Tag: Privacy

Because Instant Matters: A Roadmap for BiMPay’s Success in Barbados

nielharper

Introduction

On June 12, 2026, the Central Bank of Barbados (CBB) will launch BiMPay, a national Instant Payment System (IPS). While the Caribbean has seen high-profile struggles with Central Bank Digital Currencies (CBDCs), specifically the Bahamas’ Sand Dollar, Jamaica’s JAM-DEX, and the Eastern Caribbean’s DCash, BiMPay arrives with a different structural approach.

BiMPay is not a new currency; it is a payment platform designed to facilitate 24/7/365 transactions between existing banks and digital wallets. However, because BiMPay utilizes digital wallets to reach the unbanked, it faces the same “adoption wall” that stalled its regional neighbors. To ensure BiMPay becomes a fixture of daily life rather than a technical footnote, the Government of Barbados must learn from the failures of the prior wave of digital currencies.

Bridging the Gap: Make It Better Than Cash

The regional landscape is a graveyard of “technically sound” projects that failed to reach critical mass.

  • The “Utility Conundrum” (Sand Dollar & JAM-DEX): In the Bahamas and Jamaica, users often asked, “Why do I need this?” If it takes longer to operate the app than to hand over a $10 bill, cash remains king.
  • The “Merchant Friction” (DCash): Merchants were often treated as an afterthought, forced to adopt new hardware or navigate complex settlement delays.
  • The “Trust Deficit”: In several jurisdictions, citizens feared government surveillance of their transactions, leading to a wait and see approach that effectively killed momentum.

BiMPay must solve a burning problem for the average citizen. This means moving away from abstract goals like “financial inclusion” and focusing on Instant Settlement, the ability for a street vendor or a ZR driver to receive funds and use them to buy supplies ten seconds later.

Solve the “Merchant Friction” Problem

In Jamaica and the Eastern Caribbean, adoption was crippled because merchants were slow to join. Businesses were often required to invest in new Point of Sale (POS) hardware without clear incentives.

Recommendations:

  • Lower Barriers to Entry: BiMPay’s use of QR codes and aliases (like phone numbers) is a strong start, as it eliminates the need for expensive card readers.
  • Address Cash Flow Directly: The government must highlight BiMPay’s Instant Settlement as its primary selling point for small businesses. In a cash-based economy, a vendor who can access their funds in 10 seconds rather than waiting for a bank clearing cycle has a massive competitive advantage.

Enforce “Radical Interoperability”

DCash suffered when commercial banks were slow to integrate, creating “walled gardens” where users couldn’t send money across different institutions.

Recommendations:

  • Mandatory Participation: The Central Bank of Barbados (CBB) has already taken the vital step of making BiMPay a foundational rail that integrates with all banks and existing digital wallets.
  • Level the Playing Field: The government must ensure that smaller fintechs and credit unions can offer services on par with larger commercial banks. This competition will lower costs for the end-user and drive innovation in the digital wallet space.

Build Trust in the Platform

Previous initiatives often mistook a lack of adoption for a “natural disinterest” in digital tools. In reality, users were simply worried about security, privacy, and resilience.

Recommendations:

  • Be Transparent About Privacy: Explicitly detail what data is collected and why. Following the lessons of the Sand Dollar, the government should clarify why certain tiers of wallets require identification while others do not.
  • Showcase Security: BiMPay uses multi-factor authentication (MFA) and real-time fraud detection. Educational campaigns should not just say the system is “secure,” they should demonstrate how these features protect the user’s money.
  • Redundancy & Resilience: To prevent a prolonged outage like DCash (54 days), BiMPay must implement an active-active infrastructure across geographically dispersed data centers to provide real-time failover, and network diversification through multiple telecom providers to mitigate localized disruptions. Furthermore, BiMPay should incorporate offline payment capabilities to maintain transaction continuity during Internet or power outages. Regular, mandatory failover testing and continuous health monitoring across all participating financial institutions are essential to maintaining operational resilience.

The WeChat/Grab Model: Building a “Super App” Ecosystem

The most successful peer-to-peer (P2P) platforms, like China’s WeChat and Southeast Asia’s Grab, succeeded because they became “lifestyle companions.” They didn’t just move money; they integrated daily necessities.

  • Social Integration: WeChat succeeded because it integrated payments directly into the messaging app people were already using. BiMPay must ensure that sending money is as easy as sending a WhatsApp message.
  • The “Network Effect”: The government must incentivize anchor institutions such as utilities, supermarkets, and gas stations to offer BiMPay-exclusive discounts or loyalty rewards.
  • In-App Ecosystem Mini Programs: BiMPay should open its API to allow local businesses to build mini-programs directly into the BiMPay wallet environment. For example, a user could open the BiMPay app, order food from Chefette or another local restaurant, buy a ticket to a Crop Over event, or pay for a taxi, and complete the entire transaction securely via the built-in payment rail without ever leaving the ecosystem.
  • Alternative Credit Scoring: Many unbanked Barbadians struggle to secure financing because they lack a formal credit history. BiMPay could safely aggregate user transaction histories (with strict user consent and privacy controls overseen by the Data Protection Commissioner) to allow local credit unions or fintech lenders to offer micro-loans or flexible insurance policies directly inside the app, based on the user’s real digital footprint rather than rigid banking metrics.
  • Peer-to-Peer Group Splitting and Local Gifting: BiMPay should feature a highly intuitive peer-to-peer (P2P) tool that allows users to seamlessly split dinner bills, crowdsource funding (local version of GoFundMe), or tip local musicians and hospitality workers seamlessly.

Strategic Integration: The Bridge to PayPal, Google, and Apple

For a tourism-dependent economy like Barbados, isolation is the enemy of growth. While BiMPay is a domestic solution, its long-term success depends on its ability to talk to the world.

Why Global Integration Matters:

  • Tourism Friction: A tourist from New York or London shouldn’t have to download a “Barbados-only” app. Future integration with Google Pay and Apple Pay via the BiMPay rail would allow visitors to spend seamlessly at local vendors who currently can’t afford expensive merchant terminals.
  • The Remittance Lifeline: Integration with PayPal would revolutionize how the Barbadian diaspora sends money home. By allowing a PayPal transfer to settle instantly into a BiMPay wallet, the government removes the predatory fees and multi-day delays of traditional remittance services.

Tactical Recommendations for the Government of Barbados

To avoid the fate of the Sand Dollar, the Government must execute on five specific pillars:

Use “G2P” as the Adoption Engine

The government is the nation’s largest payor. To drive adoption, all Government-to-Person (G2P) payments, including pensions, welfare, tax refunds, and student grants, should be defaulted to BiMPay wallets. When 50,000 citizens have “digital money” in their pockets on the first of the month, merchants will be forced to accept it.

Mandate Interoperability

The Central Bank must ensure that the BiMPay Interoperability Hub is truly open. No bank should be allowed to close off its customers. A user with a wallet from a small credit union must be able to send money to a user at a large commercial bank with zero friction.

Zero-Cost Merchant Onboarding

The government should subsidize the “last mile” for small businesses. This includes providing free QR code signage and ensuring that the merchant transaction fees for BiMPay are significantly lower than traditional credit card fees (which can reach 3-5% in the region).

Allow Users to Quickly and Conveniently “Cash Out”

Users must not be locked into a digital ecosystem without access to traditional cash. BiMPay should allow users to get physical cash back at any merchant location, reducing dependency on automated teller machines (ATMs).

Privacy-First Communication

Transparency is the only cure for skepticism. The government must effectively communicate that BiMPay uses Multi-Factor Authentication (MFA) and that, while the system is audited for fraud, it is not a tool for granular government surveillance of lawful private spending.

Conclusion: Beyond 12 June 2026

BiMPay has the potential to be the most significant upgrade to the Barbadian economy since independence. However, as the failures of the Sand Dollar and DCash have shown, “if you build it, they will come” does not apply to digital finance.

The Government of Barbados must act as an ecosystem curator, not just a software deployer. By focusing on merchant instant-settlement, mandating bank interoperability, and building a roadmap for integration with global giants like Apple, Google and PayPal, Barbados can turn BiMPay from a local project into a global standard for digital excellence.

In the digital age, Instant Matters. And not just for convenience, but for the very survival of the Caribbean economy.

Cybersecurity & Data Privacy Virtual Summit 2026 

nielharper

It was my esteemed pleasure to have participated in the Cybersecurity & Data Privacy Virtual Summit 2026 these past 4 days.

I shared the “virtual floor” in 2 sessions with Dr. Bright Gameli Mawudor and Godphey Sterling and we discussed the various elements of a successful response to a cybersecurity breach, specifically looking at the Technical Response to neutralize the threat and a Strategic Response to manage business operations, legal obligations, and reputation damage.

We also touched on several topics of critical importance to cyber capacity building in the Global South (e.g., national cybersecurity strategy, CSIRTs, critical infrastructure protection, security awareness, privacy, public sector security standards, supply chain risk management, open-source as an alternative for cost containment, security in emerging technologies, international cooperation, etc.).

Kudos to the other amazing professionals who delivered top-tier presentations and deep knowledge sharing with the captive audience: Grace Lindo, Jason Lau, Rory Ebanks, Greg Richards, Kellye-Rae Campbell, Ann Cavoukian, Karnika Seth, Rosalind Lake, and Deborah Hileman.

Special thanks to Douglas Davidson for the invitation to impart my knowledge and experience and to Andrea Chisholm Anglin for her expert hosting of the event.

The Current Debate on the UK Digital ID (“BritCard”) is Misleading – Here’s Why!

nielharper

The current negative debate about the BritCard is misleading because it largely relies on outdated assumptions about technology and centralization, ignoring the fundamental privacy safeguards that several countries have proven work effectively. The central flaw in the critical narrative is that it assumes a 21st-century digital ID is equivalent to the 1950s physical paper card or a single, insecure database. As with any technology, there are pros and cons to digital ID, but to act like it is mass surveillance or gratuitous privacy violating is just wrong. What’s even more concerning to me is that a lot of the misinformation is being peddled by “privacy experts”.

Data protection legislation and digital identity legislation have been coupled together in many countries to establish standards for security, user consent, data protection, and independent regulation. Moreover, privacy and security controls like zero knowledge protocol, unique ID verification, secure storage, data minimization, decentralized data exchange, and biometric safeguards, among others are employed to protect the privacy of individuals.

I have digital IDs for Denmark, Estonia, and Germany, and they are nothing like what these negative arguments suggest. Other progressive countries like Singapore, Belgium, Austria, Sweden, Canada, Australia, Poland, Netherlands, and the UAE all have digital ID systems. They facilitate streamlined access to services, increased efficiency, financial inclusion, reduced fraud, and enhanced security. Regarding privacy, they actually allow for contextual data sharing, which privacy experts have asked for repeatedly.

NOTE: The proposed central use case for the BritCard of combating illegal immigration is ill conceived and distorts the debate around the pros and cons of digital ID.

AuditBoard names 25 CISOs to watch in 2025

nielharper

In the rapidly evolving landscape of cybersecurity, innovative Chief Information Security Officers (CISOs) play a pivotal role in safeguarding organizations against AI-driven threats, ransomware attacks, and supply chain vulnerabilities. To acknowledge and applaud those leading the charge in tackling these challenges, AuditBoard has carefully chosen 25 CISOs who exemplify a dedication to enhancing cyber risk defenses and sharing their insights with the information security (infosec) community.

This curated list showcases the industry’s most resilient and forward-thinking cybersecurity experts. The 2025 selection highlights individuals who are at the forefront of navigating the ever-changing digital risk landscape, demonstrating resilience and innovation in their approach to cybersecurity leadership.

Thank you AuditBoard for your recognition alongside these amazing industry titans!

Each of these individuals has made a significant contribution to the profession, to industry, and to the organizations they work for. Massive respect goes out to each of them!

He Said Security / She Said Privacy Podcast – ISACA 2025 State of Privacy Survey Findings

nielharper

I thoroughly enjoyed tag teaming with Safia Kazi to discuss the key findings of the ISACA State of Privacy Survey with Jodi Daniels and Justin Daniels on the ‘He Said Security / She Said Privacy’ podcast.

We touched on some important topics such as:

  • How companies are handling privacy staffing shortages
  • The growing demand for technical privacy expertise and how privacy pros can adapt
  • AI’s role in transforming privacy operations and its risks
  • The impact of shrinking privacy budgets
  • How board-level buy-in impacts company-wide privacy programs
  • Why privacy by design remains a challenge for many organizations
  • Safia’s and my personal privacy tips

Check out the podcast and let us know what you think!

Security Magazine Top Cybersecurity Leaders for 2025

nielharper

I would like to express my sincere gratitude to Security Magazine for recognizing me as one of the Top Cybersecurity Leaders for 2025.

I have always been a fan of Security Magazine and their laser focus on providing information and solutions on risk management, cybersecurity, physical security & safety, and other related industry trends. So this recognition from them is particularly appreciated.

Heartiest congratulations to my good friend Jason Lau and the other awardees Anmol Agarwal, Jay Gonzales, Sandra Cavazos, and David Baker – Your commitment to digital trust and your service to the profession are mighty!

Many thanks as well go out to the amazing teams I have led at INTERPOL, Doodle, and other companies. You are the real champions!

New ISACA Research: 63 Percent of Privacy Professionals Find Their Jobs More Stressful Now Than Five Years Ago

nielharper

The ISACA State of Privacy 2025 survey report, which gathered responses from over 1,600 privacy professionals globally, revealed that 63% of these professionals find their roles more stressful than they were five years ago, with 34% reporting a significant increase in stress levels. The primary sources of stress identified in the survey were the rapid pace of technological advancements (63%), difficulties with compliance (61%), and a lack of resources (59%).

“In an increasingly complex international regulatory environment, often with lacklustre resources, it is understandable that many privacy professionals are feeling strain from their efforts to stay compliant and keep their organizations’ data safe. Addressing these challenges and getting practitioners the support they need will be vital to not only ensure a healthy privacy workforce, but also to maintain data integrity and security, and avoid potential harm to data subjects.” I made these comments via BusinessWire on the report to emphasize not only the challenges associated with implementing privacy programs, but also the importance of organizations demonstrating their commitment to data governance, data ethics, privacy rights, and overall digital trust.

With AI, the privacy landscape has changed dramatically, including the regulatory burdens for companies. Continued leadership in the boardroom, at the executive level, as well as embedding privacy principles in organizational values is integral to nurturing the trust relationship between enterprises, their customers, and society at large.

Human Resources and Cybersecurity (The Dynamic Duo)

nielharper

The human resources (HR) function has become integral to cyber risk management in recent years.

In this CYBER CONNECT podcast, my amazing colleague Jessie Lajoie (Chief of People Ops & Culture) and I discuss how we effectively model our organizational value of collaboration towards achieving the optimal security culture at Doodle.

Our ongoing cooperation spans across the areas of identity and access management (IAM), incident response, security awareness training, data governance, asset management, privacy compliance, and third-party risk management (TPRM), among others.

You can view the full session on YouTube!

AI Under Control: Protecting Your Business from Emerging AI Risks

nielharper

Earlier today, I participated in a panel discussion hosted by Baruch College (City University of New York) titled, ‘AI Under Control: Protecting Your Business from Emerging AI Risks.’

Our exchanges touched on critical challenges in evaluating AI system risks, adversarial attacks, data privacy, and bias in AI models, among other challenges. We also shared practical controls for ensuring AI fairness, governance, and security, along with risk mitigation strategies. The overall focus was on offering the attendees practical solutions to managing AI risk.

Many thanks to Professor Patrick Slattery for the invitation to participate.

Also, much appreciation to the other panelists (Dr. Yogesh Malhotra, Patricia Voight, and Benjamin Dynkin) for sharing their experiences and ideas!

The Caribbean Cybersecurity Pandemic – Building a Digital Trust Model

nielharper

Citizens and customers are increasingly losing confidence and trust in their governments and the corporations that develop and deliver online services. From AI to crypto marketplaces to the Internet of Things (IoT), personal data leaks to unethical use of data analytics to supply chain breaches, technology vendors’ and digital service providers’ repeated failures have severely damaged the trust model at the core of their relationships with their customers. There’s no doubt that digitalisation can drive human, social, and economic development. Simultaneously, surveys and research have shown a concerning decrease in trust in online platforms and associated social institutions.

Today, I presented at the Development Dialogue Seminar of the Caribbean Development Bank (CDB) on the topic of building a digital trust model. The backdrop for the discussion was what many see as the ‘Caribbean Cybersecurity Pandemic’ – The avalanche of cyberattacks that have impacted private and public sector entities across the region – and how this correlates to the decrease in trust and limited uptake by citizens of online services (e.g., e-commerce, e-government, social media, fintech, and others).

Leveraging the World Economic Forum’s Digital Trust Framework, I discussed the key goals and dimensions (e.g., security, reliability, accountability, oversight, ethical use, privacy, fairness, redressability, etc.) underpinning digital trust as well as the capabilities needed to operationalise them.

Check out my presentation and let me know your thoughts!