NauruCommunications and Broadcasting Act 2018, confidentiality of subscriber information and communications
Communications and Broadcasting Act 2018 (No. 21 of 2018), ss. 48-49, 70-71
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: http://ronlaw.gov.nr/nauru_lpms/files/acts/7fdfb6b20bbb42e23f5bb8daf48aa363.pdfIn force since .
A comprehensive regime rule binding public and private bodies.
- Enforcement body
- Nauru Communications Authority
- Obligation class
- Consent, Data subject rights, Retention, Security, Disclosure
- Audit expectation
- none
What it requires
- As a licensed communications service provider, do not disclose information concerning a subscriber without the subscriber's written consent, unless the Act or another written law requires or authorises the disclosure.NIST Privacy FrameworkCT.PO-P1
- Let a subscriber require you to correct or remove information relating to them, and handle any complaint about how you responded to that request.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkGV.MT-P7
- Retain a subscriber's information only for billing purposes, and for no longer than 7 years.NIST Privacy FrameworkCT.PO-P2
- Take reasonable steps to maintain the confidentiality of a subscriber's communications, and do not intercept, monitor, alter, or modify their content except as permitted or required by law.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkCT.PO-P1
- If the Chief Regulator directs you to under section 49(4), monitor communications to a subscriber's connections to trace a harassing, offensive, or illegal call, to the extent your current technology allows.NIST Privacy FrameworkGV.PO-P5
- Keep all communications and other information you receive from a subscriber confidential at all times, and do not intentionally intercept, use, or disclose them unless you are Authority staff, the service provider, or its employee, agent, or contractor lawfully acting in the course of duty.NIST Privacy FrameworkCT.PO-P1
- Do not intentionally modify or interfere with the contents of a communication sent over a communications network, unless doing so in the proper course of your duties with lawful excuse.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
4 more
- AIR-PREV-020MCP Server Security Governance
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Two separate offences carry this penalty. Under section 70(2), a person other than the Authority's staff, a service provider, or its employee, agent, or contractor acting lawfully in the course of duty who intentionally intercepts, uses, or discloses a subscriber's communications or information commits an offence. Under section 71, a staff member of the Authority, a service provider, or its employee, agent, or contractor who intentionally and without lawful excuse modifies or interferes with the contents of a communication outside the proper course of their duties also commits an offence. Both are punishable on conviction by a fine not exceeding $10,000 or imprisonment not exceeding 2 years, or both.
Penalty structure
Fine only under s. 70(2) or s. 71; either subsection also allows imprisonment not exceeding 2 years instead of or in addition to the fine.
- Rule
- Fixed only
- As of
- Currency
- AUD
- Fixed cap
- 10,000
What it makes you log
Log retention
The text fixes one period of seven years for a subscriber's information retained for billing purposes only; the row's requires line reads it as a ceiling.
- Unit
- Years
- As of
- Basis
- Fixed
- Maximum value
- 7
- Minimum value
- 7
Logging duty
Section 48(4) requires a service provider or network provider to retain all of a subscriber's information, for billing purposes only, for a period of 7 years, so a billing record of each subscriber's information exists by force of the text. The Act names no log of access or events: sections 48(1) to (3) and 49 are confidentiality, correction and monitoring-on-request duties and section 70 a confidentiality and offence provision, none of which asks for a record. The cited sections state no territorial clause, so no jurisdiction hook is stated.
- Kind
- Implicit
- As of
- Provision
- Section 48(4)
- Trigger
- personal_data_processing
What this law does
Section 48(1) bars a service provider from disclosing information concerning a subscriber without the subscriber's written consent unless the Act or another written law requires or authorises the disclosure. Section 48(2) gives a subscriber the right to require a service provider to correct or remove information relating to them, with a right under section 48(3) to complain to the Nauru Communications Authority if the provider fails or declines to act.
Section 48(4) limits retention of a subscriber's information to billing purposes only, for no more than seven years. Section 49(1) requires a service provider to take all reasonable steps to maintain the confidentiality of subscriber communications, and section 49(2) bars it from intercepting, monitoring, altering, or modifying their content except as permitted or required by law.
Section 49(3) lets a subscriber ask the Chief Regulator to direct a service provider to monitor communications to the subscriber's own connections for tracing a harassing, offensive, or illegal call, and section 49(4) lets the Chief Regulator issue that direction. Section 70(1) extends the confidentiality duty to all communications and other information received from a subscriber, binding the Authority's staff and a service provider's employees and agents alongside the provider itself.
Section 70(2) makes it an offence for anyone outside that group acting lawfully in the course of duty to intentionally intercept, use, or disclose a subscriber's communications or information, punishable by a fine not exceeding $10,000 or imprisonment not exceeding two years, or both.
Section 71 separately makes it an offence, carrying the same penalty, for a staff member, service provider, or its employee, agent, or contractor to intentionally and without lawful excuse modify or interfere with the contents of a communication sent over a communications network, outside the proper course of their duties. These duties bind only a licensed communications service provider's handling of its own subscribers, not personal data generally.
When LexLint raises it
When your app profile says your app provides telecom services.
Back to the example · Lint your app
Page updated .