Opposition spokesman on science, technology and commerce, Hugh Graham is warning that the breach of the JAMCOVID-19 application, which may have exposed the personal data of thousands of travelers, will not inspire confidence in the Government’s much touted National Identification System (NIDS).

“Jamaicans would have every justification to be suspicious of the security of their data associated with the NIDS,” Graham told Loop News.

“I am sure this vulnerability (breach) is a great cause for concern and persons would not be running to get signed up (to the NIDS),” the Member of Parliament for North West St Catherine added.

According to Graham, “there wasn’t much confidence in the NIDS in the first place”.

Graham argued that the government must have the problems fixed “post haste”.

He said the Administration must share the contractual arrangements it has with the Amber Group that established the website and “must come clean with the public, apologise where necessary and say what is the way forward”.

About the JAMCOVID site, Graham said “we must have competent persons with the requisite expertise managing and maintain the application/site. He said E-Gov, which was set up as the expert agency, needs to step in at this time and be properly resourced to do the job”.

Graham, in a recent statement, pointed to reports which surfaced last Wednesday which he noted “indicate that data ranging from COVID-19 test results uploaded to the VisitJamaica website, quarantine orders, and even 440,000 signatures were accessible to the general public for an unknown amount of time”.

“It’s easy to say the data is ‘now secure’ but we need to know what caused this breach in the first place, and the public (must be) assured that this will not recur. We’re inviting people to come to Jamaica and upload sensitive data through this application, so we must guarantee our visitors that their private data will be safe,” said Graham.

The Amber Group, which created the site, has insisted that the system is now secure and has dismissed reports of a second breach of the application.

The Ministry of National Security is also insisting that the site is now safe and has launched a criminal probe into the matter.

When asked whether it was time for a comprehensive overhaul of government databases holding sensitive information on behalf of the public, Graham said: “Indeed we’re moving more and more into the digital age, we must have constant upgrades and fixes and we must have constant upgrades, surveillance and fixes to our IT platforms as technology isn’t static”.

Meanwhile, a joint select committee of the Parliament which is chaired by Justice Minister Delroy Chuck, is currently examining a new NIDS Bill. The original legislation, passed in November 2018, was struck down as unconstitutional by Chief Justice Bryan Sykes in April 2019 after certain aspects of the law were deemed to be in breach of the constitutional rights of Jamaicans.

Justice Sykes, in announcing the decision of the Court at the time, said the justices were unanimous in their decision that the entire law be declared unconstitutional, null and void. Sykes was supported by justices Lisa Palmer Hamilton and David Batts.

Justice Sykes said, after the sections of the legislation that were found to be in breach of the individual’s right to privacy as guaranteed by the constitution were removed, the justices were of the view that the remaining portions of the law could not stand. He noted that the remaining portions would not accurately reflect the will or intent of the legislature.

The offending sections of the law related primarily to privacy issues such as the collection of biometric data. Jamaicans would have been required to give their fingerprints, state their blood type and even subject themselves to iris scans if the law had taken effect.

The Chief Justice posited that the collection of biometric information violated informational privacy since such information can reveal a number of things about individuals. The Chief Justice noted that iris scans for example, can reveal a person’s health status to include their particular ailment and the type of medication being taken. He argued that individuals may be minded to keep such information private.

Speaking to the new draft bill in the Parliament in early January, Prime Minister Andrew Holness said it provides for a robust and coherent legislative framework to treat with the collection, processing, storage, retention, usage, and protection of personal data; the protocols, procedures, and systems for identity verification, monitoring and compliance; and an independent oversight body.

Holness stressed that participation of eligible persons in the system must be voluntary; the Supreme Court did argue that the mandatory requirement under the previous legislation that all Jamaicans register under the NIDS ran counter to the orderly running of a free and democratic society. They argued that this provision denied the individual of choice. The justices also noted that failure to register was "backed up by the risk of criminal prosecution".  According to the justices, this was coercive.

And Holness said that only biographic and biometric data that is absolutely necessary to ensure the efficacy of the process will be taken.