A Portal Before a Protector

A Portal Before a Protector

OPINION BY : Hem Kumar September 2026

Guyana’s all-online passport appointment system, which becomes the only way to apply from October 1, has been welcomed in a recent editorial as “a big and welcome step forward.” The editorial is right about the queues. It is silent about the law.

It lists the legal groundwork for the digital state: the Digital Identity Card Act, in full force since March 2026, and “legislation on data protection.” It does not say that the Data Protection Act, passed in August 2023 alongside the e-ID law, has never been shown to have been commenced. That omission carries the weight of the whole argument.

What the record shows

The Digital Identity Card Act was brought into operation by a commencement order from Prime Minister Mark Phillips, published in the Official Gazette on March 26 and effective March 31. Demerara Waves reported the same day that the Data Protection Act had not been so commenced. Attorney-at-law Brenden Glasford, writing in Sidebar Guyana, argued that the two laws are “intrinsically linked” and that failing to commence the Data Protection Act affects the legality of the Digital Identity Card Act.

The government has not disputed the linkage. It has conceded the gap. The Prime Minister said the state is working to establish the mechanisms to bring the Data Protection Act into full effect, and promised that private and personal data would be requested only once it is. Data Protection Commissioner Aneal Giddings, in a May 15 piece published by the Guyana Chronicle and Kaieteur News, wrote that the government “is working to establish the necessary mechanisms to bring the Data Protection Act into full effect.” In the same piece he wrote that Guyana has a Data Protection Act that is “the law of the land,” and that his office is still “in the process of formally establishing the Data Protection Office.”

Both statements cannot describe the same fully operating regime. An Act that is the law of the land yet not in full effect is an Act on paper.

A Commissioner without an office

To be fair, a Commissioner exists. The Prime Minister told the National Assembly he was appointed on January 2. But the Commissioner is also the administrator of the Digital Identity Registry and the exclusive issuer of the cards, by his own account.

The office that runs the system is the office offered as its independent overseer. Independence does not describe an official who is both operator and regulator.

Mr Giddings lists purpose limitation, data minimization, restrictions on automated decision-making and independent oversight as protections “built into the architecture of the act.” Every one is a provision of a statute he says is still being brought into effect. A citizen cannot enforce a right that exists only in un-commenced text.

Why this matters on October 1

The Attorney General’s assurance for the e-ID was that only basic data already held by the state would be collected until the Data Protection Act operates. That was the government’s own admission that collecting more, without the Act, would be unsafe. The passport system, and the integrated portal the editorial praises, is the point at which that standard must be shown to hold. The editorial itself imagines a single framework through which citizens reach passports, driver’s licences, registry documents and tax services.

Integration multiplies the harm when safeguards are missing. A single breach or misuse would expose everything at once.

The editorial warns citizens about fake websites and urges the government to keep security measures in step. It names no enforcement body, no audit, no penalty and no complaint route. The warning places the burden on the citizen, while the state’s duties go unmentioned.

Questions the state must answer

We put these to the Prime Minister’s office and to the Data Protection Commissioner, and we will publish the answers, or the silence.

1. Has a commencement order for the Data Protection Act been issued? If so, on what date, and where was it gazetted? If not, when will it be?
2. If the Act has not been commenced, under what statutory authority is the Commissioner acting?
3. Is the Data Protection Office established? Where is it, and how can a citizen contact it? Is there a phone number, a website and a complaint mechanism?
4. Who is the data controller for the passport appointment platform, and what data does it collect? How long is it retained, who can access it, and is any of it shared across agencies or with foreign governments?
5. Who audits access to this data, and what is a citizen’s remedy if it is misused or breached? Is there a duty to notify affected persons?
6. Where is the platform hosted, and under what contract with which vendor?
7. If the Act is not in force on October 1, what legal recourse does a citizen have?
8. How does the Commissioner reconcile administering the Registry with the independent oversight the Act promises?

The standard

We do not oppose digital services. We oppose the sequence. A protector should come before a portal. The editorial that celebrates the removal of a queue should have asked what stands behind the screen when a citizen surrenders identity data to the state.

Efficiency without recourse is not reform. Until the Act is shown to be in force and the Office is open, every applicant is trusting the state’s word alone.

Digital government must not become a system in which citizens are compelled to give up control over their personal data simply because essential public services have been placed online. A passport is not optional. If an online procedure becomes mandatory, the State bears an even higher duty to ensure that every applicant has legal protection, clear information and meaningful recourse.

The test of Guyana’s digital transformation is not whether government can compel citizens to use a website. The test is whether the State has built the institutions, laws, safeguards and accountability mechanisms that make digital services safe and trustworthy.

Until those safeguards are visibly and legally in place, the rush toward compulsory online public services risks becoming not modernization, but digitized vulnerability.