Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1698076615065.pdf (Guyana)
THE OFFICIAL GAZETTE 20th JANUARY, 2014 LEGAL SUPPLEMENT — B GUYANA No.

1 of 2014 REGULATIONS Made Under CREDIT REPORTING ACT Act No.

9 of 2010 IN THE EXERCISE OF THE POWERS CONFERRED UPON THE BANK BY SECTION 33 OF THE CREDIT REPORTING ACT, THE FOLLOWING REGULATIONS ARE MADE:- ARRANGEMENT OF REGULATIONS REGULATION 1.

2.

3.

4.

Citation.

Approval to transfer, store and keep data cross-border.

Adequacy of protection.

Security measures.

5. "

Notification of security breaches.

6.

Conflict in laws.


T HE OFFICIAL G A Z E T TE |LEGAL SUPPLEMENT] — B 20™ JANUARY, 2014 9 Citation 1.

These Regulations may be cited as the Credit Reporting (Cross Border Transfer and Storage of Credit Information) Regulations 2014.

Approval to transfer, store and keep data cross border.

2.

(1) A credit bureau shall not transfer and store outside of Guyana information collected under the Act except with the prior approval of the Bank.
(2) A credit bureau that transfers and stores information outside of Guyana in contravention of these Regulations commits an offence and is liable on summary conviction to a fine of not less than one million dollars and if the offence is a continuing one to a further fine not exceeding twenty- five thousand dollars for every day during which the offence is continued.
(3) A credit bureau may apply for approval under this regulation by submitting a request for approval to the Bank which shall include details o f- (a) name, address, ownership and management of the proposed storage facility; (b) the intended arrangements for the management and administration of the proposed storage facility; (c) the physical and service features of the proposed storage facility; (d) the proposed methods for transmission of the information into and out of the proposed storage facility; (e) the terms and conditions governing the credit bureau's use and storage of information at the proposed storage facility; (f) security measures which will be implemented to safeguard the information stored at the proposed storage facility; (g) the statutory and other legal requirements that shall govern the use and storage of information in the country of intended transfer; (h) the supervisory regime applicable to the use and storage of information in the country of intended transfer; 2 THE OFFICIAL GAZETTE |LEGAL SUPPLEMENT] — B 20™ JANUARY, 2014 9 (i) the arrangements proposed to enable the Bank to have access to the information stored by the credit bureau.
Adequacy of 3.

(1) Transfer of information collected under the Act to a location outside of Guyana for processing and storage may only take place if the conditions in these Regulations are met by the credit bureau and an adequate level of protection is afforded in the country of intended transfer.
(2) The adequacy of the level of protection afforded by the country of intended transfer shall be assessed in the light of all the circumstances surrounding a data transfer operation or set of data transfer operations, relevant legislation both general and sectoral in force in that country, security measures which are in place and the existence and effective functioning of a supervisory authority responsible for ensuring compliance with the data protection rules.
(3) In the event that the Bank finds that the country of intended transfer does not ensure an adequate level of protection within the meaning of this regulation, particularly where the relevant legislation, in force, both general and sectoral does not guarantee effective and enforceable rights including effective administrative and judicial redress for consumers whose information is being transferred, any transfer to that country of data acquired under the Act shall be prohibited.

Security measures.

4.
(1) The credit bureau shall remain accountable for the protection of the information even after transmission and shall take all reasonable measures to secure the integrity of the information including - (a) identifying all reasonably foreseeable internal and external risks associated with the transfer and storage of the information in a different country; (b) establishing and maintaining appropriate safeguards against the risks identified and establishing measures to monitor, control and mitigate these risks; (c) regularly verifying that the safeguards are effectively implemented; and 3 10 THE OFFICIAL G A Z E T TE [LEGAL SUPPLEMENT] — B 2 0th JANUARY, 2014 (d) ensuring that the safeguards are continually updated in response to new risks or deficiencies in previously implemented safeguards.
(2) The credit bureau shall ensure that its data retention policy is always in compliance with applicable legal requirements- of both the countries from and to which information is transferred.

Notification of security breaches.

5.

(1) Where there are reasonable grounds to believe that the information of a consumer has been accessed or acquired by an unauthorized person, the credit bureau shall, notify- (a) the Bank; and (b) the consumer.
(2) The notification referred to in sub- regulation (1) shall be made as soon as reasonably possible after the discovery of the breach, taking into account any measures legal or otherwise reasonably necessary to determine the scope of the compromise and to restore the integrity of the credit bureau's information system.

(3) The credit bureau may delay notification to the consumer if an appro- priate law enforcement agency or the Bank determines that notification will impede a criminal investigation.
(4) The notification to a consumer referred to in sub-regulation (1) must be in writing and communicated to the consumer in at least one of the following ways - (a) mailed to the consumer's last known physical or postal address; (b) sent by e-mail to the consumer's last known e-mail address; (c) placed in a prominent position on the website of the credit bureau; or (d) as may be directed by the Bank.
(5) A notification shall provide sufficient information to allow the consumer to take protective measures against any potential consequences of the breach, including if known to the credit bureau, the identity of the unauthorized person who may have accessed or acquired the information.
4 T HE O F F I C I AL G A Z E T TE [LEGAL SUPPLEMENT] B 2 0™ J A N U A R Y, 2 0 14 11 (6) The Bank may direct a credit bureau to publicise in any manner speci- fied the fact of any breach to the integrity and confidentiality of information, if the Bank has reasonable grounds to believe that the publicity would protect a consumer who may be affected by the breach.

Conflict in 6.
Conflict in 6.

In the case of conflict between the laws of Guyana and the laws of the country to which the information is transferred, the laws of Guyana shall prevail.

Made this day of January, 2014.

Lawrence T. Williams, Governor, Bank of Guyana.

5