VPNs with servers in Guyana

Subscriber information must be kept from the start of the service and for ninety days after the agreement ends. Failure to comply is an offence carrying a fine of three million dollars and one year’s imprisonment. The Act defines a service provider as any public or private entity that lets users communicate by means of a computer system, or that processes or stores electronic data for such a service or its users (section 2).

A judge may order a service provider in Guyana to produce traffic data or subscriber information (section 31). Whether a VPN operator is a service provider under these sections is not established. In September 2024 the Attorney General announced a review of the Act, to address among other things the courts’ jurisdiction over cybercrime matters and who may serve documents.

Section 18 of the Act punishes intentionally publishing, transmitting or circulating by computer system a statement or other material that advocates the use of force, without authority of law, to change the government; incites treason or any offence against the President or a member of the Government; encourages joining a terrorist group or committing terrorist financing; or excites ethnic divisions or hostility against any class of persons on the ground of race.

The penalty is five years’ imprisonment on conviction on indictment. Section 18(4) provides that expressing disapprobation of the Government’s measures or administrative action, or pointing out errors or defects of the Government, Constitution or Parliament, is not an offence under the section.

Section 19 covers using a computer system to publish or transmit data that intimidates a person or threatens violence in order to compel an act or omission; to publish indecent or obscene data, or send it repeatedly, to humiliate or harass; and to disseminate information known to be false that damages a person’s reputation or subjects them to public ridicule, contempt, hatred or embarrassment.

Threatening to publish private information to extort a benefit is also an offence. Each is punished on summary conviction by a fine of five million dollars and three years’ imprisonment, or on indictment by ten million dollars and five years. An account is traced through the provider: a judge may order production of subscriber information or traffic data (section 31), and section 25 requires that data to be stored.

The Interception of Communications Act 2008 (Act No. 21 of 2008) makes intentional interception of a communication in transmission an offence, with a fine up to five million dollars and three years’ imprisonment, unless it is done under a judge’s warrant or on the authority of a designated officer in a national emergency or where seeking a warrant is impracticable given the urgency (section 3).

A judge may issue a warrant only if it is necessary in the interests of national security or to prevent or detect a scheduled offence, other investigative procedures have failed or are impracticable, and it serves the administration of justice. A warrant runs for up to ninety days and may be renewed for up to ninety days, then again for exceptional circumstances.

A 2019 amendment to the Act, passed in May 2019, added further exceptions to the offence; the Government’s information department reports that they include interception where there are reasonable grounds for believing that a party to the communication consents. The Cybercrime Act likewise routes extended storage, production and preservation orders through a judge. The order of the rows is the security score, and a server’s location is not a recommendation.