The Tribune

By KEILE CAMPBELL

Tribune Staff Reporter

kcampbell@tribunemedia.net

ONLY about 20 to 25 data breaches have been reported to the Office of the Data Protection Commissioner this year, but Commissioner Michael Wright believes the true number could be much higher because people do not realise they report the mishandling of their personal information to his office.

Mr Wright said people often complain directly to the business or organisation involved instead of taking the matter to the regulator, which has the power to investigate such complaints.

Speaking to the Rotary Club of West Nassau, he also raised concerns about weaknesses in the way organisations handle personal information, saying many lack clear privacy policies, rules governing how long data should be retained and clear definitions of consent.

He urged people to question why organisations request their personal information and to consider where that information is ultimately stored.

He warned that data could be kept outside The Bahamas or shared under permissions contained in privacy policies that users routinely accept without reading.

He said people should understand how their information is collected, processed, stored, shared and eventually deleted and should contact his office if they believe it has been compromised.

The commissioner described information held by the public sector as secure, saying a “robust security system” was in place.

He acknowledged that new applications and software could experience problems when introduced, but said deficiencies would be corrected if they were detected.

However, Mr Wright could not explain what changes had been made to address the government’s previous assertion that its Oracle system was prone to data leaks and breaches, saying he was not sufficiently familiar with the specific matter.

He said the government also planned to establish a national registry requiring businesses to disclose where their data-storage facilities were located, but gave no timetable for its introduction.

Mr Wright said Bahamians whose information was compromised while stored overseas could still lodge complaints locally. His office, he said, could work with foreign supervisory authorities during an investigation.

The discussion comes as the Data Protection Act, 2025, which Parliament passed to repeal and replace the Data Protection (Privacy of Personal Information) Act, 2003, remains listed on the government’s legislation portal as not yet in force.

Mr Wright also said legislation governing artificial intelligence was being drafted, although he gave no timetable for when it would be completed or introduced.

He said the government had appointed what he described as an “AI ambassador” to assess the country’s capacity and expertise in the sector, but did not identify the person.

A discussion platform is also expected to be created to allow people working in AI locally to contribute to the process. Mr Wright gave no timeline for that initiative.

He acknowledged that AI could displace some jobs but said the technology could also create entrepreneurial opportunities in areas including data storage, privacy impact assessments, data governance and cybersecurity.

Mr Wright said AI could improve efficiency, healthcare and problem-solving but warned of risks including unauthorised data collection, misinformation, excessive reliance on automated systems and reduced human judgement.

He also raised concerns about unclear responsibility when AI produces harmful or inaccurate outcomes and a lack of transparency in decisions involving the technology.

Organisations using AI, he said, should anonymise personal information before processing it and employ safeguards including encryption, multi-factor authentication, continuous monitoring and strict access controls.

He also called for limits on how long information is retained, documented procedures for responding to incidents and regular risk assessments.

“Many still consider such privacy concerns as limited to IT professionals,” Mr Wright said. “The area of privacy involves legal, ICT, and broad oversight.”

He identified University of The Bahamas students, Bahamians returning after studying abroad and people with relevant experience and certifications as part of the country’s potential AI and cybersecurity workforce, although he did not specify what training or certifications would be required to pursue those opportunities.

Asked about the government’s longstanding effort to digitise 200 public services, Mr Wright said the initiative was “well on the way”.

“They’re moving about as often as they can,” he said of the Digital Transformation Unit, “and they are transforming as best they can.”

Mr Wright estimated that more than 150 services had been digitised, possibly 151, but repeatedly qualified the figure as what he believed to be the case.