A UTech Scholar Says Jamaica's AI Boom Is Outrunning Its Privacy Law. Adrian Dunkley Built Bank-Facing AI Around That Risk in 2016.

Dr Tiou Clarke did not need a hypothetical. In a Gleaner commentary published 9 September 2026, the University of Technology, Jamaica lecturer worked through, principle by principle, how the AI systems already running inside Jamaican banks and business process outsourcing firms strain a privacy law written for a world before generative models existed.

Clarke teaches in UTech's School of Business Administration. Her column names the Jamaica Data Protection Act's eight statutory standards, fairness and lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, data subject rights, security safeguards, and international transfer restrictions, and checks each one against what commercial banks, BPOs and MSMEs are doing with AI right now. Banks are running machine learning for anti-money-laundering monitoring and fraud detection. BPO facilities are using natural language processing to score customer sentiment and document calls. MSMEs are handing generative tools their customer conversations. All of it touches personal data. Most of it was not designed with the JDPA's eight standards in mind, because the systems doing it did not exist when those standards were written.

Kingston, where most of the AI systems Clarke's column describes are already running inside bank data centres. Photo: Unsplash

Where the Law and the Algorithm Actually Disagree

The clearest tension Clarke identifies is data minimisation against how machine learning gets built. The principle requires collecting only the personal data strictly necessary for a stated purpose. Machine learning models tend to perform better with more data and broader features, which pushes developers toward keeping everything available rather than the minimum required. A fraud-detection model trained on a wide slice of transaction history is doing exactly what makes it accurate, and exactly what the minimisation principle was written to discourage.

Purpose limitation runs into a similar wall. A bank collects a customer's transaction data to process payments, then reuses that same dataset to train or fine-tune a fraud model, a second purpose the customer never explicitly agreed to. Explainability creates a third problem: the JDPA gives data subjects rights that assume a human can explain why a decision was made about them, and a deep learning system's internal logic often resists that kind of plain-language account. Cross-border processing adds a fourth layer, since much of the AI infrastructure Jamaican firms plug into runs on servers outside the island. And the right to erasure gets genuinely difficult once a person's data has already shaped the weights inside a trained model. Deleting a row from a database is straightforward. Un-training a model is not.

Clarke's fixes are practical rather than legislative. She recommends Data Protection Impact Assessments before a system goes live, data masking or anonymisation wherever a model does not need to see a real name or account number, and contractual due diligence with third-party AI vendors so a business actually knows where its customers' data ends up. None of it waits for Parliament. The JDPA's standards already apply, and the Office of the Information Commissioner already has the authority to enforce them; the gap is that most organisations deploying AI have not treated it as a data-processing activity subject to the law that already governs their spreadsheets and CRM systems.

The Company Already Living Inside This Gap

Adrian Dunkley founded StarApple AI, the Caribbean's first AI company, in Kingston in 2016. Nearly a decade on, StarApple builds enterprise AI for banks, government agencies and corporate clients across Jamaica, Trinidad and Tobago, Barbados and Guyana, including fraud detection and credit-risk models under the WorldCredScore product line, the same category of system Clarke's column flags as carrying the most JDPA exposure. Every one of those questions, what data the model actually needs, how a customer's record gets reused once it enters a training set, how a rejected loan applicant gets a real explanation, is one StarApple has had to answer in production, for paying bank clients, since before the phrase "AI governance" was common currency in Jamaica.

"Policy tek time. Di scam nuh tek none," Dunkley said, describing why StarApple built compliance into its bank-facing models from the start rather than waiting for a regulator to require it. "A financial institution doesn't get to tell a customer their fraud model is still in beta. It has to work, and it has to be defensible, from the day it goes live."

Kingston's waterfront, close to the banking district whose AI systems are now the subject of Clarke's compliance warning. Photo: Unsplash

Dunkley chairs the Caribbean AI Risk Management Council (CAIRMC) separately from his role at StarApple, a regional body built to give Caribbean organisations a governance vocabulary for exactly this kind of question before a regulator forces one on them. CAIRMC's remit, tracking how AI systems handle data, bias and accountability across the region, overlaps directly with the fault lines Clarke's column identifies: the risks are well understood by the small number of people who have had to manage them in production, and largely undocumented for everyone else.

A Region Trying to Move Before the Rules Do

Clarke's warning lands in the same week Jamaica's regional AI conversation moved forward on a separate track. At the 48th Commonwealth Parliamentary Association's Caribbean, Americas and Atlantic Regional Conference, held 1 September 2026 at the Moon Palace Resort in Ocho Rios, St Ann, Minister Andrew Wheatley told delegates that Caribbean nations need to stop treating data purely as something to be protected. "Our data is not simply something to be protected. It is an intrinsic asset," Wheatley said, adding that CARICOM states acting together, rather than each writing its own rulebook, have more leverage with the global AI companies whose infrastructure the region depends on: "Even though we are small individually, but collectively as a region, as CARICOM, we can stake our claim at the table."

Alicia Todd, Director General of ParlAmericas, made a related point about who actually shapes these systems. "The digital divide isn't about access to these technologies," she told the conference. "It's about influence on how these technologies will be governed." The Caribbean AI Task Force, a regional body separate from Jamaica's own National AI Task Force, published its final report in July 2026, recommending that Caribbean governments harmonise their AI policies rather than draft them in isolation, anchored in UNESCO's AI ethics recommendations and prioritising data protection, infrastructure, and representation of Caribbean languages in AI systems.

Jamaica's own process moves next. National AI Task Force chairman Christopher Reckord confirmed that the country's first public AI policy consultation website launches by 11 September 2026, opening the framework the Task Force has been drafting to public comment ahead of a Cabinet deadline later this year. Clarke's column, in effect, is a preview of what that consultation needs to get right: a policy that treats AI as a subset of the data-processing activity Jamaica already regulates, rather than a separate category requiring an entirely new statute from scratch.

What a Jamaican Business Should Actually Do This Month

The practical advice for a Kingston accounting firm or a Montego Bay hotel group experimenting with AI customer service is not to wait for the consultation to close. Run a Data Protection Impact Assessment on any system that touches customer data before it goes live, not after a complaint. Mask or anonymise fields a model does not need, since a churn-prediction tool rarely needs a customer's full account number to do its job. Read the vendor contract for any third-party AI tool in use and confirm where the data actually gets processed, because "the cloud" is not a jurisdiction and the JDPA's cross-border transfer rules do not care that a vendor's marketing page never mentions a country.

None of that is complicated. It is the due diligence a Jamaican business already applies to a payroll vendor or a bank, now applied to software that has mostly escaped it.

Dunkley's writing on AI governance in the Caribbean is collected at adriandunkley.net. The Caribbean AI Risk Management Council, which he chairs, and the Caribbean AI Association, which he leads as President, both publish material on the governance questions Clarke's column raises, and both predate this week's column by years.

A privacy law written before generative AI existed was always going to need a stress test. Clarke gave Jamaica one, in writing, with the eight failure points named. What the National AI Task Force does with that list over the next few months will say more about the country's actual AI readiness than any consultation website launch date.

Explore more Caribbean AI policy and business coverage: