22. The first standard

22.—

1. The first standard is that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless—

(a) at least one of the conditions set out in section 23 is met; and

(b) in the case of sensitive personal data, at least one of the conditions set out in section 24 is also met.

2. In determining for the purposes of this section whether personal data are processed fairly, regard shall be had to the method by which the data are obtained, including, in particular, whether any person from whom they are obtained is deceived or misled as to the purpose or purposes for which they are to be processed.

3. For the purposes of this section, personal data are deemed to be obtained fairly if they consist of information obtained—

(a) from a person who is authorised by or under any enactment to supply it; or

(b) from a person who is required to supply it by or under any enactment, or by any instrument imposing an international obligation on Jamaica; or

(c) for the purposes of determining the suitability of a person for an honour, scholarship, prize, bursary or other award.

4. Subject to subsection (3), for the purposes of this section personal data are not to be treated as processed fairly unless—

(a) the personal data are obtained directly from the data subject, or from a person authorised in writing to provide it by—

(i) the data subject; or

(ii) the Commissioner;

(b) in the case of personal data obtained from the data subject or a person authorised in writing by the data subject to provide it, the data controller ensures so far as practicable that the data subject is provided with the information specified in subsection (6); and

(c) in any other case, the data controller ensures so far as practicable that, before the relevant time the data subject is provided with the information specified in subsection (6).

5. In—

(a) subsection (4)(c), “the relevant time” means—

(i) at the time when the data controller first processes or seeks (whichever occurs first) the personal data; and

(ii) in any case where disclosure to a third party is envisaged, before making the disclosure;

(b) subsection (6), “identity” includes official title, habitual residence or business address, telephone number and any other relevant contact information.

6. The information referred to in subsection (4) is—

(a) the identity of the data controller;

(b) the identity of its data protection officer appointed under section 20;

(c) if the data controller has appointed a representative for the purposes of this Act, the identity of that representative;

(d) the purpose or purposes for which the personal data are intended to be processed;

(e) the identity of any third party to which disclosure of the personal data is contemplated;

(f) whether the provision, by the data subject, of the personal data sought is compulsory under any law, and the consequences of not providing the personal data;

(g) the legal authority for seeking the personal data, where applicable;

(h) the expected period of retention of the personal data; and

(i) any further information which is necessary, having regard to the specific circumstances in which the personal data are, or are to be, processed, to enable processing in respect of the data subject to be fair.

7. Subsection (4)(c) does not apply where—

(a) the recording of the information to be contained in the personal data, or the disclosure of the personal data, by the data controller is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract; or

(b) in such other circumstances as may be prescribed.

8. Personal data which contain a general identifier falling within a prescribed description are not to be treated as processed fairly and lawfully unless they are processed in compliance with any conditions prescribed in relation to the general identifier of the prescribed description.

9. In subsection (8), “general identifier” means any identifier (such as a number or code used for identification purposes) which—

(a) relates to an individual; and

(b) forms part of a set of similar identifiers which is of general application.