Jamaicans for Justice (JFJ) says it remains deeply concerned about the National Identification and Registration Act, 2021 which was recently passed in the Upper House.

According to the human rights group, sections of the bill continue to infringe on the rights of the citizenry.

While noting the inclusion of several recommendations made by various organisations, including from itself, to address issues with previous versions of the bill, JFJ said that there remained six key areas of concern, they are:

Lack of adherence to the data minimization principle – Despite amendments made to limit the quantity of information collected for enrolment, JFJ’s position is that the quantity of data required is still not in accordance with the Data Minimization Principle. The Data Minimization Principle emphasizes limiting data collection to only what is required to fulfil a specific purpose. The information required for enrolment, namely the ID holder’s marital status and the name of their spouse, required under Section 11(1)(a) is not justifiable. JFJ believes such Personally Identifiable Information (PII), which if lost, compromised, or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

Broad definition of accredited third parties require strong regulations – JFJ notes that the Senate has submitted a definition for ‘third parties’ under section 25 as, “an entity accredited under this section with whom the Authority has entered into agreement for the provision of authentication and verification services”. The organisation strongly believes the definition within the pending law is still too broadly defined and submits that without strong regulations future problems of privacy breaches could occur. The accompanied regulations must therefore establish clearly defined parameters under which such accredited third parties must operate.

Lack of independence of the NIDS authority – The independence of the NIDS authority must be safeguarded. Currently, the authority reports to an appointed minister, who is empowered to amend the schedules to the Bill as he/she sees fit. JFJ is worried that the current framework of the authority is too heavily vested in executive control rather than parliamentary oversight, noting that this has huge implications for accountability.

Provisions guiding the disclosure of data remain unclear – JFJ says it is deeply perturbed about a recent amendment which now allows a “constable, not below the rank of superintendent” to access NIDS information. This is a change from the previous position which allowed for a police authority “not lower than Senior Superintendent” to access the information. This means a greater number of individuals will have access to an individual’s personal data. In addition, the amendment also allows the Commissioner of Police to make an ex parte application to obtain identity information of individuals who are enrolled in the system, if that information is deemed necessary for the prevention, detection or investigation of crime or in the interest of national security. JFJ’s position is that sensitive information must only be accessed on an absolute “need to know” basis, which limits unnecessary exposure, as well as, limits access to the smallest number of people possible.

Lack of defined data retention period – JFJsay it is deeply troubled that the bill empowers the authority to maintain records each time a person’s national ID card is authenticated as part of a transaction, even if the transaction was conducted with a private entity. The organisation maintains that clear regulations must be established to guide the framework around data retention both in NIDS and the Data Protection Act (DPA) to ensure that personal data is not keptfor longer than is necessary and is disposed of in accordance with regulations.

The human rights lobby group says, every effort should be made to address the highlighted areas of concerns raised prior to the bill being gazetted.