The Jamaican Data Protection Act: The Risks of Relying on Employee Consent

Introduction

I recently read an article where persons were suggesting that in order to process employee personal data, you must obtain consent. In particular it was said:

.“Under the new legislation, employers must obtain explicit consent from candidates before collecting, recording, or sharing their personal information. This requirement extends to all aspects of the recruitment process, including virtual or in-person interviews, video, written and audio recordings“

This is a slippery slope. If we were to follow several decisions handed down supervisory authorities, similar to our Office of the Information Commissioner, we would appreciate that this may not be the best approach. The limitations of consent as a legal basis for processing personal data are particularly relevant under the Jamaican Data Protection Act (JDPA).

The JDPA marks a significant shift in how organizations, including employers, must handle personal data. The act, which aims to regulate the processing of personal data and safeguard individuals’ privacy rights, imposes stringent requirements on organizations to ensure compliance. Failure to adhere to these regulations can result in severe penalties.

As the Caribbean Society for Human Resource Professionals (CSHRP) navigates this new regulatory landscape, it’s crucial to understand the implications of the JDPA on recruitment processes. This article explores the limitations and risks of relying on consent as the primary legal basis for processing personal data, using insights from the Data Protection Regulation of the European Union and specific cases from Slovenia and Belgium as reference points.

The Jamaican Data Protection Act: An Overview

The JDPA sets out the principles for data processing, emphasizing the need for transparency, accountability, and the protection of individuals’ rights. Key provisions include:

Lawfulness and Fairness: Personal data must be processed lawfully, fairly, and transparently.
Purpose Limitation: Data should be collected for specified, explicit, and legitimate purposes.
Data Minimization: Data collected should be adequate, relevant, and limited to what is necessary for the intended purposes.
Accuracy: Data must be accurate and kept up to date.
Storage Limitation: Personal data should not be kept longer than necessary.
Integrity and Confidentiality: Data must be processed securely to protect against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

Consent is one of the legal bases for processing personal data under the JDPA. However, the act stipulates that consent must be:

Freely Given: Individuals must have a genuine choice without facing any detriment if they refuse.
Specific: Consent must be specific to the particular data processing activities.
Informed: Individuals must be fully informed about the data processing activities, including the purpose and potential risks.
Unambiguous: Consent must be given through a clear affirmative action, indicating agreement.

The Slovenian Case:

A recent decision by the Slovenian Data Protection Authority (DPA) underscores the pitfalls of relying on consent in employment relationships. In this case, a company director required that employees participate in a video greeting card, which was then sent to clients and sought to rely on their consent as the lawful basis. The DPA was asked to rule on the legality of this decision and the lawfulness of processing the employees’ personal data.

Findings of the Slovenian DPA

The Slovenian DPA concluded that:

Power Imbalance: Due to the inherent power imbalance in employer-employee relationships, consent cannot be considered freely given. Employees might feel compelled to consent to avoid negative consequences.
Voluntary Participation: For consent to be valid, participation must be genuinely voluntary, allowing employees to refuse without facing any repercussions.
Exceptional Cases: Consent should only be used in exceptional cases where no other legal basis is appropriate.

This case illustrates that consent is not a suitable legal basis in situations where there is a significant power imbalance, such as between employers and employees.

The Belgian Case:

The Disputes Chamber of the Belgian Data Protection Authority (DPA) provided another example in Decision 35/2024. The case involved an employee who discovered that her photo was being used by her former employer in a recruitment campaign without her consent. Despite requesting the removal of her photo, the employer failed to comply in a timely manner, leading to a complaint being filed with the DPA.

Findings of the Belgian DPA

The Belgian DPA highlighted several important points:

Right to Erasure: The employee exercised her right to erasure under Article 17 GDPR, which requires personal data to be deleted without undue delay if it has been processed unlawfully.
Legal Basis for Processing: The DPA found that the use of the employee’s photo was not justified under any of the legal bases for processing personal data, including consent, contract performance, or legitimate interest.
Timely Response: The employer failed to respond to the erasure request within the required timeframe, further complicating the situation.

This case underscores the importance of adhering to data protection principles and the challenges of relying on consent, especially when former employees are involved.

Coercion and Power Imbalance

In the context of recruitment, the power imbalance between employers and candidates can make it difficult to obtain valid consent. Candidates may feel pressured to consent to data processing activities to increase their chances of being hired, undermining the voluntariness of their consent.

Ensuring that candidates are fully informed about how their data will be used is challenging, particularly when data processing involves complex or opaque activities. This can lead to situations where consent is not truly informed, violating JDPA requirements.

Candidates have the right to withdraw their consent at any time. This can create operational challenges for employers, particularly if consent is withdrawn after significant data processing activities have already taken place. Employers must have mechanisms in place to cease processing and delete data upon withdrawal of consent.

Alternative Legal Bases for Processing

Given the limitations and risks associated with consent, HR professionals should consider alternative legal bases for processing personal data under the JDPA:

Performance of a Contract

Processing may be necessary for the performance of a contract with the data subject. For instance, processing data to fulfill employment contracts or pre-contractual measures requested by the candidate can provide a solid legal basis.

Legal Obligations

Employers often need to process personal data to comply with legal obligations, such as verifying candidates’ right to work or conducting background checks required by law.

Legitimate Interests

Employers may process personal data based on their legitimate interests, provided these interests are not overridden by the candidates’ rights and interests. This requires a careful balancing test to ensure that the processing is necessary and proportionate.

Best Practices for HR Professionals

To navigate the complexities of the JDPA and avoid the pitfalls of relying on consent, HR professionals should adopt the following best practices:

Conduct Data Protection Impact Assessments (DPIAs)

DPIAs help identify and mitigate risks associated with data processing activities. By conducting DPIAs for recruitment processes, HR professionals can ensure that they are using appropriate legal bases and implementing necessary safeguards.

Develop Clear Data Protection Policies

Comprehensive data protection policies should outline the legal bases for processing personal data, the purposes of processing, and the rights of data subjects. These policies should be communicated to candidates transparently.

Minimize Data Collection

Adhere to the principle of data minimization by collecting only the data necessary for specific purposes. Avoid requesting excessive or irrelevant information from candidates.

Ensure Data Security

Implement robust data security measures to protect candidates’ personal data from unauthorized access, loss, or damage. This includes secure storage, access controls, and encryption where appropriate.

Train HR Staff

Provide regular training to HR staff on data protection principles and the requirements of the JDPA. This ensures that all staff members understand their responsibilities and can handle personal data appropriately.

When relying on consent, ensure that it is explicit, specific, informed, and freely given. Provide candidates with clear information about the data processing activities and their rights.

Conclusion

The JDPA presents significant challenges and opportunities for HR professionals in Jamaica and the wider Caribbean region. While consent is a valid legal basis for processing personal data, its limitations in the context of employment relationships make it a less suitable option. The Slovenian and Belgian cases serve as cautionary tales, highlighting the potential pitfalls of relying on consent where there is a power imbalance or when dealing with former employees.

By understanding the requirements of the JDPA and adopting best practices, HR professionals can ensure compliance, protect candidates’ privacy rights, and build trust in the recruitment process. Embracing alternative legal bases for processing and implementing robust data protection measures will position organizations for success in the evolving data protection landscape.

A Warning for HR Professionals in the Caribbean