Data Protection Bill outlines stiff penalties for defaulter

Aug 09, 2023 News

Prime Minister Brigadier (ret’d) Mark Phillips

Kaieteur News – The Data Protection Bill, which is set for its 2^nd reading in the National Assembly today, envisages safeguarding citizens’ personal information through a Protection Commissioner. It also provides for fines totaling as much as $100M in addition to imprisonment for those who violate the law.

The Data Protection Bill is being presented by Prime Minister Brigadier (ret’d) Mark Phillips in the National Assembly even as the Government moves in the direction of establishing an electronic identification system which would store a broad range of information on citizens.

As such, this Bill will outline the legal parameters within which data can be lawfully processed and obtained.

Moreover, due to the development in the field of information, communication and technology and the rise in cybercrimes, the need to protect personal information is all the more important.

This was captured in the explanatory memorandum attached to the Bill. According to the information, the very act of processing of personal data is considered lawful interference with rights and freedoms.

For this reason, the Bill sets out the legal parameters within which data can be processed in accordance with law.

Consequently, the objects of the Bill are to define the general principles of data protection and the rights of data subjects; protect personal data collected, used or stored by both private and public entities; and provide for enforcement mechanisms, including penalties, for failure to process personal data in accordance with the law.

A data controller who is not established in Guyana and who does not nominate a representative is liable on summary conviction to a fine of $20M or to imprisonment for two months.

Other violators of the provisions in the Bill on conviction of a charge can be fined no less than $20M or no more than $100M or to imprisonment for a term not exceeding five years.

According to the memo, the responsibilities of a data controller include implementing the appropriate technical and organisational measures to ensure that processing is performed according to the law.

The information stipulates that data controllers are also mandated to conduct a data protection impact assessment where the type of processing is likely to result in a high risk to the rights and freedoms of a person.

The data controller shall consult the Protection Commissioner prior to processing data where a data protection impact assessment indicates that the processing would result in a high risk to the rights and freedoms of any person in the absence of measures taken by the data controller to mitigate the risk.

Like data controllers, data processors must also be registered, and when necessary appoint a representative established in Guyana. A data processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller. Processing by a data processor shall be governed by a written contract between the data processor and the data controller.

In addition to this, the Bill empowers the Protection Commissioner to issue enforcement notices in instances where the Commissioner is satisfied that a data controller has contravened, or is contravening any of the data protection standards.

The Commissioner must consider whether the contravention has caused or is likely to cause any individual damage or distress at the point when deciding to serve an enforcement notice.

The notice issued may require the data controller to take or refrain from taking specific steps within a specified time; refrain from processing any personal data or personal data of a specified description; or refrain from processing data for a specific purpose or in a specific manner, after a specified time.

Compliance with an enforcement notice is not required until the expiration of the period within which an appeal can be brought. If there is an appeal, the notice need not be complied with pending the determination or withdrawal of the appeal.

Discover more from Kaieteur News

Subscribe to get the latest posts sent to your email.

Data Protection Bill, Mark Phillips

Latest News