Case Summary and Outcome

A three-judge bench of the Supreme Court of Judicature of Jamaica held the National Identification and Registration Act (“NIRA” or the “Act”), in its entirety to be unconstitutional on the grounds of violating the right to privacy and equality. The Act required Jamaican citizens and residents of more than six months to mandatorily enroll in the database and provide biographic and core biometric data. To ensure enforcement of the Act, criminal sanctions were provided for individuals who failed to enroll themselves. The Court, while giving an extensive interpretation of the right to privacy held the mandatory nature of the Act and the criminal sanctions to be in violation of informational privacy and liberty of the individuals. The disproportionate measures used to enforce the Act, the lack of necessary and a legitimate purpose, and absence of safeguards against misuse of the data collected under the Act were the primary grounds on which the Court declared the Act to be unconstitutional.

---

Facts

Mr. Julian Robinson, a Jamaican citizen, challenged the constitutionality of some provisions of NIRA. NIRA had been passed by the legislature and became law on December 8, 2017, but had not come into force. The challenge was made before the three-judge bench of the Supreme Court of Judicature of Jamaica on the grounds that some of the provisions of the Act violated the right to equality, liberty, security and privacy guaranteed under the Jamaican Charter of Fundamental Rights and Freedoms Act, 2011 (“the Jamaican Charter”) which are enshrined in the Constitution of Jamaica.

The Attorney General of Jamaica argued on behalf of the government that the provisions challenged are constitutional and reasonably justified in a free and democratic society. NIRA does not engage with privacy in the territorial sense or warrant interference with bodily integrity. In the alternative, if the Court finds that the right to privacy was interfered with, then interference was justified as the Act pursued a legitimate objective and purpose.

The legislature enacted NIRA to provide for a system of data collection on all Jamaican citizens and those who live there for at least six months of a calendar year. NIRA required registrable individuals to apply for registration and the failure to do so could put them at risk of a criminal conviction. The system proposed to collect broad range of information including biometric data, demographic information and national reference numbers such as taxpayer registration and driver’s license to create a National Civil and Identification Database which would be stored on government systems indefinitely. On registration, individuals would be given a National Identification Number (“NIN”), which would make them eligible for a National Identification Card (“NIC”). The NIN or NIC were prerequisites for access to goods or services from public authorities. On request, the system also allowed third parties access to the data, without sufficient safeguards for data protection.

The Court considered detailed arguments on the test of proportionality, nature and ambit of right to privacy, and interpretation of legitimate objective and purpose in the free, democratic society.

---

Decision Overview

Chief Justice Sykes, Justice Bates and Justice Batts delivered separate opinions but unanimously held the NIRA, in its entirety to be unconstitutional null and void on the grounds of being in violation to the right to privacy and equality. The central claim was whether the mandatory enrollment prescribed was a breach of the Jamaican Charter and whether the criminal sanction imposed for non-registration was a proportional means of enforcement.

The underlying theme of this claim was narrowed down to freedom and privacy. Citing the Canadian Supreme Court’s views on the nature of freedom in Big M Drug Mart Ltd 18 DLR (4th) 321, Justice Sykes stated that “the rights dealing with freedoms of thought, religion, peaceful assembly, movement and from discrimination are about being free from compulsion or restraint from doing or not doing something that one does not want to do when there is no compelling reason other than somebody else’s views, including the executive’s and legislature’s, that one should do it” [para. 173].

The Court analysed every section of NIRA under challenge and found that because non-registration is a continuing offence, the potential of prosecution is ongoing. The enrolling process necessitates the submission of biographic and core biometric data. When this is paired with the interpretation of other provisions of the Act, it creates the prospect that someone who does not enroll in the database will be denied access to the whole array of Government services and benefits [para. 247(B)(7)].

On the ambit of right to privacy, the Court while referring to Justice K Puttaswamy (Rtd) and Anr v. Union of India (“Puttaswamy case”) held that the right to privacy is an inherent right which “has at least three aspects: privacy of the person; informational privacy, and privacy of choice” and the Jamaican Charter is “predicated on the inherent dignity of human beings” [para. 175-176]. The Court recognized that “privacy in a free and democratic society recognises that a person’s biometric information is theirs and that they retain control over that information by virtue of their inherent dignity as free autonomous beings” [para. 247(B)(10)].

The Attorney General argued that the onus to conclusively prove the violation of rights such as privacy and freedom is on the claimant. However, the Court did not support this position. Relying on the Canadian case of R v Oakes 26 DLR (4th) 200, the Court held that in constitutional litigations, once the claimant establishes a prima facie case for a violation of fundamental rights in the legislation, “it is for the violator to prove that the law is justifiable in a free and democratic society” [para. 101]. The test is whether the violation is demonstrably justified which requires “clear evidence” and “convincing justification” [para. 121]. This imports a high standard of accountability and the court needs to know of the alternative measures available for implementing the objective to ensure effective protection of fundamental rights. Further, where there is a tie between the claimant and the state in regards to violation of a right and justifications for the violation, “the court should always rule in favour of upholding the right” [para. 130].

To assess whether a legislation is “demonstrably justified in a free and democratic society”,  Justice Sykes relied on the proportionality test applied in the Oakes case but modified it to a four step criteria:

• “the law must be directed at a proper purpose that is sufficiently important to warrant overriding fundamental rights or freedoms;
• the measures adopted must be carefully designed to achieve the objective in question. They must not be arbitrary, unfair or based on irrational considerations.
• the means, even if rationally connected to the objective in this first sense, should impair as little as possible the right or freedom in question;
• there must be a proportionality between the effects of the measures which are responsible for limiting the Jamaican Charter right or freedom and the objective which has been identified as of sufficient importance” [para. 108].

Applying this test in the backdrop of the right to privacy, Justice Sykes differed from the majority’s decision in the Puttaswamy case to allow for a more “granular scrutiny” of “the deleterious effect of the measure relied on to meet the objective” [para. 177].

This leaves lesser margin of appreciation for national authorities in their assessment. As a result, any modification of a fundamental right requires a “high standard of justification.” While the standard of proof for the claimant is on the lower end of a balance of probabilities, the standard of proof for the violator is “balance of probabilities but at the higher end, closer to the fraud end of the spectrum of proof.” Thus, any trespass to fundamental rights will be upheld only when it is necessary, justified and is the “least harmful having regard to the purpose or objective of the law” [para. 203].

“Proportionality means, among other things, that the cure must not be worse than the ailment. The cure should not leave the patient in a worse state than before the medicine was administered” [para. 228]. Applying this test to the NIRA, the Court held that the Act fails on all accounts as there is an acute lack of evidence to show the urgency or the importance of the mandatory scheme.

Differentiating NIRA from the Aadhaar scheme upheld in the Puttaswamy case, the Court held that the information collected extended beyond demographic information to include extensive biographic information which was to be processed for economic or social goals. Further, the Aadhaar scheme was a voluntary programme, targeted to provide government help to a special group of people. The Indian government produced considerable data to indicate the necessity of the scheme in India to effectively distribute money from welfare schemes and other programmes to the intended recipients [para. 228].

Relying on the Supreme Court of Canada decision in Blencoe v British Columbia 190 DLR (4th) 513, the Chief Justice stated that the right to life, liberty and security as protected under section 13(3)(a) of the Jamaican Charter is an extensive right. The compulsion to provide biographical or biometric information under NIRA interferes with the person’s right to liberty. Unlike instances of data collection for a driving license or passport, creating a unique identifier for every individual will give the State the power to link data across a broad range of databases which can generate new data identifiers the individual had not consented to [para. 247(B)(19)].

The Court further discussed that “protection against search” would also encompass protection against compulsory taking of biographical and biometric data of individuals. The Court discussed several cases of the Canadian Supreme Court where it was established that “the concept of search is not confined to the physical examination of the person or his/her home or business but extends to the taking of fingerprints and any information that is given under compulsion of law” [R v. Spence [2014] 2 SCR 212; R v. Dyment 55 DLR (4th) 503].

Highlighting the dangers of collecting biometric information in threatening privacy and personal security, facilitating discrimination and mass surveillance, and undermining an individual’s right to remain anonymous, Justice Sykes concurred with Justice Chandrachud’s dissenting opinion in the Puttaswamy case. Considering the irreversible and grave impact of a data breach, collection of biometric data for matters apart from criminal investigations is likely to result in fundamental rights violations unless very there are rigorous safeguards in place.

The Court further expressed great concern over third-party access provided for in the NIRA. The Act permits third parties or requesting entities access to the database for verification purposes, without showing that the access was necessary [para. 247(B)(59)]. While the Act directs the requesting entity to access the database only for verification purposes, the penalty if the database is used for any other purpose is not sufficiently prohibitive to have a deterrent effect on the third parties to prevent misuse [para. 247(B)(74)].

Seeing no compelling need for the mandatory scheme of enrollment, the Court concluded that the Act was a “disproportionate means to achieve the objective of providing each citizen with reliable identification” [para. 247(B)(51)].

In regards to criminal sanctions against individuals who fail to enroll under NIRA, the Court found the provision to be a plain violation of the right to privacy. Criminalisation deprives the citizens the choice to seek the state’s identification number voluntarily. This assumes greater significance where the statute does not rule out data profiling.

Lastly, the Court assessed the safeguards under NIRA to protect private information. Section 39(4) of the Act provided for a criminal penalty of $500,000, if requesting entities used the information for anything but verification. The Court found that the fine was insufficient and the Act did not provide an affirmative duty on the third party to destroy verification data. Further, the Act did not prevent third parties from storing data or collecting metadata. Misuse of data is a violation that can go undetected very easily which makes data theft a serious cause for concern. For this reason, there must be a strong deterrent to minimise data theft and robust systems should be put in place to minimise data theft.

Although only some parts of NIRA were found to be unconstitutional, the Court struck down the law in its entirety because the Act did not provide sufficient safeguards to protect sensitive information. A more robust protection would be required, even if the scheme was voluntary.

---