you want to buy something.
00:07:28.468 --> 00:07:32.149
In order for you to get it, you have to search for it.
00:07:32.149 --> 00:07:37.331
When you find it, you make a decision as okay, I want to buy this.
00:07:37.331 --> 00:07:38.081
Now.
00:07:38.081 --> 00:07:41.531
When you buy it, you have to tell them where to send it.
00:07:41.699 --> 00:07:43.507
Yeah, you have to give them your personal information.
00:07:43.740 --> 00:07:45.447
Name, address and all of that.
00:07:45.447 --> 00:07:53.168
All that information is collected, and when it's collected, it is then used to provide a service.
00:07:53.168 --> 00:07:59.132
Right, so you go to Amazon, you see what you want, you say I want to buy this.
00:07:59.132 --> 00:08:03.831
You give them your information and they magically it shows up at your doorstep.
00:08:03.831 --> 00:08:17.692
Many things and many people touch that product between where you order it online and when it gets to your doorstep, and all those different entities have access to various bits of your information.
00:08:17.692 --> 00:08:35.613
Okay, right, when you go on social media, same thing To use Facebook you have to give Facebook some information so you can access it and Facebook uses that information to then create an experience for you.
00:08:35.613 --> 00:08:38.519
Same thing with any social media platform.
00:08:38.519 --> 00:08:42.270
But let's take it even in a more simplistic way.
00:08:42.270 --> 00:08:53.754
When you go to do business with, let's say, the government Right, you know you go to the registrar, you go to the tax office.
00:08:54.321 --> 00:08:59.346
You go to any one of those government entities In order to get service from them.
00:08:59.346 --> 00:09:00.448
What do you do?
00:09:00.448 --> 00:09:01.530
You give them information.
00:09:01.530 --> 00:09:04.886
You give them information and that information is stored somewhere.
00:09:04.886 --> 00:09:14.794
Right Now, the thing that is important to understand is that information has a tremendous amount of value.
00:09:15.419 --> 00:09:16.504
Why does it have value?
00:09:16.785 --> 00:09:17.027
Okay.
00:09:17.027 --> 00:09:21.826
So that information, when you give it to them, allows them to know you.
00:09:21.826 --> 00:09:23.048
Give it to them, allows them to know you.
00:09:23.048 --> 00:09:38.188
It allows them to say, well, this person came here, they asked for this information and, based on the information they gave us, we can then provide them with what they're asking for.
00:09:38.188 --> 00:09:49.320
That information also allows different types of service providers to become very efficient in the way they provide that information and that service.
00:09:49.320 --> 00:09:57.875
So, if it is that I asked you your name, your email address, your phone number, but then what kind of food do you like?
00:09:57.875 --> 00:10:12.715
Or what kind of beverage do you like, the next time you come to me and you say, hey, my name is Natasha Levy, then I can say, oh hi, great to have you.
00:10:12.715 --> 00:10:16.447
Do you want to have your favorite glass of red wine?
00:10:16.447 --> 00:10:22.230
And you're like, sure, and you don't even have to tell them what the wine is because you told them already.
00:10:22.230 --> 00:10:25.649
So they just bring it to you and you're like, wow, how did they know that?
00:10:25.649 --> 00:10:28.028
Yeah, well, you told them and they kept that information.
00:10:29.760 --> 00:10:44.206
When you go online and this is what some people tend to find scary sometimes is when you go online and you are shopping you may notice that, all of a sudden, things that are of interest to you start popping up.
00:10:44.206 --> 00:10:47.605
Yes, and that's what you're shown and you're like well, how did they do that?
00:10:47.605 --> 00:10:52.993
Well, you, unknowingly, are giving them information about what you like when you're searching.
00:10:52.993 --> 00:11:00.472
So what they do is they say, ah, natasha is logged in.
00:11:00.472 --> 00:11:06.120
The last time she was here, she was looking for these things, so let's show her stuff like this.
00:11:06.120 --> 00:11:12.494
And all of that is based on data that is collected, based on what you're doing.
00:11:13.220 --> 00:11:14.261
So bring it home for me.
00:11:14.261 --> 00:11:15.625
So you've set the scene.
00:11:15.625 --> 00:11:22.225
You've said listen, there's a lot more data now than there was decades ago.
00:11:22.225 --> 00:11:26.975
And you've said not only is there more data, but this data is important.
00:11:26.975 --> 00:11:30.370
How does that tie back to this Data Protection Act?
00:11:30.600 --> 00:11:40.730
Because not only can you do great things when you collect that data, but you can do not so great things with it as well.
00:11:40.890 --> 00:11:41.150
Right.
00:11:41.679 --> 00:11:49.511
So consider, I go to a service provider, let's say Amazon.
00:11:49.511 --> 00:11:59.644
I give Amazon my name, my address and, because I want to check out and buy things quickly, I give them my credit card.
00:11:59.644 --> 00:12:20.876
Well, if somebody who is what we would call a bad actor or a hacker stole that information from Amazon, then suddenly they have your information and your card number and my card number.
00:12:21.457 --> 00:12:22.278
You know what that does.
00:12:22.278 --> 00:12:37.815
That allows them to go to other places and literally become you, because when you sit in front of a computer, amazon doesn't know that, physically, natasha is sitting in front of that computer.
00:12:37.815 --> 00:12:40.428
What they depend on is the information that you provide.
00:12:40.428 --> 00:12:47.751
If that information is legitimate as far as they're concerned, then this must be Natasha.
00:12:48.354 --> 00:12:48.854
Fair enough.
00:12:48.940 --> 00:12:54.653
And as such we will validate and say yes, whatever Natasha wants, we will give it to her.
00:12:54.653 --> 00:13:02.214
But think about this If they can't see you, then anybody with your information can become you.
00:13:02.214 --> 00:13:16.231
So if I steal your information, then I can go somewhere else, use that information and become you, conduct business as if I am you and use your money as if I'm you right.
00:13:16.231 --> 00:13:25.169
So because of that, that information is now a target for people who want to do bad things.
00:13:25.169 --> 00:13:56.320
Here's another scenario If I'm a company that collects information about you I know your name, I know where you live, I know what you like Then suddenly, if I'm another business that wants to figure out how best to market products to you, then that information about what you like and where you are, is valuable because now I don't have to do a survey to find out.
00:13:56.961 --> 00:14:03.614
Now that information is readily available, I just need to find out where it is and purchase it.
00:14:03.614 --> 00:14:06.660
To find out where it is and purchase it right.
00:14:06.660 --> 00:14:09.783
And as the need for that goes up, so does the value.
00:14:09.783 --> 00:14:15.788
So what has happened now is data has become increasingly valuable.
00:14:15.788 --> 00:14:20.552
In fact, in certain quarters, data is viewed almost as a currency.
00:14:20.552 --> 00:14:27.236
It's almost viewed like oil, right, and what has happened is a very interesting thing.
00:14:35.162 --> 00:14:37.813
People, you and I have become a product, because our information is suddenly valuable.
00:14:37.813 --> 00:14:44.326
I don't think I fully appreciated all of this before, because I go about my life just on a normal basis.
00:14:44.326 --> 00:14:48.705
So, yes, so I go to my doctor's office, I give them information, I go to the hairdresser.
00:14:48.705 --> 00:14:50.149
Back to your analogy.
00:14:50.410 --> 00:14:50.993
Absolutely yeah.
00:14:51.581 --> 00:14:52.846
I shop online.
00:14:53.399 --> 00:14:58.932
But you never consider what can be done with the information you freely give away.
00:14:59.379 --> 00:15:00.787
Well, I think it's two parts.
00:15:00.787 --> 00:15:06.282
I think you know it makes my life convenient to just go about my life the way I do.
00:15:06.282 --> 00:15:14.645
But then also there's, I think, a little bit of a distance, because you do hear about hackers or people who are doing bad things, but it doesn't.
00:15:14.645 --> 00:15:16.046
It's certainly you.
00:15:16.265 --> 00:15:30.611
All this data is out there and we are on this push to go.
00:15:30.611 --> 00:15:35.995
Digital and digital information is extremely accessible.
00:15:35.995 --> 00:15:45.578
It's very portable of information on our person, something which 30, 40 years ago would be unheard of.
00:15:45.578 --> 00:16:22.226
So how do we ensure that, when we give our data to different companies or service providers, how do we now ensure that, in light of how valuable, how accessible and how portable this information is, how do we now make sure that who we give it to secures it, keeps it in a manner that we're comfortable with, but also keeps it in a way that makes it safe for us?
00:16:22.567 --> 00:16:24.090
I think I know the answer to this Trevor.
00:16:24.090 --> 00:16:27.333
This is where you're going to say, this is where the Data Protection Act comes in.
00:16:28.274 --> 00:16:46.173
Yes, because what the data protection law does for the first time in, I would say, our history is it puts control of your data and my data right.
00:16:46.173 --> 00:16:50.230
It puts the control of that data in our hands.
00:16:50.230 --> 00:17:00.259
We can now determine, through the law and what the law provides us, we can say, look, I don't want you to have my information.
00:17:00.259 --> 00:17:04.749
Or, if I give you that information, you need to tell me what you're doing with it.
00:17:04.749 --> 00:17:09.622
You need to tell me how you're storing it, how you're keeping it safe.
00:17:09.622 --> 00:17:22.567
In fact, if I don't feel that you need a certain piece of information that you're asking me for to provide a service to me, I'm not going to give it to you to provide a service to me.
00:17:22.567 --> 00:17:25.288
I'm not going to give it to you, right?
00:17:25.288 --> 00:17:33.571
So you may go to certain places, right, and they say, look, we need your name, okay fine, we need your phone number, okay fine, we need your data, bird.
00:17:33.571 --> 00:17:33.811
Why?
00:17:34.592 --> 00:17:35.872
Are you being hypothetical?
00:17:36.073 --> 00:17:40.094
No, no, no no, this is what is contemplated in the law.
00:17:40.094 --> 00:17:50.630
So right now and I'm going to show you some very practical situations, because I know a lot of people have certain things happen to them and they're like, boy, why do I keep doing this?
00:17:50.630 --> 00:17:52.442
What can I do to stop them?
00:17:52.442 --> 00:18:04.159
So you may go to a store, like a retail store, you're buying clothes, and they say give me a name, give me a phone number, and you're like, okay, cool, all right, give me a data bird.
00:18:04.159 --> 00:18:05.503
Why do you need that?
00:18:05.503 --> 00:18:08.955
Well, you know it's on the paper.
00:18:08.976 --> 00:18:20.363
Yeah, but my date of birth I have nothing to do with buying the clothes these pair of jeans are right, exactly right, and you can actually say yeah, no, I'm not giving you that information and they can't force you to do it.
00:18:21.243 --> 00:18:24.365
Right, because in your In law like no seriously.
00:18:24.365 --> 00:18:26.688
I could say no, thank you, I don't need to give you my birth date.
00:18:26.847 --> 00:18:34.073
Absolutely, because, in your estimation, because that information that you're giving to them is yours, right.
00:18:34.073 --> 00:18:43.109
So let me even make this even clearer have you ever been to a doctor's office and say, listen, I want all of my records.
00:18:43.351 --> 00:18:43.592
Yes.
00:18:43.815 --> 00:18:47.325
And some of them look at you and say yeah, yeah, we don't really give that out, you know.
00:18:47.586 --> 00:18:47.826
Yes.
00:18:49.556 --> 00:18:50.077
But why not?
00:18:50.077 --> 00:18:51.019
It's mine?
00:18:51.019 --> 00:18:56.944
Yeah, yeah, no, we have it, so it's our information, not anymore.
00:18:56.944 --> 00:19:09.761
Your medical records are yours, the law says so, and you can now go to a doctor's office and say, listen, I would like my data.
00:19:09.761 --> 00:19:17.221
In fact, I would like to see everything that you have on me, and I'd like you to provide it to me in an intelligible format.
00:19:17.934 --> 00:19:22.434
So stick up in Trevor, let's just take we're going to take two steps back and come back right here.
00:19:22.434 --> 00:19:23.856
Absolutely, we Can Solve.
00:19:23.856 --> 00:19:26.679
This is brought to you by Solution Space Consulting.
00:19:26.679 --> 00:19:31.163
Have a podcast idea, need editorial support for books or other publications?
00:19:31.163 --> 00:19:36.448
Solution Space will produce your podcasts and take care of your publications.
00:19:36.448 --> 00:19:41.211
Visit solutionspacecocom so that we can create wonderful work together.
00:19:45.435 --> 00:19:46.884
The Data Protection Act is in force in Jamaica right now.
00:19:46.884 --> 00:19:47.548
Yes, so the Data Protection Act.
00:19:47.548 --> 00:19:49.916
It was tabled in 2017.
00:19:49.916 --> 00:19:53.781
It was brought.
00:19:53.781 --> 00:19:57.728
Well, the big word for it is it was promulgated in 2020.
00:19:57.728 --> 00:20:09.371
There was a two-year grace period for it to go into effect and it came into effect December 1 of 2023.
00:20:10.335 --> 00:20:14.871
So right now, if I walked into my doctor's office, I could do what you just suggested.
00:20:14.871 --> 00:20:15.093
Yeah, yeah.
00:20:15.555 --> 00:20:36.848
They are required by law to provide you, because now the power is in our hands, because the information they have is mine, it's yours, so you are entitled to get it, and that's the kind of thing that the Data Protection Act provides, right?
00:20:37.556 --> 00:20:58.685
So if it is that and here's another scenario that a lot of people are very familiar with Sometimes you're sitting at home and you get a message on your phone, maybe from a course or a digital or a singer or Max's Furniture or whatever, and you're like how did these people get my information?
00:20:58.685 --> 00:21:06.163
I've never shopped there, I've never done business there, but, be that as it may, I don't want them to send me text messages.
00:21:06.163 --> 00:21:08.046
I don't want them to send me text messages.
00:21:08.046 --> 00:21:09.474
I don't want them to call me, right.
00:21:09.474 --> 00:21:14.247
I don't want them to send me mail in my mailbox, right?
00:21:14.247 --> 00:21:29.730
What the Data Protection Act does now for you is gives you the power to tell them listen, you sent me a text message, or you called my phone, or you sent me some mail.
00:21:29.730 --> 00:21:31.681
I don't want you to do that anymore.
00:21:31.681 --> 00:21:34.904
Please remove me from your marketing database.
00:21:35.894 --> 00:21:40.055
Trevor, it feels that there are two sets of people in this conversation.
00:21:40.055 --> 00:21:49.630
So when we talk about the Data Protection Act, you're telling me about the things that I can do as the consumer, as the person out there.
00:21:49.755 --> 00:21:53.946
The fancy name for us in the law is data subject.
00:21:55.038 --> 00:21:56.682
So I'm a data subject.
00:21:57.044 --> 00:21:57.546
All of us are.
00:21:57.775 --> 00:21:59.362
We're all data subjects, all right.
00:21:59.362 --> 00:22:00.840
So that's one piece of person.
00:22:01.777 --> 00:22:03.082
Or entity or being.
00:22:03.957 --> 00:22:13.307
In this equation entity or being, or in this equation and you know we kind of almost can look at well, what are my rights right and and what are the other right?
00:22:13.327 --> 00:22:27.304
people's rights, the other part of that equation is what you call the data controller, and that's who we give the information to I see so in this thing I'm a data subjects right, you have the data subject and you have the data controllers.
00:22:27.423 --> 00:22:28.205
Right, all right.
00:22:28.226 --> 00:22:29.208
These are the fancy terms.
00:22:29.367 --> 00:22:30.189
Fancy terms.
00:22:30.535 --> 00:22:34.405
So data subjects are you and me, citizens, people, right?
00:22:34.405 --> 00:22:40.086
Right, whose data is given to a data controller?
00:22:40.086 --> 00:23:01.777
And a data controller is a business, it is a government entity, a public authority, it is a company, right, it could be your mechanic or hairdresser, all the way up to a multinational, multimillion-dollar traded company.
00:23:02.057 --> 00:23:03.560
All right, so stick a pin.
00:23:03.560 --> 00:23:16.488
Lots of pins to be stuck all over the place, sure, but I really want to make sure that we're breaking this down and that everybody has an opportunity to really look and understand what's going on here.
00:23:16.488 --> 00:23:27.128
I'm not clear that we really understand who the Data Protection Act applies to.
00:23:28.135 --> 00:23:30.042
So I think that would be a first step.
00:23:30.042 --> 00:23:42.767
You've done a great job in explaining the importance of data and why we now need to protect it in this day and age, but it's something that's a legislation right?
00:23:42.767 --> 00:23:46.214
It's clearly for these big companies, right, Trevor?
00:23:46.214 --> 00:23:51.858
I mean, when you talk about, you know, is these these data controllers?
00:23:51.858 --> 00:23:58.483
I mean you must be talking about the banks and the fact and the and the insurance companies are.
00:23:58.483 --> 00:24:04.628
Are people, like you know, are creatives, data controllers, are bloggers' data controllers.
00:24:04.628 --> 00:24:17.044
Suppose I have a little skincare product and I sell my shea butter on IG and people place their orders and then I have a bearer that delivers it.
00:24:17.044 --> 00:24:19.101
I can't be a data controller.
00:24:19.482 --> 00:24:20.186
Absolutely, you are.
00:24:20.207 --> 00:24:22.336
How am I a data controller?
00:24:22.356 --> 00:24:25.766
Because you collect the data of data subjects.
00:24:25.766 --> 00:24:34.567
Now, here's the thing the way you've outlined all these different types of people is based on size.
00:24:35.055 --> 00:24:36.180
It's based on size.
00:24:36.240 --> 00:24:40.747
Yes, you say well, I can't be a big organization, I'm a little one.
00:24:40.747 --> 00:24:46.085
This law must only apply to the big guys, right?
00:24:46.085 --> 00:24:48.181
Well, here's the thing with that.
00:24:48.181 --> 00:24:59.769
The amount of data or information that you have has nothing to do with the size of your business, and here's why.
00:24:59.769 --> 00:25:10.634
You could be a hairdresser with 100 clients Well, that's a hundred people that you have information on.
00:25:10.634 --> 00:25:20.670
You could be a small, you know, five-person operation with thousands of clients.
00:25:20.670 --> 00:25:23.338
How do you get those thousands of clients?
00:25:23.338 --> 00:25:32.538
Because one of your clients is a bank and the bank shares that their information with you.
00:25:32.538 --> 00:25:42.915
Now, the bank has thousands of clients and because you are providing a service to the bank, they might share that information.
00:25:42.915 --> 00:25:51.178
So now, little little, you with your five employees, has information about 100,000 people.
00:25:52.619 --> 00:26:00.715
The size of your business is not an indication of how much data you have on data subjects.
00:26:00.715 --> 00:26:22.088
So what the law is trying to do is to ensure that whoever has your information, regardless of their size, treats with it in an appropriate manner.
00:26:22.088 --> 00:26:36.441
Are I haven't invested in all the different things that I need to protect the information that I have about you, right?
00:26:36.441 --> 00:26:39.164
What do I mean by that?
00:26:39.164 --> 00:26:48.626
Well, a bank invests millions of dollars in, you know security and security software and all that kind of stuff.
00:26:48.626 --> 00:26:51.342
Right, they have the budget for that.
00:26:51.342 --> 00:27:08.690
Smaller companies may not have that kind of budget or they don't make it a priority, but at the same time, they have access to the very valuable and sensitive information about you that a bank does.
00:27:09.256 --> 00:27:28.415
So Trevor is a reasonable expectation that if I have a clothing store and I've collected my customers' name, email addresses and telephone numbers because I want to send them information about my promotions, the expectation is that I must have the same sort of security protocols in place like a bank.
00:27:29.739 --> 00:27:31.582
So that's an excellent question, right?
00:27:31.582 --> 00:27:37.056
Because right off the bat that just cannot seem equitable or fair right.
00:27:37.615 --> 00:28:05.030
So, over time, the expectation is that companies, regardless of their size, will eventually get to the point where they have all the measures in place to protect that information associated with are being put out.
00:28:05.030 --> 00:28:06.131
Is that?
00:28:06.131 --> 00:28:37.964
Look, we understand and this is from the government we understand that, look, you know, the hairdresser or the mechanic or the micro business individual cannot be expected to make the kind of investment and do the kind of things at the drop of a dime that a bank can do, that an insurance company can do, that a large entity that has a whole lot of information can do.
00:28:37.964 --> 00:28:47.567
So what has happened is the government has chosen to phase in different aspects of this law.
00:28:48.609 --> 00:28:48.990
Okay.
00:28:49.029 --> 00:28:49.211
Right.
00:28:49.211 --> 00:28:55.169
So you would have heard me say that the law came into effect on December 1.
00:28:55.169 --> 00:28:56.111
2023.
00:28:56.111 --> 00:28:56.952
2023.
00:28:56.952 --> 00:29:04.208
Right, there was a grace period that was implemented on December 1.
00:29:04.208 --> 00:29:05.089
Implemented on December 1.
00:29:05.089 --> 00:29:17.666
It says we're going to give everybody six months to prepare, even after the two-year period to prepare to become a registered data controller.
00:29:17.666 --> 00:29:18.509
Right.
00:29:18.977 --> 00:29:20.815
You know I'm going to ask you about that, but go on.
00:29:21.196 --> 00:29:28.223
So we're going to give you six months and that six-month time period I've taken it to June 1 of this month this year.
00:29:28.223 --> 00:29:34.499
So you get a six-month period.
00:29:34.499 --> 00:29:38.944
Because they're saying, look, when this thing came into effect, people didn't understand.
00:29:38.944 --> 00:29:50.355
Businesses didn't understand exactly how this worked, worked.
00:29:50.355 --> 00:29:55.269
So we need to give them some time to some more public education and awareness so that they can understand what's happening here and make the necessary preparations.
00:29:55.269 --> 00:29:58.478
Now, come June 1, you're going to need to register.
00:29:58.478 --> 00:30:08.708
But even at June 1, a lot of businesses still didn't quite understand and between during that grace period, that became very obvious.
00:30:08.708 --> 00:30:10.400
So what did the government do?
00:30:10.400 --> 00:30:22.410
They said, listen, we're only going to initially target certain types of entities and organizations.
00:30:22.609 --> 00:30:23.111
Okay.
00:30:23.351 --> 00:30:23.550
Right.
00:30:23.550 --> 00:30:26.136
What are these kinds of organizations?
00:30:26.136 --> 00:30:28.861
Well, all public bodies.
00:30:28.861 --> 00:30:36.871
So all the government has to register as a data controller.
00:30:36.871 --> 00:31:14.232
So who are they registering with states that there has to be this body that's responsible for managing this whole regime, and that body is called the, and again, the fancy word for that is that's the regulator for the data protection law Understood.
00:31:26.894 --> 00:31:30.167
So the office of the information commissioner, staffed with an information commissioner, a very powerful post is who data controllers must register with.
00:31:30.167 --> 00:31:31.815
And, again, the data controllers are the entities that have information on us.
00:31:32.095 --> 00:31:33.400
The data subjects absolutely.
00:31:33.601 --> 00:31:40.528
I understand, and so you're saying that between June 1 and June 31st?
00:31:41.586 --> 00:31:42.253
August 31st.
00:31:42.335 --> 00:31:42.634
Sorry.
00:31:42.634 --> 00:31:46.557
June 1 and August 31st there are a group of.
00:31:47.598 --> 00:31:48.140
Industries.
00:31:48.460 --> 00:31:54.704
Industries, entities that must register with the Office of the Information Commissioner.
00:31:54.724 --> 00:31:55.265
That's correct.
00:31:55.285 --> 00:32:03.632
Okay, that's correct and thereafter, I guess, information will be shared in terms of who next must register under various categories.
00:32:03.632 --> 00:32:11.557
That's correct register under various categories.
00:32:11.557 --> 00:32:21.057
So is there talk to me now about what happens if I don't register, or what happens if I register and something happens and I'm not treating the information on my data subjects securely?
00:32:21.758 --> 00:32:22.459
Excellent question.
00:32:22.459 --> 00:32:42.207
So because the law says that if you are a data controller you must register, the law prescribes some penalties, and these penalties are harsh, very harsh, harsh.
00:32:42.207 --> 00:33:10.397
Harsh, but it is structured in such a way that a certain level of discretion can be used with the application of this law.
00:33:10.397 --> 00:33:22.151
The largest penalty that exists in this thing is you could be fined 4% of your yearly revenue.
00:33:22.151 --> 00:33:26.161
4%.
00:33:26.161 --> 00:33:27.484
Now people say 4% telecom?
00:33:27.484 --> 00:33:28.105
No, no, no.
00:33:28.105 --> 00:33:32.382
4% to some businesses can literally shut them down.
00:33:34.696 --> 00:33:48.166
It can literally shut them down and this applies and just to be very clear, Trevor, this 4% applies to these telcos, but it would also apply to my dentist, as well Any data controller.
00:33:48.166 --> 00:33:51.740
My little micro enterprise.
00:33:52.020 --> 00:33:55.901
Shea Butter store yeah, absolutely 4% across the board.
00:33:55.901 --> 00:34:00.085
Of your yearly revenue.
00:34:00.085 --> 00:34:01.028
Yearly revenue.
00:34:01.028 --> 00:34:06.186
If you're an international company, it's 4% of your global revenue.
00:34:06.186 --> 00:34:10.865
Okay, so it's important to understand that.
00:34:10.865 --> 00:34:19.547
But also, directors of entities can also be fined.
00:34:20.509 --> 00:34:21.150
Directors.
00:34:21.250 --> 00:34:21.731
Yes, yes.
00:34:21.731 --> 00:34:34.440
So if you are the member of, say, on a board for a particular organization, that is company is found in breach of the law.
00:35:02.574 --> 00:35:03.376
I realize that.
00:35:03.516 --> 00:35:04.317
Right.
00:35:04.317 --> 00:35:19.992
So this legislation does posit that if you're a director on a company that's found to be in breach, you too can be fined, and you too can go to jail.
00:35:21.094 --> 00:35:23.509
Trevor, it seems like it's a lot of information to digest.
00:35:23.775 --> 00:35:24.036
It is.
00:35:24.036 --> 00:35:26.302
It is Quite a bit.
00:35:26.543 --> 00:35:34.617
How would I go about, or can you suggest some ways in which we can go about finding?
00:35:34.617 --> 00:35:35.682
Out more information.
00:35:35.682 --> 00:35:43.481
I mean this conversation that we're having I'm sure is going to help, but it's a whole act to try and understand.
00:35:43.481 --> 00:35:45.782
I'm sure it's not two pages of information.
00:35:46.014 --> 00:35:50.155
Yeah, man, we would want to know where the cliff notes are.
00:35:50.496 --> 00:36:11.884
Yes, so the Office of the Information Commissioner has a website and the website has information in some easily digestible forms for you to go and find out what you know, what you need to know, what you need to do and how you need to do it.
00:36:11.884 --> 00:36:21.985
Now the website for the Office of the Information Commissioner is oicgovjm, and you go there.
00:36:21.985 --> 00:36:28.684
Any information that you want, any information that you want, you can find it there.
00:36:28.684 --> 00:36:58.688
If you're a business and you kind of would like somebody to come much like how I'm speaking to you here to do a presentation about this thing called the Data Protection Act, you can go on that website and request that they come and do a presentation to you and they'll come and they'll tell you everything you need to know about what you should do, what you shouldn't do, about the data protection legislation.
00:36:58.688 --> 00:37:10.336
So it's very important from the standpoint of a data controller that you understand what is required of you when you're collecting my data.
00:37:11.018 --> 00:37:19.920
And again, the litmus test is once I collect information about people and I'm oversimplifying it.
00:37:20.081 --> 00:37:21.686
No, no, you're perfectly accurate.
00:37:22.048 --> 00:37:24.536
Once I collect information about people.
00:37:24.635 --> 00:37:25.536
You're a data controller.
00:37:25.697 --> 00:37:36.606
I am a data controller, correct, and it's a big title data controller, and what you're saying is that it's not only the banks and the big companies are data controllers.
00:37:36.606 --> 00:37:41.271
Once I collect information about people, I too am a data controller.
00:37:41.411 --> 00:37:47.818
Correct, correct and the legislation right and the way I like to.
00:37:47.818 --> 00:38:20.822
I like how they frame the legislation, because there's a part of the legislation that says listen, we know that nobody likes to read the legalese, so what they did was they have a part in legislation that speaks about what they call data processing standards, and there are eight of them and, as a data controller, if you study those eight standards, you're good to go, if you understand those eight standards.
00:38:20.822 --> 00:38:23.668
And these are one sentence standards.
00:38:24.135 --> 00:38:27.483
And Trevor, I'm going to ask this seemingly simple question.
00:38:27.483 --> 00:38:34.286
Those eight standards apply to me as a hairdresser as well as it applies to my bank as a.
00:38:34.447 --> 00:38:35.288
Absolutely.
00:38:35.288 --> 00:38:39.445
So, all data controllers.
00:38:39.445 --> 00:38:40.929
So here's what I'm going to do for you.
00:38:40.929 --> 00:38:45.518
I am going to read the standards for you, if that's okay.
00:38:45.518 --> 00:38:45.920
No.
00:38:47.001 --> 00:38:49.626
The standards are available on the website.
00:38:49.626 --> 00:38:50.688
Yes, absolutely.
00:38:50.708 --> 00:38:51.809
They're available on the website.
00:38:51.809 --> 00:39:01.074
Generally, what the standards are saying is that, look, when you collect information, you must only collect it for the service you're providing.
00:39:01.074 --> 00:39:11.025
You should only collect the amount of information that you need to provide that Whenever you don't need that information anymore, you must dispose of it.
00:39:11.025 --> 00:39:24.065
That's the kind of stuff that the standards say, and what happens is is, once you understand those standards and you practically live by them, you will be in compliance with the law all the time.
00:39:25.047 --> 00:39:26.128
Got you, got you.
00:39:26.128 --> 00:39:29.199
Poor Trevor, it really is a lot to digest.
00:39:29.219 --> 00:39:29.661
Yes, it is.
00:39:30.757 --> 00:39:38.516
But what I heard you say is a good place to start is the Office of the Information Commission's website.
00:39:38.516 --> 00:39:47.702
And also to recognize the two parties in this equation, so data subjects and data controllers.
00:39:47.742 --> 00:39:47.882
Right.
00:39:48.936 --> 00:39:57.523
And to come to terms with the fact that once I collect information on behalf of my from my customers, I'm a data controller.
00:39:57.523 --> 00:40:01.746
No matter how big or small my business is Right.
00:40:02.215 --> 00:40:05.204
And something that and there's a lot of fear about.
00:40:05.204 --> 00:40:19.826
Well, what does that mean?
00:40:19.826 --> 00:40:32.565
If I'm a small entity collecting information, going to kick down your door and say, oh, you are in breach because you collected somebody's information and you kept it for too long, and so on?
00:40:32.565 --> 00:40:33.567
No, they're not going to do that.
00:40:33.567 --> 00:40:59.822
What they're committed to doing is to one acting in such a way that entities that collect information treat with it in accordance with the law, make sure that data they collect on you and me, they secure it, they keep it safe, they don't give it to people without my consent, because it's my data.
00:40:59.822 --> 00:41:03.505
If I ask for it, they should give it to me.
00:41:03.876 --> 00:41:19.536
But more importantly and this is something that, again, it's very new Whenever any one of those data controllers suffers a data breach, they have to tell you Right.
00:41:19.536 --> 00:41:40.668
So what the law says is, within 72 hours of discovering that there has been a data breach, one, they must inform the Office of the Information Commissioner, but they must also tell the data subject whose information may have been stolen or compromised, what happened.
00:41:40.668 --> 00:41:53.867
Now, this is something that has never happened before, because I can tell you there have been situations where entities that have personal information or sensitive information about you and me.
00:41:53.867 --> 00:41:56.989
They have suffered breaches, but you've never heard of it.
00:41:57.210 --> 00:41:57.851
Never heard of it.
00:41:57.851 --> 00:41:59.240
No one says anything to you.
00:41:59.375 --> 00:42:06.788
Now the law requires that they tell you when information has been breached.
00:42:06.788 --> 00:42:07.849
Now, what does that do?
00:42:07.849 --> 00:42:32.806
That forces them to put things in place to make sure that they protect your information, and your information is extremely valuable because there are some people out there who want access to that information so that they can take away your money right, so that they can go buy fancy car under your name and you don't know nothing about it.
00:42:32.806 --> 00:42:38.927
Those kinds of things are what the law is protecting against.
00:42:38.927 --> 00:42:50.077
So, as we move more and more into the digital age, there needs to be protections and guardrails for us, because we want the services.
00:42:51.059 --> 00:42:52.141
We want them efficiently.
00:42:52.141 --> 00:42:53.985
We don't want to stand up in a line anymore.
00:42:53.985 --> 00:43:00.585
But to do that, we have to provide that information to somebody who is delivering that service.
00:43:00.585 --> 00:43:06.742
But in doing so, we want to make sure that who we're giving that information to, which is extremely valuable.
00:43:07.425 --> 00:43:12.853
We want to make sure that who we're giving that information to, which is extremely valuable, is keeping it safe.
00:43:12.853 --> 00:43:24.925
And, trevor, as we wrap up, I just want to make an observation here that the Data Protection Act that we're speaking of, as it relates to Jamaica, does not exist on its own, so it's not that Jamaica decided that we are.
00:43:24.925 --> 00:43:25.085
We must.
00:43:25.085 --> 00:43:26.648
You know we're the only ones who are going to be doing this.
00:43:26.648 --> 00:43:32.193
There has been a global recognition that data is important and it needs to be protected.
00:43:32.414 --> 00:43:32.735
That's correct.
00:43:33.096 --> 00:43:38.231
And there are a few other countries out there that actually have their version of data protection.
00:43:38.331 --> 00:43:39.494
More than a few, more than a few.
00:43:39.494 --> 00:43:45.148
About 75% of the countries in the world have similar types of legislation.
00:43:45.414 --> 00:43:53.306
So this act really allows Jamaica to have global standards in terms of treating with data treating with information.
00:43:53.306 --> 00:43:53.806
That's correct.
00:43:54.735 --> 00:44:07.442
In fact it also extends beyond our borders, so places outside of Jamaica that have our information are now required to treat with it properly.
00:44:09.487 --> 00:44:18.778
So, trevor, as we wrap up, I think you did a fantastic job of just breaking it down into these bite-sized digestible nuggets.
00:44:18.778 --> 00:44:19.641
I hope so.
00:44:20.336 --> 00:44:33.887
Because it's a complex topic and not a lot of people quite get it the first time around, but I hope it kind of shed some light on it in this discussion.
00:44:35.317 --> 00:44:38.438
What I'm hearing is that a first stop is to find out more information.
00:44:38.820 --> 00:44:38.981
Yes.
00:44:39.463 --> 00:44:43.585
And also I kind of heard that it's not as scary as people think it is.
00:44:43.605 --> 00:44:44.088
No it's not.
00:44:44.088 --> 00:44:44.670
It's not.
00:44:44.670 --> 00:44:46.737
It's really to protect us.
00:44:47.036 --> 00:44:47.797
It's really to protect us.
00:44:47.818 --> 00:44:48.699
It's really to protect us.
00:44:48.699 --> 00:44:55.387
It's really for us and for the data controllers who think that you know, hey, this is going to ruin my business.
00:44:55.387 --> 00:45:08.079
No, it's not, that you do have enough leeway and there is enough discretion to allow you to get to the point where you can keep people's data safe without breaking the bank.
00:45:08.079 --> 00:45:10.422
Right, you have sufficient time to get there.
00:45:11.576 --> 00:45:14.925
And on that note, Trevor, I want to say thank you so much.
00:45:14.925 --> 00:45:21.445
Our guest this afternoon was Trevor Forrest, the CEO of 876 Solutions.
00:45:21.445 --> 00:45:24.074
Thank you so much for joining us today, Trevor.
00:45:24.295 --> 00:45:25.096
I enjoyed being here.
00:45:52.650 --> 00:45:57.193
Thanks for listening to this podcast of we Can Solve this a Solution Space podcast.
00:45:57.193 --> 00:46:00.144
Follow us on socials at we Can Solve this podcast.
00:46:00.144 --> 00:46:02.001
Like, follow, subscribe.
00:46:02.001 --> 00:46:08.427
We Can Solve this sharing ideas to help build thriving communities wherever you are.