← Back to Jamaica DPA Accelerator: Fundamentals
Standard 1: Fair and Lawful Processing (Consent)
Standard 1 is the foundation on which the other seven stand: personal data must be processed fairly and lawfully. In plain terms — no secrets, no tricks, and always a proper legal reason for what you do with people’s information.
The two halves of Standard 1
1. Fairness
People must not be misled about what happens to their data. If a customer gives a phone number “for delivery updates,” using it for marketing blasts is unfair processing — even if they handed it over willingly. Fairness means transparency at the point of collection: who you are, what you are collecting, why, and who it will be shared with.
2. Lawfulness
Every processing activity needs a lawful basis. Consent is the most famous one, but it is not the only one. Other bases include: performance of a contract (you need an address to deliver goods), a legal obligation (payroll records for TAJ), protection of vital interests (emergency medical care), and the controller’s legitimate interests where these do not override the individual’s rights.
What real consent looks like
Under the JDPA, consent must be freely given, specific, informed, and unambiguous. That rules out:
- Pre-ticked boxes or silence treated as agreement
- Burying consent inside 30 pages of terms and conditions
- “Consent or no service” where the data is not actually needed for the service
- Consent from someone who could not realistically say no (e.g. an employee pressured by a manager)
Consent must also be withdrawable. If a customer can sign up for SMS promotions in ten seconds, opting out must not require a written letter and two weeks of waiting.
A supermarket in Sav-la-Mar launches a loyalty card. The sign-up form asks for name, phone, date of birth, and — in fine print — permission to share data with “partners.” A customer later starts receiving insurance calls. Because the sharing was not clearly explained and specifically agreed to, the supermarket cannot rely on consent. The fix: a separate, plainly worded, unticked checkbox for third-party sharing, and a record of who ticked it and when.
Your job as a staff member
You do not need to be a lawyer. You need three habits: (1) only collect what your role genuinely requires, (2) never use data for a purpose the person was not told about, and (3) when in doubt, ask your supervisor or DPO before sharing anything.
Quick check: A customer’s number is in the system from a past delivery. Can sales call them with a new promotion?
Not automatically. The number was collected for deliveries. Marketing is a different purpose and needs its own basis — usually a recorded marketing consent. Using it without one breaches both Standard 1 (fairness) and Standard 2 (purpose limitation).
Quick check: Do you need consent to keep employee payroll records?
No. Payroll processing rests on legal obligation and contract — stronger bases than consent. This is a common misconception: consent is one lawful basis among several, and often not the best one.
- Standard 1 requires processing to be both fair (transparent, no surprises) and lawful (a valid legal basis).
- Consent must be freely given, specific, informed, unambiguous — and easy to withdraw.
- Consent is not the only lawful basis: contract, legal obligation, vital interests, and legitimate interests also count.
- Golden rule for staff: never use data for a purpose the person was not told about.