The Data Protection Act, 2020 of Jamaica uses the factor of local establishment to determine its applicability to data controllers.

Text of Relevant Provisions

The Act Article 3(1)(a):

"Except as otherwise provided for in section 60, this Act applies to a data controller in respect of any personal data only if the data controller – (a) is established in Jamaica or in any place where Jamaican law applies by virtue of international public law, and the personal data are processed in the context of that establishment;"

The Act Article 3(3):

"For the purposes of subsections (1) and (2), each of the following shall be treated as established in Jamaica— (a) an individual who is ordinarily resident in Jamaica; (b) a body incorporated under the laws of Jamaica; (c) a partnership or other unincorporated association formed under the laws of Jamaica; (d) any person who does not fall within paragraph (a), (b) or (c) but who maintains in Jamaica— (i) an office, branch or agency through which the person carries on any activity; or (ii) a regular practice."

Analysis of Provisions

The Data Protection Act of Jamaica clearly uses the concept of local establishment as a key factor in determining its applicability. Article 3(1)(a) states that the Act applies to data controllers who are "established in Jamaica" or in places where Jamaican law applies due to international public law. This provision ensures that entities with a physical presence in Jamaica are subject to the country's data protection regulations.

The Act further clarifies what constitutes being "established in Jamaica" in Article 3(3). This comprehensive definition includes:

1. Individuals who are ordinarily resident in Jamaica
2. Bodies incorporated under Jamaican law
3. Partnerships or unincorporated associations formed under Jamaican law
4. Any person maintaining an office, branch, agency, or regular practice in Jamaica

This broad definition of establishment ensures that the Act covers a wide range of entities operating within Jamaica's jurisdiction. It captures not only formal legal entities but also individuals and organizations with a significant presence in the country.

The inclusion of "regular practice" in Article 3(3)(d)(ii) is particularly noteworthy. This provision extends the Act's reach to entities that may not have a formal office or branch but conduct regular business activities in Jamaica.

Implications

The local establishment factor has several important implications for businesses and organizations:

1. Jamaican entities: All companies incorporated in Jamaica, as well as partnerships and associations formed under Jamaican law, are automatically subject to the Data Protection Act, regardless of where their data processing activities occur.
2. Foreign entities with local presence: International companies that maintain offices, branches, or agencies in Jamaica fall under the Act's jurisdiction for their data processing activities related to that establishment.
3. Regular business activities: Organizations conducting regular business in Jamaica, even without a formal office, may be considered established in the country and thus subject to the Act.
4. Individuals: The Act applies to individuals who are ordinarily resident in Jamaica, potentially affecting freelancers, sole proprietors, or individuals processing personal data.
5. Compliance requirements: Entities meeting the establishment criteria must ensure compliance with all aspects of the Jamaican Data Protection Act, including data protection principles, data subject rights, and any notification or registration requirements.
6. Extraterritorial application: While the establishment factor primarily focuses on local entities, it's important to note that the Act also has provisions for applying to non-established entities under certain circumstances, as outlined in Article 3(1)(b).