Jamaica – Kellye-Raé Campbell

We’re all familiar with how much of our lives are tracked and quantified in the digital age. From the step counter on your phone to the number of likes on your latest selfie, we are constantly leaving behind a trail of data. And while some of it might seem harmless (after all, who doesn’t love a GPS that guides them around traffic?), the reality is that all this data also raises big privacy concerns—especially when it comes to Artificial Intelligence (AI) in the telecom industry.

AI, Telecom, and Privacy: What’s the Connection?

Telecommunications (the networks that carry our calls, messages, and data) is the backbone of our connected world. Think of telecoms as the pipes that carry data like water, and AI as the smart system that analyzes and optimizes how that data flows. It’s a powerful combo, but it comes with a big question: How do we protect our privacy in a world where AI is positioned to process so much of our personal data? You might already be familiar with AI as the brains behind chatbots or the villain in sci-fi movies. But AI is much more than that. It’s about machines that can learn, adapt, and make decisions that usually require human intelligence. From facial recognition to self-driving cars, AI is rapidly transforming how we live, work, and communicate. In the telecom sector, AI can analyze massive amounts of data, optimize network performance, and enhance user experiences. But here’s the thing: as AI collects, processes, and analyzes data, it has the potential to uncover deeply personal insights about us—without us even knowing.

The Data Deluge: What’s Being Collected?

Consider how much data is recorded about you every single day: Your phone’s GPS tracks your movements. Your IP address links you to the Wi-Fi, revealing browsing habits. Your voice assistant is always listening for commands. All of this data flows through networks—and with 5G on the horizon, the amount of data moving through these pipes will only grow. But with all this data being collected, there’s also a big risk. The more devices connected to the network, the more chances there are for data breaches or cyberattacks. Your smart fridge, your security camera, even your car—everything is potentially vulnerable to surveillance or compromise.

The Caribbean’s Privacy Challenge

So, where does the Caribbean stand in all of this? Our legal and regulatory systems for data protection are often fragmented, with each country having its own laws and guidelines. This patchwork approach can make it harder to enforce privacy and security consistently across the region. The EU, on the other hand, is a shining example of regional collaboration. Its General Data Protection Regulation (GDPR) is a robust framework that protects individual privacy while allowing innovation to flourish. The Caribbean could take inspiration from this model—creating a regional approach to AI and data governance that balances the need for privacy with the drive for technological progress.

Privacy Laws: Are They Keeping Up with AI?

Current privacy and data protection laws in the Caribbean often struggle to keep up with the rapid pace of technological change. For example, most laws focus on the collection of personal data—like your name, email, or location. But with the rise of AI, new categories of data are being generated. AI can infer things about us from patterns in our behavior, such as predicting our health, financial status, or even our likelihood to commit a crime. This inferred data can be just as revealing—and sometimes more invasive—than data we willingly share. Take the example of the unverified story of Target and the annoyed father. The story is that the American retailer, once used AI to predict when a customer was pregnant based on their shopping habits. They then sent highly personalized coupons to customers at specific stages of pregnancy. While this data was highly effective for Target, it raised privacy concerns when a father received maternity coupons for his teenage daughter—before he even knew she was pregnant. This story highlights two key issues:

There are new types of data (like inferred data) that aren’t always covered by existing privacy laws.
Inferences made by AI—whether accurate or not—can have serious implications for privacy.

A New Approach to Data Classification

So, how do we fix this? One solution is to rethink how we classify and protect data. Right now, privacy laws focus heavily on identifiable information—data that can directly identify an individual, like your name or address. But with AI, data can be generated or inferred about you without your direct input. This includes things like your health status, your interests, or even your predicted behavior. A more comprehensive data governance framework for the Caribbean should take a risk-based approach and focus on four key areas:

Source of Data: Where does the data come from? Is it directly provided by the individual, collected indirectly, or inferred through algorithms?
Sensitivity of Data: How sensitive is the data? Does it pose a risk to the individual, others, or society as a whole if it’s exposed or misused?
Intended Use: How is the data being used? Is it for personal, operational, or critical uses? Data used for healthcare or legal decisions, for example, requires stricter oversight than data used for marketing.
Privacy Rights: Individuals should have control over how their data is used. This includes the right to access, correct, or delete personal data—and challenge inferences made by AI.

A Balanced Approach to Privacy

It’s clear that AI will continue to shape our lives. The challenge is to ensure that while we embrace these technologies, we also protect individuals’ privacy and rights. A balanced data governance framework—one that considers data’s source, sensitivity, and intended use—will help safeguard privacy while allowing for innovation. As the Caribbean continues to develop its approach to AI and data protection, regional cooperation will be key. A unified framework for AI and privacy can ensure that we protect personal data without stifling the technological growth that promises so much for the region.

To dive deeper into the complexities of AI, telecoms, and privacy in the Caribbean, check out my full paper on Navigating AI in Caribbean Telecom: A Privacy Perspective. This paper was initially presented at 2024 University of the West Indies Cavehill Faculty of Law Caribbean Commercial Law Workshop.

Share this:

On 30^th November, 2021 the Government of Jamaica, through its publication in the Jamaica Gazette, enacted sections 2,4, 56, 57, 60, 66, 74 and 77, and the First Schedule, of the Data Protection Act 2020 with an operative date of the 1^st December 2021. A week later, it was reported via local news outlets, that the Governor General had also appointed an Information Commissioner – Ms. Celia Barclay, also with an effective date of 1^st December 2021. These developments have the primary effect of:

Establishing the Office of the Information Commissioner with certain powers, duties and responsibilities as conferred under the Act;
Commencing the two year transitional period stipulated in section 76 of the Act; and
Effecting immediate obligations & data standards for data that can’t be processed automatically, or that does not form a part of a structured filing system.

The Office of the Information Commissioner

The sections of the act brought into operation with the gazette notice, primarily apply to the establishment of the role and office of the Information Commissioner. With these enactments, the duties & responsibilities of the Commissioner are now operational. In particular, the Commissioner is to establish procedures and make regulations to give effect to the provisions of the act and create a data sharing code after consultation with industry stakeholders. Additionally, the published notice officially conferred to the Commissioner the duty to prepare reports & guidelines for parliament; to adhere to regulations for international co-operation; and to maintain confidentiality of information in her role. The newly appointed Information Commissioner, Ms. Celia Barclay brings to her role a wealth of legal & regulatory experience with over fourteen years at the bar and over seven years in public service.

Commencement of Transitionary Period for Data Controllers

The Act directs controllers to take all necessary measures to ensure compliance with the provisions of the Act and the standards articulated therein for a period of two years after the earliest date of enactment. For this transitionary period, no proceedings may be taken against a data controller for any processing done in good faith. Data controllers now therefore have until 30^th November 2023 to reform their data processing practices to ensure that the comply with the provisions of the Data Protection Act.

Immediately Effective Standards & Obligations

As of the earliest effective date of the Act, being December 1^st2021, any personal data that is held in a way that:

does not allow the data to be processed automatically or;
is not a part of a filing system where the information is structured (either by a reference to individuals or by reference to criteria relating to individuals) in a way that allows specific information relating to a particular individual to be readily accessible;

shall be subject to certain obligations under the Act. In particular, any such data must adhere to the following data standards in accordance with the Act:

The personal data shall be processed fairly and lawfully;
The personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with those purpose;
The personal data shall be adequate, relevant, and limited to what is necessary for the purposes for which they are processed
The personal data processed for any purpose shall not be kept for longer than is necessary for that purpose
Appropriate technical and organisational measures shall be taken— (a) against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data; and (b) to ensure that the Commissioner is notified, without any undue delay, of any breach of the data controller’s security measures which affect or may affect any personal data.
The personal data shall not be transferred to a State or territory outside of Jamaica unless that State or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
That personal data shall be processed in accordance with the rights of data subjects conferred under the Act, with the exception of the right to access and the right to request rectification of inaccuracies.

In addition to this, Controllers processing the data falling within this category are required to:

Obtain consent for any direct marketing in accordance with the Act;
Adhere to written requests for the prevention or cessation of processing in accordance with the Act;
Respect the rights conferred on data subjects with regard to automated decision making;
Meet registration requirements with the Information Commissioner; and
Where applicable, appoint a data protection officer.

Notwithstanding this enactment, without the establishment and structure of a formal registration process within the Office of the Information Commissioner, it is unlikely these provisions will be immediately enforced. Moreover, where a data controller can demonstrate that he has been processing data in good faith during this transitionary period no proceedings may be brought against him under the Act.

Category: Jamaica

Navigating AI Governance in Caribbean Telecom: Privacy Implications