Papua New Guinea has opened public consultation on three bills that would establish legal foundations for data protection, cybersecurity, verifiable credentials and digital trust services across the country’s emerging digital identity ecosystem.
The consultation runs through August 19 and covers the Data Governance and Data Protection Bill, the Cybersecurity Bill and the Verifiable Credential and Trust Services Bill. Together, the proposals address the operation of SevisPass and SevisWallet, oversight of identity providers, biometric-data safeguards and age-assurance requirements for online platforms.
The draft data-protection legislation classifies biometric information for heightened protection. It would require a defined legal purpose or explicit consent for collection and use, restrict sale and sharing, require deletion in specified circumstances and call for encryption when biometric data is captured and stored. Organizations would also face data-protection impact-assessment and notification duties.
The bill proposes fines of up to one million kina, approximately $230,000, for businesses that breach certain requirements. It would initially place data-protection authority functions with the National Information and Communications Technology Authority, with the option of moving them to a future National Digital Economy Authority.
The Verifiable Credential and Trust Services Bill would give a statutory basis to Papua New Guinea’s TECH5-built identity platform and wallet, while allowing approved third-party wallets to participate. It also proposes a regulator, a technical standards committee and a sustainability fund supported by certain verification and platform fees.
A separate Cybersecurity Bill includes rules for age assurance on social media. A covered service would have to offer at least one method that does not require the user to submit a government identity document. The proposal also provides for a Child Online Safety Commissioner and addresses digital evidence and incident reporting.
The consultation builds on the rollout of SevisPass for the security sector and the later expansion of SevisWallet to more government credentials. The questions issued with the bills cover identity adoption, data residency, cross-border recognition, institutional oversight and alignment with international standards.
The three proposals place identity infrastructure, privacy rules and online verification within one legislative program. They give stakeholders an opportunity to comment on how biometric and credential data should be protected while the government expands wallet-based public services.
Sources: PNG DICT consultation notice, Draft Data Governance and Data Protection Bill, Draft Verifiable Credential and Trust Services Bill, Draft Cybersecurity Bill
–
By the ID Tech Editorial Team
