GuyanaData Protection Act 2023, the Commissioner, enforcement and offences
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
As of .
What it requires
- Once the Data Protection Act 2023 is commenced, comply with an enforcement notice, information notice or special information notice the Commissioner serves, and make no statement you know to be false, or recklessly make one that is false, in answering an information notice.
- Compensate a person who suffers damage or distress from your contravention of the Act, unless you show that you took all measures reasonably required to comply.
- Do not knowingly or recklessly obtain or disclose personal data, or procure its disclosure, without the data controller's consent, and do not sell or offer to sell personal data obtained that way, unless a section 98(2) defense applies.
- Comply with the notification of register changes, records of processing, security, breach notification, impact assessment, prior consultation and data protection officer duties in sections 53(1), 59(1) and 62 to 69, which the Commissioner may enforce, after a hearing, by an administrative penalty of up to ten million dollars.
These lines are LexLint's reading of the law's text, as of .
What this law does
Section 72 provides that the President appoints a Data Protection Commissioner. Section 73 makes monitoring and enforcing the application of the Act the Commissioner's first function. Section 78 lets the Commissioner serve an enforcement notice on a data controller or data processor that has contravened the Act.
Section 85 makes failing to comply with an enforcement, information or special information notice an offence liable on summary conviction to a fine of one million dollars or imprisonment for three months.
Section 4(10) makes failing to comply with the section 4(1) principles an offence, liable on summary conviction to a fine of five million to fifty million dollars or imprisonment for up to two years, and on indictment to a fine of twenty million to one hundred million dollars or imprisonment for up to five years. Section 97 entitles a person who suffers damage or distress from a contravention to compensation from the controller or processor.
Section 99 lets the Commissioner, after a hearing, order an administrative penalty of up to ten million dollars for contravening sections 53(1), 59(1) and 62 to 69. Section 1 provides that the Act comes into operation on the day the Minister appoints by order, and that different days may be appointed for different provisions. The Act was gazetted on following passage on . No commencement order has been located.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.