EBC says there was no data breach

The Electoral and Boundaries Commission (EBC) says the publishing of the list of voters is required by law and it has no knowledge of that information being used to commit fraud.

The EBC, which oversees elections in Barbados, was responding to claims made by “social media commentator” Niel Harper on one of his social pages.

Harper is a board member of ISACA and also served in various capacities at United Nations agencies, African Union, European Commission, CARICOM Secretariat, Deloitte and CIBC. He has a degree in Internet Law & Policy and is certified in privacy, IT auditing, cybersecurity and business continuity management.

He alleged that in a recent call with a professional colleague who works in security and threat intelligence for credit card issuing banks, that Nigerians and other fraudsters “have been employing the leaked Barbados electoral list to perpetrate identity theft and fraud across the world.

Niel Harper believes the EBC set a dangerous precedent by electronically publishing the voters’ list. (GP)

“Credit cards owned by Bajans are now being blocked from many transactions by banking institutions in Europe, North America, and other regions due to the increase in fraud using Bajan identities”.

Harper said he also drew this to the attention of the EBC last year “but they totally ignored me and downplayed a major data breach”.

The EBC addressed those concerns in the following points and said there no reports of card fraud before the Anti-fraud Committee of the Bankers Association of Barbados or the Central Bank of Barbados

This publication, whether in physical/hard or electronic copy does not constitute a data breach under the Data Protection Act 2019 (DPA) because it is a publication that is being done pursuant to a legal obligation. Section 37 of the DPA exempts such personal data from the parameters of the DPA, since although it is personal data, it is personal data that is legally available to the public.

Therefore, under the DPA, the publication of the Register of Electors does not constitute a data breach. It should also be noted that the Barbados Representation of the People Act Chapter 12 does not vary substantially from the legislation in the region in terms of the requirements to publish certain personal data. In fact, Guyana, Trinidad and Tobago and Antigua and Barbuda all have their Register of Electors posted online.

Secondly, the Electoral and Boundaries Commission has no reports, no knowledge and certainly no evidence of any theft of the identities of Barbadians. Furthermore, the Commission has no reports, knowledge and/or evidence of the theft of the identities of Barbadians due in any part to the previous publishing the Register of Electors.

Thirdly, relative to our efforts to safeguard the identities of our citizens, it must be underscored that it was not very difficult to reproduce the old paper and laminated ID card; therefore, there were multiple incidents of persons substituting the photograph, along with other means, to fraudulently present the old ID card.

As a result, and in the interest of keeping our citizens’ identities as safe as possible, the ID card has been changed. A significantly more secure ID card, which has a chip is being issued, and registrants have an option to also employ a PIN on this new Trident ID card, in keeping with some of the latest technological security features for cards.

This new card, the Trident ID card displays ONLY what was previously displayed on the old ID card but additionally, the chip carries the address, issue date, place of birth, residential status, the voting status and for minors, the parent/guardianship information. This additional information cannot be accessed without the entering of the registrant’s PIN; therefore, the registrant is completely in control of who has access to this additional information. Among other benefits, giving access to the address on the chip will allow the registrant to conveniently provide a government validated proof of address without having to produce utility bills in his/her name. This is a significant benefit to persons who do not have utility bills in their name.

The EBC said “recently there has been much misinformation and allegations around the security of the Trident ID card, security of the registration information captured and stored by the Electoral and Boundaries Commission and data breaches regarding the electronic publication of the Register of Electors”, but the body remained committed to securing of the data and information of every Barbadian resident (PR/SAT)


Leave a Reply