ished among other things to receive Hurricane Melissa relief donations, are being addressed following the implementation of an access control document.
It comes after a recent audit of the official Support Jamaica website, operated by ODPEM, revealed significant information security and administrative flaws.
The Auditor General’s Department identified inadequate access management in data protection non-compliance and a lack of approved information security policies governing the donation portal’s dashboard.
The matter was highlighted during Wednesday’s meeting of the Public Accounts Committee (PAC).
Eight external officers were granted access to the administrative dashboard without documented requests, formal approvals or evidence that their assigned permissions aligned with their official roles.
Responding to questions raised by PAC Chairman Julian Robinson about data protection, Director General at ODPEM, Commander Alvin Gayle, explained that the privacy terms were updated to reflect the conditions of local data protection laws.
“The accounts which were mentioned as the eight officers who were given external access to the website, those accounts have been since removed from access. Nevertheless, the issues related to access control of the Support Jamaica website have been rectified and access control document has been implemented, and as mentioned before, all the non-ODPEM user access accounts have been deactivated. Additionally, the matter concerning the Director General himself possessing super user access, those privileges to the website have since been removed and the Information Systems Manager of the ODPEM has since been granted the necessary access permissions to the Support Jamaica website,” Commander Gayle explained.
He said an agreement was established to ensure donor data privacy is being maintained despite the Support Jamaica website still being owed by the developer.
“The developer and ODPEM have access to the information as per our current privacy statement. We would have made the necessary adjustment to make it clear. As it is now, they own the website and we are utilising our portal. There’s a requirement in the data protection agreement concerning once we are concluded using the platform, the modalities around how the information should be scrubbed and the assurances given to us that the matters are indeed removed from their access,” he told the PAC.