DATA Protection Commissioner Aneal Giddings has sought to reassure the public that safeguards are in place to protect citizens’ personal information under Guyana’s emerging digital identification system.
In a letter responding to concerns raised by a citizen in the May 13 edition of the Kaieteur News, Giddings said Guyana already has a Data Protection Act in force and that work is actively underway to formally establish the Data Protection Office.
According to the official, the legislation sets out clear rules governing how personal information may be collected, stored and shared, while also granting citizens’ rights over their data, including the right to know what information is being held about them and to request corrections or deletions.
He noted that concerns surrounding the collection of sensitive information through digital systems, including medical, financial and identification records, are among the very issues the legislation was designed to address.
“The Digital Identity Card Act itself mandates several preconditions before the system could be launched, and among those preconditions is the appointment of a Data Protection Commissioner. The Digital Identity Card Act did not sidestep data protection — it required it. A Data Protection Commissioner had to be appointed before the Act could come into force. That was not optional, and that condition has been met,” Giddings wrote.
Giddings further stressed that both government agencies and private contractors handling public data are legally bound by the Act’s provisions and cannot avoid accountability simply because they operate as third-party service providers.
Addressing concerns that the Digital Identity Card Act of 2023 became operational before the Data Protection Act was fully implemented, the Commissioner said the two laws were deliberately passed together as “companion laws” and were intended to function alongside each other.
He pointed out that the Digital Identity Card Act specifically required the appointment of a Data Protection Commissioner before the system could come into force, describing this as a built-in safeguard within the legislation.
The Commissioner also clarified that the Digital Identity Card Registry falls directly under the administration of his office, making the Data Protection Commissioner responsible for both issuing the cards and overseeing the protection of data collected through the system.
Giddings said only basic personal information already held by state agencies, including the Guyana Elections Commission (GECOM), the Guyana Revenue Authority (GRA), and the National Insurance Scheme (NIS), is currently being used as part of the enrolment process.
He added that no tax, health or financial records are presently stored on the digital ID cards themselves.
On the technical side, Giddings said the cards were designed to meet international ICAO biometric security standards and contain anti-forgery protections, including laser-engraved polycarbonate material and PKI-enabled authentication features.
At the same time, the Commissioner acknowledged broader fears surrounding political profiling, surveillance and commercial misuse of personal data, saying such concerns were “not paranoid” given international examples of governments and corporations misusing data on a large scale.
He maintained, however, that protections against such abuses are built into the framework of the legislation through provisions including purpose limitation, data minimisation, and independent oversight mechanisms.
“What I would say to any citizen who has hesitated to apply for their digital ID card because
of concerns about data protection, the system you are interacting with when you go to a
regional enrolment office is one administered by this office, built to international security
standards, limited in its current data collection to what the state already holds about you,
and structured by two laws that Parliament passed with broad support precisely because
they were designed to work together,” he said.
He added that Guyana’s digital future is ultimately being built on “trust, transparency, accountability and genuine institutional capacity”.
