Guyana well underway to traverse ‘digital age’ as House passes Data Protection Bill – AG

The Data Protection (Amendment) Bill 2023 was on Thursday passed in the National Assembly, which allows for the privacy of persons when their personal data is being used or handled.
Presenting the Bill for its final reading in Parliament was Attorney General Anil Nandlall, who noted that this piece of updated legislation has been long overdue, given the shift to e-governance and digitalisation.
The Data Protection Bill was created to regulate the collection, keeping, processing, use and dissemination of personal data. It sets a statutory framework, moving away from the current construct of the country’s legislation, which does not safeguard against rights to data protection.
“Guyana is well on its way into traversing the digital age and this Bill is of utmost importance as it seeks to establish a framework to support the accumulation, storage, use, and dissemination of data but most importantly, it sets out a protective framework through which the data collected and used on our behalf, that that data is protected,” he underscored.
Personal data has been defined as any information relating to an identified or identifiable person, pertaining to private and public life as well as professional activities.
The Bill prescribes that a body be established, recognised as the Data Protection Office, which shall be responsible for the administration and implementation of the Act. The President will also be empowered to appoint a Data Protection Commissioner.
According to the Attorney General, the Bill was drafted in keeping with the Universal Declaration of Human Rights and the International Covenant on Civil and Political Rights.
The General Data Protection Regulations approved by the European Parliament have also been used, regarded as a gold standard for data protection laws. Lawmakers took guidance from the United Kingdom, Jamaica, Barbados, Mauritius and Kenya.
An implementation plan will allow different dates for segments of the Bill to be enacted.
He outlined, “This means persons and entities must be aware of their obligation and given time to put their house in order before we can enforce the law. We are not unique in this regard. For example, in Jamaica, the Data Protection Act was passed in 2020 but will come into force this year. Of course, we are hoping not to be so protracted in bringing the Bill into force.”
A person who fails to comply with the enforcement notice, an information notice, or a special information notice commits to an office and can be fined $1 million or imprisoned for three months.
Any person who intentionally obstructs the execution of a warrant, fails to provide the Police with required assistance, or makes false statements under certain subsections can be fined $1 million- or six months’ imprisonment.
There are penalties for data controllers, which are persons who determine the manner and purpose of which personal data is processed. It is a criminal offence for such officers to operate without being registered or without nominating a representative, carrying a fine of $10 million- or two months’ imprisonment.
Like data controllers, data processors must also be registered and when necessary, appoint a representative established in Guyana. A data processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller.
Both are required to maintain a record of processing activities, cooperate with the commissioner, implement appropriate technical measures to ensure certain security and notify the commissioner when there is a breach of personal data.