GIVEN the importance of data in the technological era, the Data Protection Act is a key piece of legislation to prevent its misuse or theft. It aims to protect the personal data of Guyanese.

The Attorney General’s Chambers has emphasised the importance of data protection in Guyana’s digital economy development and the need for a legal framework.

Sunday’s episode of ‘Simplifying the Law’ featured contributions from Joann Bond, the Deputy Chief Parliamentary Counsel at the Ministry of Legal Affairs, and Ismat Bacchus, a State Counsel, who provided insights into the provisions of the act.

Pursuant to the legislation, personal data encompasses any information that can be utilised to discern the identity of an individual. This can include data such as a person’s name, address, or identification number.

It provides that personal data must be processed lawfully, fairly, and in a transparent manner, and only collected for specified, explicit, and legitimate purposes. Moreover, this data must be accurate, kept up to date, and processed in a manner that ensures appropriate security.

According to the Deputy Chief Parliamentary Counsel, the act safeguards the human right to privacy and autonomy, and creates the enabling environment for development.

She pointed out, “Once you have good legislation, investors would want to invest in your jurisdiction, because data is always being shared, particularly across borders. So, one of the important things for investors is ensuring that their data is secured…..”

While upholding an individual’s right to privacy and autonomy, the Data Protection Act also provides for exceptions to avoid infringing on other basic rights, such as access to information and freedom of expression.

Passage of the data protection legislation also allowed for the implementation of other pieces of legislation to facilitate the digital transition, such as the Planning and Development Single Window System Act, and the Electronic Communications and Transactions Act.

It identifies the key players in the data processing operation: the data controller, the data processor, and, in the enforcement aspect, the data protection commissioner.

Counsel Bond outlined that the data controller has the overall responsibility for the processing of the personal data, while the data processor is any person or group that processes the personal data on behalf of the controller.

In the enforcement aspect, the data protection office is the independent supervisory body for the law, and the data protection commissioner has extensive powers, such as investigating complaints from persons concerning abuses in the processing of personal data.

Meanwhile, State Counsel Bacchus noted that, while the act covers an extensive assortment of personal data, there are several exemptions.

“Not all of the provisions under the act would apply to all types of data. In the case of data being collected by law enforcement, or the Guyana Revenue Authority, for example, that is data that is being collected to calculate tax or in the interest of national security, so under the act, this type of data is exempt from what we call the disclosure requirements, meaning that, when being collected, this type of data doesn’t have to be disclosed to the data subject,” she said.

Disclosure requirements are applicable in many cases, except in the case of data that is collected for domestic or personal use, or data that is covered by either a legal professional privilege, such as attorney-client privilege.

She emphasised that consent for data processing is only required in the absence of a legal basis for processing the data.

“There are certain pieces of legislation that require certain data to be processed, so the data controller and the data processor would have to comply with these acts, so they wouldn’t require consent to go ahead and start that processing. However, if, for example, they intend to use that data in some way that would cause the data subject to suffer some form of intrusive aspect of their data being shared, then they would require consent,” she explained.

Along this vein, she added that the rights of the data subjects within the confines of the law are also enshrined in the legislation.

“If the data controller or the data processor’s actions harm the data subject in some way, then the data subject is entitled to compensation. Section 97 (1) states that any person who suffers damage or distress as a result of some sort of contravention to the act by a data controller or data processor, is entitled to some kind of compensation from that data controller or processor. So, persons shouldn’t be worried that they are left without a claim,” she relayed.

The duo made it clear that there are several systems that must be put in place to facilitate full implementation of the act, such as the appointment of a data protection commissioner. However, once implemented, the provisions of the act will effectively regulate the collection, keeping, processing, use, and dissemination of personal data.