Alignment

Ensuring that The UWI’s operations are in-sync with the fairly new privacy paradigm globally and in the Caribbean

Phase 2 of the promulgation of the Data Protection Policy, which was approved in February 2020, got underway in the period of review. Phase 2 involved implementing some of the actions identified from the gap analysis conducted during the first phase (AY 2020/2021 and AY 2021/2022).

The UDP Office embarked upon several awareness building activities to build internal capability during the review period:

Cave Hill Campus

• Awareness Building Session (“Data Privacy Discussion with UWI Cave Hill Students”) – February 6, 2023
• Data Privacy Discussion with Staff (“The Impact of The UWI Data Protection Policy on records creation, use and disposition”) [collaboration with the UWI Archives and Records Management Programme for UWI Privacy Awareness Month, February 2023] – February 24, 2023

Centre

• Session with leads in The UWI Global Centres and Institutes (GCIs) – August 24, 2022
• Data Protection Impact Assessment (DPIA) – preliminary session with the Office of Finance – October 7, 2023
• Presentation to the Board, Institute for Gender and Development Studies (IGDS) – October 14, 2022
• Presentation to the University Archives and Records Management Advisory Committee (UARMAC) – May 15, 2023
• Sensitisation session with the Hugh Wynter Institute for Reproductive Healthcare and Endoscopic (formerly the Hugh Wynter Fertility Management Unit) – July 19, 2023
• Sensitisation session with the Caribbean Institute for Health Research (CAIHR) – July 24, 2023

Five Islands Campus

• Awareness Building Session (“Data Privacy Discussion with UWI Five Islands Students”) – February 7, 2023
• Data Privacy Discussion with Staff (“The Impact of The UWI Data Protection Policy on records creation, use and disposition”) [collaboration with the UWI Archives and Records Management Programme for UWI Privacy Awareness Month, February 2023] – February 24, 2023

Mona Campus

• Session with staff in the Records and Information Systems Unit – September 1, 2022
• Presentation to new Heads of Department – September 16, 2022
• Presentation to Faculty Board, Engineering – October 6, 2022
• Presentation to staff at the UWI School of Nursing (UWISON) – October 27, 2022
• Presentation to the Faculty Board, Humanities and Education – October 27, 2022
• Presentation to Security Committee – April 19, 2023
• Data Privacy Discussion with Staff (“The Impact of The UWI Data Protection Policy on records creation, use and disposition”) [collaboration with the UWI Archives and Records
Management Programme for UWI Privacy Awareness Month, February 2023] – February 24, 2023
• Presentation to the George Alleyne Hall, Resident Advisor Retreat – June 9, 2023
• Session at the New Resident Advisors’ Training Programme – July 7, 2023

St. Augustine Campus

• Awareness Building Session (“Data Privacy Discussion with UWI St. Augustine Students”) – February 10, 2023
• Data Privacy Discussion with Staff (“The Impact of The UWI Data Protection Policy on records creation, use and disposition”) [collaboration with the UWI Archives and Records Management Programme for UWI Privacy Awareness Month, February 2023] – February 27, 2023

Fora/Workshop Presentations

• Centre for Excellence in Teaching and Learning (CETL) Forum “Demystifying AI (Chat GPT and the Rest of the Crew) in Education – Implications for the Caribbean” – May 30, 2023

Similarly, the UDP Office conducted several sessions with external entities to both share knowledge as well as demonstrate the University’s budding expertise in the area of Privacy:

• Presentation to the Jamaica Post and Telecommunications Department (Jamaica Post), Ministry of Science, Technology, Energy and Mining – October 13, 2022
• Presentation to the International Association of Privacy Professionals (IAPP) KnowledgeNet Caribbean Chapter – December 8, 2022
• “Introduction to the Jamaica Data Protection Act” – Presentation to the Board of the National Council on Technical and Vocational Education and Training (NCTVET) – April 20, 2023
• “Introduction to Data Protection in Jamaica” – presentation to Community College Principals across Jamaica – July 6, 2023
• Presentation to the Board of the National Solid Waste Management Authority (NSWMA) – July 31, 2023

Agility

Ensuring that The UWI’s operations are sufficiently flexible to quickly capitalise on opportunities (regional and global)

University Data Protection Procedures

The Data Protection Procedures – General Operations were tabled for noting at University F&GPC at its October 21, 2022 meeting. These have subsequently been put in circulation. The Procedures, which are linked to, and should be read in conjunction with, the University Data Protection Policy (2020), provide step-by-step instructions to University personnel and those acting on behalf of the University (as contractors/sub-contractors). Outlined in the Procedures are the actions to be taken in order to ensure that the staff member (or contractor), acting on behalf of The UWI (Data Controller) or Data Processor (non-UWI entity), does not breach The UWI Data Protection Policy (2020) and by extension the legislation in the country in which the staff member (or contractor) operates.

The Procedures apply to all Personal Data and/or Sensitive Personal Data managed by all constituent parts of The UWI and its staff (full-time, part-time, or contractor/sub-contractor) in the course of their work with/for the University and irrespective of the format (electronic or hard-copy) in which these data are managed. The Procedures also apply to archival holdings.

Definitions outlined in the Data Protection Procedures:

Alumni – Any individual who holds a PhD, master’s, bachelor’s or associate degree, diploma and certificate from The University of the West Indies or The University College of the West Indies. (From the UWIAA Constitution).

Contractor – A natural or legal person (i.e., a living individual or entity) who agrees to undertake work for the University based on the terms of a specific contract between them and the University.

Contractors are not considered staff of the University and, unlike staff, are independent and may, depending on the terms of the contract between them and the University, undertake work for multiple entities simultaneously and also, independent of the University, be responsible to meet their tax and other statutory obligations.

Data Executive – The head of a University department in which Personal Data and/or Sensitive Personal Data are managed – collected, stored, processed, and/or maintained.

Data Controller – The University of the West Indies.

Data Custodian – The person managing the actual data.

Data Processor – An external entity which manages (creates, collects, stores, disseminates, or disposes of) data on behalf of The UWI.

Data Requestor – Any individual (staff, student, external entity) who makes a request for Personal Data and/or Sensitive Personal Data.

Enterprise Systems Support (ESS) – ICT staff who work in any section which supports the University’s Enterprise Systems.

Personal Data – Information relating to a living individual, or to an individual who has been deceased for less than thirty years, who is, or can be identified, either from the data by itself or from the data in conjunction with other information, which is in, or is likely to come into the possession of the Data Controller (The UWI). (ref. Data Protection Policy (2020)

Sensitive Personal Data – Specific categories of Personal Data. These are defined as data relating to a person’s racial origin, political opinions or religious or other beliefs, physical or mental health, sexual life, criminal convictions or the alleged commission of an offence, and trade union membership. (ref. Data Protection Policy (2020)

Staff – Persons in the employment of the University engaged in one, or a combination, of the following: teaching; research; the application of a well-defined body of technical knowledge, practices and skills in support of the University’ mission; the overall management of the University and/or that of its systems and/or component parts in support of the University’s mission. (Adapted from Statutes and Ordinances 2012 – Revised May 15, 2014)

Student – A person who is registered as a student of the University during a current academic year for a first or higher degree, diploma, certificate or such other qualification or courses of the University as may be approved by the Senate as qualifying a person for the status of a student, but does not include a student of an affiliated institution who is registered for examinations to the degrees, diplomas, certificates and other academic awards of the University. (ref. Statutes and Ordinances 2012 – Revised May 15, 2014)

Rule of Thumb to be used by all who process personal data:

Always manage (collect, create, store, use, share, and dispose of) Personal Data and/or Sensitive Personal Data about other people as carefully as you would wish Personal Data and Sensitive Personal Data about yourself to be managed.

An important note in the Procedures is that Personal Data and/or Sensitive Personal Data, managed (collected, created, stored, used, shared, and disposed of) by staff (or sub-contractors) as a result of their engagement with The UWI, form part of University records. These are, therefore, subject to the University Records Management Policy and its accompanying procedures and guidelines. This means that persons managing these data should always consult the Campus Records Management Unit at their respective campus (or the Campus Records Management Unit associated with their Centre location) in respect of the retention and disposal/destruction of the Personal Data and/or Sensitive Personal Data in your custody.

Contribution to The UWI's 'Revenue Revolution'

The UDP Office has embarked upon several income earning initiatives on behalf of the University. The aim is to not only lend The UWI’s expertise to the wider community but to earn much needed income. This income is then ploughed back into the University’s own Privacy Management Programme activities. Initiatives during the period are:

Privacy Management Programme for HEART/NSTA Trust

• The Privacy Management Programme aims to ensure the Trust's adherence to the Jamaica Data Protection Act (2020) and optimise its operations in accordance with privacy best practices. The engagement will occur in two stages:
  Phase 1: Conducting an initial evaluation of the Trust's privacy landscape, including the identification of personal data handled by the Trust (data mapping).
  Phase 2: Establishing the structure for a Privacy Management Programme and commencing the initial implementation of the Programme.
• Project Duration – 15 Months
  Start Date – December 19, 2022
  End Date – April 30, 2024 [Extended to June 28, 2024]