Tiou Clarke | Artificial intelligence and the Jamaica Data Protection Act: navigating statutory alignment

Across Jamaica, artificial intelligence (AI) is actively integrated into enterprise operations. Commercial banks utilise machine learning models for automated anti-money laundering (AML) monitoring and fraud detection; business process outsourcing (BPO) facilities deploy natural language processing systems for sentiment scoring and call documentation; and micro, small, and medium-sized enterprises (MSMEs) apply generative tools to support customer interactions and operational tasks.

This adoption pathway intersects with the regulatory framework established by the Jamaica Data Protection Act (JDPA). As organisations process customer information, communications records, and operational data through external or cloud-hosted algorithmic architectures, technical configurations must be evaluated against the statutory obligations overseen by the Office of the Information Commissioner (OIC).

Modelled after the European Union’s General Data Protection Regulation (GDPR), the JDPA establishes legal guidelines for the management of personal data. The statute delineates explicit rights for data subjects while assigning compliance responsibilities to data controllers handling personally identifiable information (PII).

Institutional compliance requires adherence to eight statutory standards:

• Fairness and lawfulness: Personal information must be gathered and processed through legitimate, transparent channels.

• Purpose limitation: Data collection is restricted to explicit, specified purposes and cannot be repurposed without valid grounds.

• Data minimisation: Processing must remain proportional and strictly limited to what is required for the intended function.

• Accuracy: Controllers are required to maintain correct and updated records.

• Storage limitation: Personal data must not be kept longer than necessary to fulfil the documented objective.

• Rights of data subjects: Operational workflows must accommodate individual entitlements under the statute.

• Security safeguards: Entities must maintain technical and administrative controls against unauthorised data compromise or loss.

• International transfer: Cross-border data transmission requires verification that the recipient jurisdiction provides equivalent safeguards.

Operational intersections with the JDPA

The operational characteristics of modern AI architectures create distinct compliance challenges under the JDPA framework. Complex machine learning algorithms and large language models (LLMs) rely on extensive datasets for predictive modelling, which introduces procedural tensions with existing data governance mandates.

When organisations utilise public or commercial AI platforms to process enterprise workflows, specific regulatory intersections arise:

• Data minimisation considerations: Broad ingestion of comprehensive records can conflict with requirements to limit inputs to the minimum necessary information.

• Purpose limitation boundaries: Customer records collected for a defined operational purpose (such as credit evaluation) cannot be repurposed for model optimisation or conversational agent development without documented consent or statutory justification.

• Algorithmic explainability: The JDPA outlines rights regarding visibility into automated processing. For deep learning architectures where mathematical decision pathways are opaque, fulfilling statutory explanation requirements presents substantial technical complexity.

Cross-border processing and technical erasure limitations

Commercial AI infrastructure frequently routes computational workloads through data centers situated outside Jamaica. Transferring un-anonymised local datasets across international borders activates statutory compliance obligations under cross-border transfer requirements.

Additionally, the JDPA establishes an individual’s right to erasure. While record deletion is standard practice in relational databases, removing specific data vectors from a fully converged machine learning model presents significant engineering challenges, frequently requiring full model re-training to achieve definitive parameter removal.

Algorithmic calibration and jurisdictional context

Commercial off-the-shelf models are largely developed using demographic and linguistic datasets from the Global North. Deployed without local calibration, these tools may misinterpret regional naming structures, community address formats, or dialectical expressions. In automated evaluation pipelines (such as employment screening or financial risk scoring) uncalibrated variance can produce uneven outcomes, creating compliance concerns under fairness and lawfulness standards for any affected data subject, whether a citizen or resident.

Governance strategies for institutional compliance

To align technological deployment with the expectations of the OIC, organisations generally adopt structured governance mechanisms:

• Data Protection Impact Assessments (DPIAs): Systematic technical audits prior to system deployment allow entities to identify processing risks, trace data lineage, and configure required safeguards.

• Data masking and anonymisation protocols: Removing direct identifiers, including names, Taxpayer Registration Numbers (TRNs), and specific contact markers, before data transmission reduces exposure risk during algorithmic evaluation.

• Third-party contractual due diligence: Formal vendor agreements ensure third-party service providers maintain verified data security practices and prevent model providers from retaining proprietary inputs for global training datasets.

As automated technologies continue to integrate into the modern economy, data protection regulations establish the baseline parameters for sustainable implementation. Concurrently, the statute provides administrative pathways (including access inquiries, requests for human intervention in automated determinations, and formal notifications to data protection officers or the OIC, to ensure processing practices remain transparent and legally grounded.

Dr Tiou Clarke is a lecturer and researcher in the School of Business Administration at the University of Technology, Jamaica. Send feedback to columns@gleanerjm.com and tiouclarke.facilitator@gmail.com.