Caribbean Data Sharing Needs a Defined Purpose and a Lawful Route

Originally dated 9 September 2026. Updated 13 October 2026.

A useful dataset can support research and better public services. Making it available also requires decisions about who may use it, for what purpose, under which conditions and with what accountability if something goes wrong. Regional cooperation becomes practical when those decisions are clear for the particular project.

What Was Said in Barbados

The Caribbean Development Bank’s published programme placed an AI, data and power plenary on 2 September, during its 1–3 September 2026 Caribbean Evaluation Space conference in Barbados. Craig Ramlal of UWI St Augustine’s Artificial Intelligence Innovation Centre was among the speakers.

In 4 September reporting, the Jamaica Observer described Ramlal’s concern about confusion over data privacy and reported that an open-data initiative pursued since 2012 remained unapproved. It also described his expectation that stronger policies in 2026 would lead to implementation beginning in 2027.

These remarks identify a concern and an ambition. They do not establish why the initiative was delayed, that a regional agreement has been signed, or that every institution will be required to transfer data by a particular date. Those questions need their own documentary evidence.

What the Final Report Actually Recommends

The Caribbean AI Task Force’s July 2026 final report has seven policy pillars. Recommendation 1 calls for harmonisation of data-protection and cross-border data-flow frameworks. The governance discussion explicitly recognises uneven legal and institutional foundations and treats addressing those gaps as part of enabling trusted sharing. The report leaves detailed design, costing and implementation sequencing to national and regional entities.

That makes the next question specific: how will a proposed project turn those recommendations into a lawful, workable arrangement? A broad policy direction cannot answer every question about a hospital dataset, tax record, business survey or public information portal. Each involves different people, purposes and risks.

Distinguish Open Data From Controlled Sharing

“Sharing” can mean several things: publishing statistics for anyone to use, granting a named research team access to protected records, exchanging information between agencies, or allowing analysis without distributing the underlying records. These choices need different safeguards. A project should specify which it means before discussing a regional platform.

The SHARE framework for Caribbean health research highlights risks of re-identification and stigmatisation in small communities, alongside questions about participation, benefits and power between research partners. It provides an ethical research perspective, not legal permission to release data. Its concerns are a reminder that removing names is not the end of a disclosure assessment.

Ask whether a result can be produced with less information. Aggregate outputs, controlled access or a different study design may serve the intended purpose better than a downloadable record-level dataset. None is automatically risk-free; assess what could be inferred or linked in the actual context.

Check the Route Under Applicable Law

A Caribbean agreement must account for the rules that apply to each participating organisation and transfer. A reason to process data domestically does not automatically settle whether it can be sent elsewhere. Nor should a team assume consent is always required, always sufficient or the appropriate basis for every public-sector or research activity.

For example, Jamaica’s Office of the Information Commissioner describes an adequacy requirement for cross-border personal-data transfers, subject to specified exceptions. Its guidance also covers purpose limitation, minimisation, accuracy, retention and security. This is a Jamaican example; it is not a single legal route that can be applied across CARICOM.

The institution’s legal and privacy advisers should identify the relevant authority or basis for the proposed processing, restrictions on particular data, transfer conditions and any required approvals. They should examine onward access by vendors and subcontractors as well as the first recipient. A contract helps document responsibilities, but cannot override applicable law or supply public authority an organisation does not hold.

Participants also need clarity about who answers requests, investigates a complaint and corrects information. People affected by a project should not have to navigate an unclear chain of institutions to find someone responsible. That is an operational design question as well as a legal one.

A Small Project With an Explicit Decision Record

CAIRMC proposes beginning with a tightly defined service or research question, subject to the necessary permissions. Before requesting records, write down the intended benefit and how it will be assessed. Identify the people or communities involved and include appropriate consultation about the project’s design and use of findings.

1. Describe the minimum dataset. Explain why each field is needed, what it represents and whether a less detailed version would work.
2. Resolve authority and access. Record the applicable legal assessment, authorised recipients, permitted uses and conditions for onward sharing.
3. Agree technical definitions. Check units, time periods, missing values and collection methods. Matching column names do not guarantee that two institutions measured the same thing.
4. Test safeguards. Use synthetic examples where suitable to check access controls, audit records and incident handling before exposing protected information.
5. Plan correction and exit. Decide how errors are fixed, how copies and derived outputs are handled, and what happens when permission or the project ends.

Report both the benefit and the burden. Useful measures might include time to answer the agreed question, error rates, staff effort, access problems and unresolved complaints. The measures should follow the project’s purpose; a larger volume of shared records is not, by itself, evidence of success.

An exploratory project may reveal which arrangements are workable. It cannot establish that the same approach is appropriate for every country, dataset or use. Review the evidence before expanding scope, and make a fresh decision when the purpose or recipients change.

Where Cooperation Can Help

Regional work can reduce duplication through shared definitions, training, model agreements and technical expertise. Those resources should make national responsibilities easier to carry out, with clear routes for resolving differences. A useful implementation plan would identify the institutions responsible, the decisions still required and the evidence that will be reported.

The conference discussion and final report create an opportunity to make that work more concrete. The next meaningful milestone is a defined arrangement that participating institutions can explain, operate and review, with safeguards proportionate to the data and the people affected.

Frequently Asked Questions

Did the Task Force set a binding 2027 data-sharing deadline?

The September newspaper report described Craig Ramlal’s expectation that implementation would begin in 2027. That is not evidence of a signed regional agreement or a legally binding delivery date.

Did its final report overlook privacy?

No. The July 2026 final report explicitly discusses uneven data-protection foundations and recommends harmonising data-protection and cross-border data-flow frameworks. Its recommendations still need detailed implementation.

Did privacy law cause the reported delay to the open-data initiative?

The Observer reported that an initiative pursued since 2012 had not been approved. The report does not establish a single cause for that delay. Legal questions, technical interoperability, funding and institutional decisions need separate evidence.

Can an institution rely on legitimate interests to share data across the region?

That cannot be assumed. The available legal basis, any special-category restrictions and cross-border transfer requirements depend on the jurisdiction and the proposed activity. A regional agreement or contract does not by itself authorise a transfer.

Is removing names enough to make data safe to publish?

No. People may still be identifiable through other attributes or through linkage with additional information. Assess the actual disclosure risk, especially for small groups, and consider restricted access or aggregate outputs when appropriate.

What should a first sharing project demonstrate?

It should show a useful, defined outcome, a lawful basis, limited necessary data, suitable security, clear responsibilities and a workable correction or complaints route. Success with one dataset does not validate unrelated uses or wider transfers.

Publisher Disclosure

CAIRMC is chaired by Adrian Dunkley, founder of StarApple AI. The project questions above are editorial recommendations, not a legal opinion or an implementation agreement adopted by the Task Force.