The OIC responds to concerns about registration and renewal of registration by data controllers under the Data Protection Act, 2020

FOR IMMEDIATE RELEASE

 

 

The OIC responds to concerns about registration and renewal of registration 

by data controllers under the Data Protection Act, 2020

 

The Office of the Information Commissioner (OIC), as the regulatory authority under the Data Protection Act, 2020 (“DPA” or "the Act"), has noted the concerns and anxiety of various stakeholders regarding the annual registration of data controllers. 

 

We apologise for the delay in processing registration applications and responding to applications submitted. This delay is due to administrative and technical issues. We understand that this may have caused inconvenience or other challenges for data controllers and wish to assure them that we are actively working to resolve the issues. 

 

The Act imposes on all persons, including public authorities, who process personal data to register with the Information Commissioner (“Commissioner”) annually by submitting their registration particulars and paying a prescribed fee. The specific requirements for registration are detailed in the Data Protection (Data Controller Registration) Regulations, 2024. Further, the Act requires that the Commissioner makes available to the public a Register reflecting the registration particulars of all data controllers. The Data Controller Register has been publicly accessible via the OIC’s website (www.oic.gov.jm/register-of-data-controllers) since October 9, 2024.

 

As the requirement for registration as a data controller was brought into operation on December 1, 2023, each registration year starts on December 1 and ends on November 30 of the following year. However, the OIC only commenced registration of data controllers for December 1, 2023 to November 30, 2024 (the first registration year) on June 1, 2024. This is consequent on a declaration by the Minister with responsibility for data protection of a six-month extension of the two-year transitional period provided at section 76 of the Act.

 

Data controllers who processed personal data between December 1, 2023 and May 31, 2024 will not be held liable despite not being registered with the Commissioner, provided they did so in good faith.

 

The OIC acknowledges and advises that, due to administrative and technical challenges, the Data Controller Register does not reflect the entry of every data controller whose application has been processed and approved by the Information Commissioner since June 1, 2024 when the online registration portal opened. The OIC further advised that:

 

  • Applications for the 2023/2024 registration year are still being processed; hence, some applicants have not yet received communication about the outcome of their applications.

     

  • Cases of applicants paying the incorrect registration fee for RY 2023/2024 are being addressed on a case-by-case basis. As the Act prescribes different registration fees for different categories of data controllers, applicants are advised to check and confirm the fees applicable to the data controller prior to making payment. The OIC does not issue refunds to data controllers who remain in operation and are under a duty to register.

     

  • Data controllers will be issued official receipts for fees paid for each registration year. Receipts will reflect the amount paid, as well as any amount applied as credit from a previous year or being held on credit for a subsequent year. 

     

  • Where the payment is less than the applicable prescribed fee, the applicants are notified, in writing, by the OIC, and their applications will not be approved until the difference is paid. 

 

  • Where payment is in excess of the prescribed fee, the amount of the excess will be held on credit and applied to the fees payable at the next registrationapplication (or renewal) for the respective data controller. In such cases, the person making the application may reference the previous excess payment and pay only the additional amount required, if applicable, in submitting the renewal application. 

 

  • Registration for RY 2024/2025 opened on December 1, 2024 and these applications are being processed simultaneously with those received for RY 2023/2024 but not yet processed. 

     

  • The OIC has not yet began issuing e-certificates to registered data controllers. Once issuing commences, data controllers can expect to receive an e-certificate for each year for which they are registered. [I.e., data controllers who applied to be registered in RY 2023/2024 and also to renew their registration in RY 2024/2025 will receive two (2) e-certificates.]

     

  • There has been a significant delay in the posting of new entries in the Register. The OIC, therefore, provides official confirmation of the registration status of any data controller whose application was received and processed, but whose particulars are not yet reflected in the online Register, upon request.

 

We will modify our online platform as necessary to improve efficiency. To this end, e-commerce functionality will be integrated in the coming months to facilitate online payments. Notice of this, and any other change to the registration process, will be published in local newspapers and on our website and social media channels.

 

As Jamaica continues to develop the regulatory framework for data protection, our office also continues to build our operational and other systems. It can be expected that unforeseen challenges will impact our responsiveness to our valued stakeholders. We appreciate your continued patience and understanding as we strive to serve you more efficiently and effectively, and we thank you for your cooperation to safeguard the privacy rights of data subjects and others. 

 

For general information about data protection matters, including DPA compliance requirements, please email Click here to show mail address. For questions or guidance on registration, contact the Complaints Resolution and Compliance Division at Click here to show mail address. Applicants can access technical support relating to the online registration process by emailing Click here to show mail address. 

 

The Information Commissioner

The OIC: Your data. Your rights. Protected!

 

***********************************

For media inquiries, please contact our Communication and International Relations Team at 876-381-2384 or 876-381-3515.

 

 

For other inquiries or general information, please contact us or check us out at: