GambiaInformation and Communications Act, 2009, security of information and communications services (subscriber risk notification)
Information and Communications Act, 2009 (No. 2 of 2009), sec. 140(3)-(6)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Security, Breach notice
What it requires
- This binds the same information and communications service provider bound by section 140(1) and (2)'s safeguards duty.
- Where a particular risk of a breach of the security of your services persists despite your safeguards, inform your subscribers of the risk and of the measures they may take to protect themselves.NIST CSF 2.0RS.CO-02
- Identify in that notice any software or encryption technology available to the subscriber to protect the security of their communications.NIST CSF 2.0RS.CO-02
- Where an event affecting or jeopardizing the security of your services occurs and reveals a previously unknown risk, promptly and free of charge inform the affected subscriber of the risk, the measures they may take, and the estimated cost involved.NIST CSF 2.0RS.CO-02
- Notifying subscribers of a security risk does not excuse you from taking immediate measures to restore your service's normal security level.NIST CSF 2.0RC.RP-02
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- CIS Controls
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Contravening or failing to comply with a provision of the Act that carries no penalty of its own, including this duty, is an offence punishable by a fine of not less than fifty thousand Dalasis or imprisonment for a term not exceeding three years, or both, plus a further fine of five hundred Dalasis for every day a continuing offence persists.
Penalty structure
Section 140 carries no penalty of its own; a violation falls to section 247's general offence for contravening or failing to comply with a provision of the Act, a fine of not less than fifty thousand Dalasis or imprisonment for a term not exceeding three years, or both, for the underlying offence, with a further fine of five hundred Dalasis for every day a continuing violation persists.
- Rule
- Per violation only
- As of
- Minimum
- 50,000
- Currency
- GMD
- Per violation unit
- Day
- Per violation amount
- 500
Over one month of continuous breach, GMD 15,220.
Who enforces it
Enforcement body
The Gambia Public Utilities Regulatory Authority (PURA), the Authority the Act designates to regulate the provision of information and communications services, may apply its own sanctions against a licensee's non-compliance with the Act, including a fine, a disclosure order, or advising the Minister to suspend or revoke the licence; a contravention with no penalty stated of its own draws the general offence under section 247.
Settledness
- As of
- Open questions
- Does any Public Utilities Regulatory Authority directive, or the gmCSIRT's own protocols, require an information and communications service provider to report a security incident to a regulator or to gmCSIRT, in addition to the subscriber notice section 140(3) to (6) require?
What this law does
Where a particular risk of a breach of the security of the services persists despite the technical and organizational measures taken under section 140(1) and (2), the service provider must inform the subscribers of the risk and of the measures they may take to enhance their level of protection. That information must also indicate any software and encryption technologies available for use by the end-users and subscribers to safeguard the security of their communications.
Where an event affecting or jeopardizing the security of the services occurs and a previously unknown risk of a breach of security appears as a result, the service provider must promptly inform the subscriber of the risk, free of charge, of the measures the subscriber may take to enhance the level of protection, and of the estimated costs involved.
Informing subscribers of a particular security risk does not discharge the service provider from the obligation to take appropriate and immediate measures to restore the normal security level of the service.
The Act sets no penalty specific to this duty, so a violation falls to the general offence under section 247 for contravening or failing to comply with a provision of the Act, a fine of not less than fifty thousand Dalasis or imprisonment for a term not exceeding three years, or both, with a further fine of five hundred Dalasis for every day a continuing offence persists.
When LexLint raises it
When your app profile says your app provides telecom services.
Back to the example · Lint your app
Page updated .