BhutanInformation, Communications and Media Act of Bhutan 2018, offences and compensation for data failures
Information, Communications and Media Act of Bhutan 2018, ss.387-388
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Security, Consent
- Audit expectation
- none
What it requires
- An app that negligently fails to implement reasonable security practices for personal data of a person in Bhutan, including a biometric identifier, and thereby causes wrongful loss or gain, is liable to pay court-determined compensation to the victim, and unlawfully disclosing another's personal data without consent is a separate offence under section 388.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
ICMA s.388 (Unlawful Disclosure of data or information) grades the offence a misdemeanour. Under the Penal Code of Bhutan 2004 (as amended by the Penal Code (Amendment) Act of Bhutan 2011 and 2021), Chapter 3 (Sentencing) s.12, a misdemeanour carries imprisonment of a minimum of one year and a maximum of less than three years; a second conviction for the same offence is enhanced to a felony of the fourth degree under Penal Code s.15(c). ICMA s.387 (Failure to protect data, the negligent security-failure provision) carries no criminal offence grading of its own, only court-determined civil compensation to the victim.
Who enforces it
Enforcement body
Bhutan InfoComm and Media Authority (BICMA), created by this Act, is the sector's general regulator, but a Chapter 22 offence such as s.388 is enforced as an ordinary crime: ICMA ss.443-444 route the investigative search-and-seizure power through a Court-issued warrant under the Civil and Criminal Procedure Code of Bhutan, and it is the Courts of Bhutan, not BICMA, that adjudicate the offence and determine the compensation award under ss.387-388.
Settledness
- As of
- Open questions
- Is the standard of "reasonable security practices and procedures" in section 387 the same as the standard for security mechanisms in sections 344 and 345?
- Does "wrongful loss or wrongful gain" in section 387 cover non-financial harm, such as the exposure of a person's biometric identifier, or only a loss or gain in money or property?
What it makes you log
Logging duty
Section 387 makes a person who handles personal data and is negligent in keeping reasonable security practices liable to court-determined compensation, and section 388 makes unlawful disclosure an offence with compensation. Neither imposes a duty to keep or produce a log or record, and no regulator audit or access power appears in them. The cited sections state no territorial scope clause.
- Kind
- None
- As of
What this law does
The Bhutan InfoComm and Media Authority (BICMA) is the autonomous regulatory authority this Act establishes to carry out the responsibilities entrusted under the Act.
Section 387 ("Failure to protect data") makes a person possessing, dealing with, or handling personal data, including sensitive personal data, who is negligent in implementing reasonable security practices and thereby causes wrongful loss or gain, liable to pay court-determined compensation to the victim, a genuine private right of action in substance.
Section 388 ("Unlawful Disclosure of data or information") separately makes it an offence to disclose another's personal data without consent or in breach of a lawful contract, intending or knowing it likely to cause wrongful loss or gain; the offender is liable for the offence of misdemeanour and must also pay the victim compensation as determined by the Court.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .