VPNs with servers in Jamaica

Section 47(1) of the Telecommunications Act requires every carrier and service provider to treat as secret information on the type, location, use, destination, quantity and technical configuration of services its customers use. It must disclose it to the Commissioner of Police, the officers in charge of internal security or of the firearm and drug intelligence centre, or the Chief of Staff or head of military intelligence, on request for a criminal investigation or prosecution.

Section 47 sets no retention period. The provisions of the Telecommunications Act above are as the Court of Appeal quoted them in 2015. Whether a VPN operator is a carrier or service provider is not established.

Section 9 of the Cybercrimes Act 2015 (in force 22 December 2015) makes it an offence to use a computer to send another person data that is obscene, threatening or menacing, with intent to harass any person or cause harm, or the apprehension of harm, to any person or property. Communications about industrial action in an industrial dispute are excluded, and the offence is complete whoever actually receives the data (s. 9(1)–(2)).

A Parish Court sentenced a man who pleaded guilty to three counts of sending obscene data to a complainant, one also through a website: twelve months’ imprisonment at hard labour on two counts and a J$1,000,000 fine on the third. In 2021 the Court of Appeal cut the two custodial terms to six months and affirmed the fine.

The Constitution protects the privacy of communication (s. 13(3)(j)(iii)). In INDECOM v Digicel ([2015] JMCA Civ 32, 29 May 2015) the Court of Appeal held that a statutory commission was not among the officers s. 47(2)(a) names, and that its notice was properly refused because it did not state that the purpose was a criminal investigation. The provider there stored subscriber and call data in digital form.

In April 2019 a three-judge bench of the Supreme Court held the National Identification and Registration Act unconstitutional on privacy grounds. The order of the rows is the security score, and a server’s location is not a recommendation.