LiberiaTelecommunications Act of 2007, Protection of Personal Information (§§ 51-52)
Telecommunications Act of 2007, §§ 51-52 (Protection of Personal Information)
In force.
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Governance, Consent, Disclosure, Security
- Audit expectation
- none
What it requires
- Be responsible for customer information and customer communications in your custody or control, or in the custody or control of your agents.NIST Privacy FrameworkGV.PO-P4
- Collect, use, maintain, or disclose a telecommunications customer's information or communications only as permitted or required by law, or with that customer's consent.NIST Privacy FrameworkCT.PO-P1
- Identify the purposes for which customer information is collected, at or before collection, and do not use it for an undisclosed purpose.NIST Privacy FrameworkID.IM-P5NIST Privacy FrameworkGV.PO-P1
- Keep customers' information accurate, complete, and up to date for the purposes it is used for.NIST Privacy FrameworkCT.PO-P2
- Protect customer information and customer communications with security safeguards appropriate to their sensitivity.NIST Privacy FrameworkPR.DS-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P5The purposes for the data actions are inventoried.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P4Privacy roles and responsibilities are coordinated and aligned with third-party stakeholders (e.g., service providers, customers, partners).
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does Section 51 of the Telecommunications Act of 2007 bind an internet or messaging service that carries customers' communications but holds no permit or license from the LTA, given that "service provider" means "a person or entity under permit or license by the LTA that provides a telecommunications service to the public"?
- What request or order from a Government authority satisfies Section 52, which allows access "pursuant to Section 71 (1), (2) and in accordance with the laws of Liberia", before a service provider may disclose a customer's communications?
What it makes you log
Logging duty
Section 51 makes a telecommunications service provider responsible for customer information and communications, bars collecting, using, keeping or disclosing them except as the law permits or the customer consents, requires the purposes to be identified at or before collection, requires the information to be accurate and up to date, and requires security safeguards suited to its sensitivity. Section 52 only preserves government access under Section 71, which this row does not cite. Neither section requires a log, register or record of processing, and neither names an audit or a person who may demand one. The row's text is a copy of the Act on ICT Policy Africa; neither section has a scope clause.
- Kind
- None
- As of
What this law does
Liberia's Telecommunications Act of 2007 makes a telecommunications service provider responsible for customer information and customer communications in its own custody or control or in that of its agents.
The Act requires a service provider to operate its telecommunications network with due regard for the privacy of its customers, and bars it from collecting, using, maintaining, or disclosing customer information or customer communications except as permitted or required by law or with the customer's consent. It requires a service provider to identify the purposes for which customer information is collected at or before collection, and bars using customer information for an undisclosed purpose.
It requires a service provider to keep customers' information accurate, complete, and up to date for the purposes it is used for. It requires a service provider to protect customer information and customer communications with security safeguards appropriate to their sensitivity. It leaves a government authority's access to otherwise confidential customer information or communications governed separately by the Act's national security, public emergency, and traffic interception provisions.
Under its section 85 the Act takes effect immediately upon publication into handbill; no source stating the day of that publication has been located.
When LexLint raises it
When your app profile says your app provides telecom services.
Back to the example · Lint your app
Page updated .