By Kurt Campbell
The government has completed the draft of its Data Protection Bill and is inviting submissions and recommendations.
But even before the legislation is taken to Parliament for debate and passage, the Bill is being hailed as “impressive” by regional leaders and lawyers.
One such person is Barbadian attorney, Bartlett Morgan, who has distinguished himself in IT law.
On his LinkedIn page, he said the Bill is probably the most advanced and ‘fit-for-purpose’ privacy law that he has seen emerging from the Caribbean to date.
“While there is some room for fair criticism, there is a lot to be pleased about in the direction of the draft law. The drafters have clearly assessed prior efforts of other countries in the region (and further afield) and sought to strike a fair balance between the competing interests of data subjects and data controllers,” he said.
According to the regional attorney, the biggest takeaways are the fines set out for companies in breach of the law and separate liability for senior company leadership.
The purpose of this Bill is to ensure a person’s right to protection with respect to the processing of personal data which includes professional activities, as well as information concerning the person’s public life.
Notwithstanding, it is important to note that the rights captured in this Bill are not absolute but may be limited if necessary for protecting the rights and freedoms of others.
In fact, the very act of processing personal data is considered lawful interference with rights and freedoms. For this reason, the Bill sets out the legal parameters within which data can be processed in accordance with the law.
It allows too for the registration of data controllers and data processors who will be required to comply with the law or face hefty fines of up to $10 million or imprisonment.
However, data controllers and data processors will not be required to comply with certain provisions of the legislation when personal data is processed for the prevention, detection, or investigation of crime, the apprehension or prosecution of offenders, or the assessment or collection of any tax or duty.
These are exempted from the principle that data shall be processed fairly and lawfully, the provisions regarding the right of access to personal data, and the non-disclosure provisions.
The non-disclosure provisions are those provisions that prohibit the disclosure of personal data.
Personal data which are processed for special purposes such as journalism, artistic or literary purposes are also exempt from the data protection principles.
However, the exemption is only permissible where the publication is in the public’s interest.
Personal data processed only for research purposes are exempt where the data is not processed to support measures or decisions regarding particular individuals and the data are not processed in such a way that substantial distress is, or is likely to be, caused to any data subject.
A person who operates as a data controller or data processor without being registered commits an offence and is liable on summary conviction to a fine of $10 million or imprisonment for two months. That fine can increase to $20 million for a data controller or data processor who is not established in Guyana.
And a person who fails to collect and store data as specified commits an offence and is liable- (a) on summary conviction to a fine of not less than $5 million nor more than $50 million or to imprisonment for a term not exceeding two years; or (b) on conviction on indictment to a fine of not less than $20 million nor more than $100 million or to imprisonment for a term not exceeding five years.
Personal data shall not be transferred to a country or territory outside Guyana without good, agreed, or known reasons and must be protected with the appropriate safeguards.
The draft Bill can be accessed on the Attorney General and Ministry of Legal Affairs website www.mola.gov.gy.
