AS concerns about data privacy intensify, the conversation is shifting from solely holding data controllers accountable to ensuring data subjects — individuals whose personal data is collected and processed — fully understand their rights.

“We need to get to the stage where we can quote sections of the Constitution to show we know our rights,” said Mickel Jackson, executive director of Jamaicans for Justice, during her keynote address at the Office of the Information Commissioner’s Annual Data Privacy Conference on Wednesday.

“It says we have the right to protection of our private and family life, the privacy of our home, and privacy of property and communication,” she added, in referencing Chapter III, Section 13(3)(j) of the Jamaican Constitution.

Jackson is urging Jamaicans to become more aware of the constitutional protections afforded to them, particularly their right to privacy. In today’s interconnected world, data has become a powerful currency. Every time Jamaicans make an online purchase, check into a hotel, or share aspects of their lives on social media, they leave behind a digital footprint, which is valuable data that companies can use for targeted marketing.

“Your data is power; as such, we can look at it as property, and because it is property, it is currency, therefore, we must protect it like money in the bank,” Jackson stressed.

From social media platforms tracking user preferences to telecommunications companies tailoring advertisements, data is at the centre of how businesses interact with consumers. This reality makes it more important than ever for data subjects to understand how their information is collected, used, and shared. Under Jamaica’s Data Protection Act, data subjects have critical rights, including the right to access: individuals can request access to their data from data controllers. The right to rectification: Data subjects can demand corrections if their data is incomplete or inaccurate. The right to erasure (“right to be forgotten”): Under specific circumstances, individuals can request that their personal data be deleted. And the right to object: Data subjects can object to how their data is being used, especially if it’s used in ways they did not authorise.

“Data subjects tend to think of privacy in a conventional sense, like someone poking into their business,” Jackson noted.

She also dispelled a common misconception that an online presence equates to giving up privacy rights, as in the digital era, privacy invasions take different forms, such as AI-generated videos of an individual saying things they didn’t, or an individual’s image being used without consent, which are all violations of one’s rights.

Making tweets is your property — no one has the right to use them without your express permission,” she said. “Not because we are online, it gives others the opportunity to use our information in a way that we did not intend for it to be used.”

While data subjects must know their rights, Jackson emphasises that data controllers — the entities responsible for determining how and why data is processed — have a duty to educate their customers and employees. She called on data controllers to be “champions of human rights”, and if there’s a breach, they must inform data subjects within 72 hours, as required by law. Recent public incidents have shown mixed responses, with some organisations acting swiftly while others delayed beyond the legal time frame. The Data Protection Act outlines severe penalties for breaches. Section 18 states that data controllers who process personal data without registering with the information commissioner commit an offence and, upon summary conviction, may face a fine of up to $2 million or imprisonment for up to six months. Meanwhile, Section 62 empowers the information commissioner to impose fixed penalties on data controllers for offences likely to cause substantial damage or distress, especially when such offences are deliberate or result from negligence.

“To know our rights is also to understand that when someone breaches them, we’re taking you to court,” Jackson declared.