MicronesiaFSM Telecommunications Act of 2014, Security Safeguards for Customer Information
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security
What it requires
- This reaches you where you hold an operating or spectrum licence to provide a communications network or communications service in the Federated States of Micronesia, whether you are a private operator or a public authority; it does not reach a business with no such licence.
- Apply appropriate security safeguards to prevent the collection, use, maintenance, or disclosure of a customer's information without the customer's consent.
- Expect a contravention of this duty to be prosecuted as a general offence: a natural person faces a fine of up to $50,000 and imprisonment of up to one year, plus up to $10,000 for each day the offence continues, and a corporation or other entity faces a fine of up to 5% of its gross revenue in the prior financial year, plus up to $100,000 for each day the offence continues.
- Expect no direct civil claim from a customer harmed by a safeguards failure; a customer's recourse runs through the Telecommunication Regulation Authority's own consumer complaint and dispute process rather than a private right of action in court.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A contravention of section 349(1)(b) is a general offence under section 383, which makes a contravention of any provision of the Act a general offence. Section 384 sets the penalty: a natural person is liable to a fine not exceeding $50,000 and imprisonment for a term not exceeding one year, and for a continuing offence a further fine not exceeding $10,000 for each day the offence continues; a corporation or other entity is liable to a fine not exceeding 5% of its gross revenues in the previous financial year, and for a continuing offence a further fine not exceeding $100,000 for each day the offence continues. Section 385 extends liability to a director, officer, employee, or agent who directed, authorized, or participated in a corporation's or other entity's offending conduct. Section 387 lets the Attorney General appoint Special Assistant Attorneys General to prosecute offences under the Act. No civil action or private right of action running to a customer was found; a customer's complaint about a safeguards failure is addressed through the Telecommunication Regulation Authority's own consumer protection rules and dispute process under section 352, not a direct court claim for damages.
Who enforces it
Enforcement body
Telecommunication Regulation Authority of the Federated States of Micronesia (established under section 304 of Title 21), with prosecutions under sections 383 and 384 conducted by Special Assistant Attorneys General appointed by the Attorney General
Settledness
No Telecommunication Regulation Authority rule, order, or enforcement action implementing or applying section 349(1)(b) was found; the Authority's own website (fsmtc.fm, which appears to serve both the Corporation and the Authority) serves only a JavaScript shell, so its published rules and any enforcement record are not described here.
- As of
- Open questions
- Does the Federated States of Micronesia Telecommunications Corporation, the incumbent state-owned operator under Title 21 Chapter 2, hold a licence under Chapter 3 that makes it a licensee bound by section 349(1)(b), or does a separate transitional or licence-exempt arrangement apply to it?
- Has the Telecommunication Regulation Authority issued consumer protection rules or technical standards under section 349(7) that specify what appropriate security safeguards must include?
- Has any prosecution been brought under sections 383 and 384 for a contravention of the section 349(1)(b) safeguards duty?
What this law does
Section 349(1) of Title 21, inserted by Public Law No. 18-52 (2014), the 'FSM Telecommunications Act of 2014', binds a telecommunications licensee with two duties under the same subsection. Paragraph (a) bars collecting, using, maintaining, or disclosing information about a customer without the customer's consent, a duty this jurisdiction's privacy row researches.
Paragraph (b), researched here, separately requires the licensee to apply appropriate security safeguards to prevent the collection, use, maintenance or disclosure of that information without the customer's consent.
Section 383's general offence provision makes a contravention of any provision of the Act, including section 349(1)(b), a criminal offence, and section 384 sets escalating fines and imprisonment for a natural person and a percentage-of-revenue fine for a corporation or other entity, with an added daily fine for a continuing violation.
Section 387 lets the Attorney General appoint Special Assistant Attorneys General to prosecute offences under the Act, and no civil action or private right of action for a customer harmed by a safeguards failure was found; a customer's recourse instead runs through the Telecommunication Regulation Authority's own consumer complaint and dispute process. Public Law No. 18-52 gave this new chapter of Title 21 the short title 'FSM Telecommunications Act of 2014'.
Section 94 of Public Law No. 18-52 sets its own effective date as the date of presidential approval, dated .
When LexLint raises it
When your app profile says your app provides telecom services.
Back to the example · Lint your app
Page updated .