Madam Speaker,
Today, as we debate the Data Protection Bill 2025, we are standing at a crossroads in human history. We live in an era of “big data.” Every second, billions of pieces of information are created, collected, analysed, and stored.
In the time it takes me to deliver this contribution, millions of transactions will occur, countless photographs will be uploaded, and terabytes of information will flow through the digital networks that now form the infrastructure of modern life.
For nations that master the responsible use of data, the rewards are immense. Economic growth, educational advancement, faster government services, more robust research, and smarter use of resources all require the effective and responsible use of data.
But for nations that fail to responsibly and effectively protect their data, the consequences are equally profound. Identity theft, financial fraud, espionage, erosion of trust, and exploitation abound.
This is what is at stake when we talk about data protection in the 21st century.
If we are to remain competitive, we must embrace digital transformation and the world of big data.
We live in an era where you either lead the way or you will end up being led.
This Bill ensures that The Bahamas will lead.
Madam Speaker,
Each and every day, our citizens provide a wide range of personal data on the internet and mobile networks.
Data collection begins as soon as they wake and reach for their phones.
When they unlock their devices using their fingerprints or their faces, they are sharing biometric data.
When they post online, their location is recorded. When they browse the internet, algorithms track their interests, beliefs, and opinions. When they shop online, their credit card information, purchasing habits, and browsing history are all captured and stored.
When our businesses operate, they collect data on employees, customers, and suppliers. When our hospitals treat patients, they create detailed medical records.
When our banks process transactions, they handle sensitive financial information. And when our government agencies provide services, they accumulate records on every citizen and resident.
Never before have so many people had so much of their personal information available to so many organisations. The scale is truly unprecedented, and there is no way to opt out.
Our data is inevitably collected and stored, analysed by algorithms, bought, and sold.
The inevitable provision of data by every citizen of this country makes data protection critically important.
Those who have had personal data compromised are aware of how disruptive it can be to their lives. The process of making police reports, replacing IDs and credit cards, or even waiting for money to be returned to bank accounts is beyond inconvenient.
And when data is compromised at an even larger scale, it can threaten major corporations and governments.
So, it is obviously in the best interest of everyone living or doing business in The Bahamas to have the best possible data protection framework in place.
Unfortunately, our current law was passed in 2003. It was groundbreaking at the time, but considering all the technological advancements since 2003, it is clearly past time for us to update our laws.
The Data Protection Act 2003 was written for a different world: a world without smartphones, tablets, cloud computing, AI, and biometric authentication on devices designed for daily use.
None of those technologies that collect data from us on a regular basis were available for widespread consumer use at the time.
The Data Protection Bill before us today reflects the outcome of broad public consultations and meaningful engagement with key stakeholders, including the Chamber of Commerce and the Bar Association. Guided by the Office of the Data Commissioner, we also considered additional submissions and recommendations that came in after the Bill was first laid. In response, we have advanced to debate and moved the Bill into committee for further refinement, ensuring that it truly reflects the views and best interests of the Bahamian people.
This is why the Data Protection Bill 2025 has been designed to be comprehensive and aligned with international best practices.
This Bill repeals and replaces the outdated 2003 Act and establishes transitional provisions, giving organisations time to comply before full enforcement begins.
It also ensures that government agencies must meet the same standards as private entities.
There is one high standard established for everyone to follow.
This Bill is built on core principles that govern all data handling, including lawfulness, fairness, and transparency in how data is collected. Purpose limitations apply, which means ensuring data is used only for the reasons given; data minimisation standards are in place, which means collecting only what is necessary; and modern data accuracy, storage limitations, and security standards are also being introduced.
For data to be lawfully collected and processed, it must meet one of a number of lawful conditions, including consent, contract necessity, legal obligation, the protection of vital interests, being a necessity of a public body or public interest function, being necessary for the protection of fundamental rights or the administration of justice, or other areas where the processing of data is deemed necessary and justifiable.
Madam Speaker,
The Data Protection Bill grants powerful rights to individuals. Under this Bill, individuals have the right to know what information is being held and how it is used.
They have the right to correct inaccurate information, as well as the right to have data erased when it is no longer needed. This Bill includes the right to restrict or object to certain uses, the right to stop processing that causes harm, the right to seek compensation when data is mishandled, and the right to file complaints with an independent regulator.
Special protection applies to sensitive personal data, such as information about race or eth-nicity, political views, religious beliefs, trade union membership, genetic or biometric identifiers, sexual orientation, health records, financial information, and criminal history.
This information can only be processed under strict conditions.
To oversee the implementation and enforcement of this new data protection regime, this Bill strengthens the Office of the Data Protection Commissioner. This office will be properly resourced, staffed, and empowered to do its job.
Every person or organisation that handles personal data, whether public or private, must register as either a Data Controller or a Data Processor with the Office of the Data Protection Commissioner.
Anyone can file a complaint with the Commissioner to address any issue with data protection or legal infringements.
There is also the option to appeal any decisions made by the Commissioner to a Data Protection Appeal Tribunal.
Madam Speaker,
The Data Protection Bill also regulates international data transfers, ensuring that when information about Bahamians travels out of our borders, it remains protected.
It establishes clear rules for consent, requiring that permission be freely given, specific, informed, and unambiguous. Consent can also be withdrawn after it has initially been given.
This Bill provides for enforcement, with meaningful penalties for violations, including fines and imprisonment for serious breaches.
It also sets standards for direct marketing, protecting citizens from unwanted communications while allowing legitimate business activity.
Under this Bill, the government must lead by example. All public agencies must register as data controllers. Each agency must also appoint Data Protection Officers to manage compliance. They must implement appropriate security measures, and they must respect citizens’ rights to access, correct, and control their information.
The Data Protection Commissioner will have the authority to review government practices, investigate complaints against public agencies, and require corrective action.
For ministries developing e-government services, digital identification systems, and online service delivery, the Bill provides clear standards.
When citizens interact with the government di-gi-tally, they need confidence that their information is secure. When the Road Traffic Department digitises records, when National Insurance modernises systems, when Immigration implements new technologies, these efforts must be built on a foundation of data protection.
This Bill will ensure that the government has enhanced public trust as a result of these new standards.
Madam Speaker,
This Bill has specific implications for the healthcare industry.
For example, consent must be explicitly given for sharing medical data or using medical data for research, and any data breaches can result in significant penalties. Patients’ records will receive the highest levels of protections, which further strengthen trust in our ability to expand in areas like telemedicine.
Madam Speaker,
The private sector must fully comply with these standards as well.
All businesses will be required to obtain proper consent before collecting or using personal data. They must also implement security measures to protect information and report breaches when they occur.
Financial services, telecommunications, retail, hospitality, marketing, and insurance companies – all industries where data is collected – must demonstrate their ability to meet strict standards for how they collect, use, and protect data.
This is good for business.
Many overseas customers and partners require their service providers to meet General Data Protection Regulation-equivalent standards.
This Bill puts Bahamian companies in that category. It opens doors to markets and opportunities that would otherwise be closed.
Madam Speaker,
Data privacy and protection have become a global investment standard. International banks, multinational corporations, and technology platforms evaluate jurisdictions based on their data protection frameworks. Savvy investors are now examining a country’s data protection laws to ensure they are investing in a nation that takes the protection of business ventures seriously in this digital era. This Bill establishes a high standard that will be welcomed by the business community.
When this Bill becomes law, multinational firms and investors can confidently transfer data to and from The Bahamas, knowing that information will be protected according to international standards.
We are signalling to the world that The Bahamas is modern, transparent, compliant, and serious about protecting information.
We are ensuring that Bahamian entrepreneurs and investors can compete on equal terms with their counterparts anywhere in the world.
Madam Speaker,
Any discussion of data protection must address the relationship between privacy and freedom of expression. This Bill strikes that balance carefully.
Journalists investigating matters of public interest need access to information. Academic researchers studying social phenomena require data. And civil society organisations advocating for vulnerable populations need to document their work.
This Bill protects privacy while preserving legitimate journalism and research. Specific exemptions exist when data processing serves a genuine public interest, advances knowledge, or creates meaningful art.
These exemptions are not unlimited. They require that the processing be proportionate and necessary. But they recognise that privacy rights must coexist with other fundamental freedoms.
The benefit of maintaining this balance is a society where privacy is respected without stifling the free exchange of ideas, the pursuit of truth, or the creation of art.
Other areas where some exemptions may apply include law enforcement and criminal justice, taxation, regulatory activities, research, and correctional services, among others.
This Bill also makes special provision for those who are most vulnerable: our children, elders, and those who may not always be able to protect themselves. We recognise the fact that some people deserve extra protection to prevent exploitation.
Madam Speaker,
This will be a significant transition for our nation. Organisations will need time to comply, the government will need time to build capacity, and the public will need to be educated.
We are committed to a phased implementation that gives all stakeholders the time and support they need.
At the end of this comprehensive process, The Bahamas will be a jurisdiction where data is protected, privacy is respected, and digital entrepreneurs can flourish with full knowledge that we take the protection of their enterprises seriously.
Madam Speaker,
Let the record reflect the fact that in this era of big data, The Bahamas has positioned itself to be ready to take on future challenges and opportunities.
We’ve benchmarked this Bill against the top regional and international jurisdictions and we are satisfied that, thanks to the hard work of the Office of the Data Protection Commissioner and all others who contributed to the development of this Bill, we have produced yet another region leading legal framework that positions us for success in the same way that the 2003 Bill provided a strong foundation at the time.
The Data Protection Bill 2025 provides a modern, transformative framework that will help our nation to thrive in the 21st century, one that Cat Island, Rum Cay, and San Salvador stands in full support of.
Thank you, Madam Speaker.