Solomon IslandsTelecommunications Act 2009, Confidentiality and Consent Duties
Telecommunications Act 2009 (Solomon Islands), Part 11 (Relations with Consumers), ss. 72-74
In force since .
A comprehensive regime rule binding public and private bodies.
- Enforcement body
- Telecommunications Commission of Solomon Islands
- Obligation class
- Consent, Disclosure, Retention, Security, Data subject rights
- Audit expectation
- none
What it requires
- If operating as a licensed telecommunications service provider in Solomon Islands, do not collect, use, maintain, or disclose a consumer's information without the consumer's consent, other than publishing the consumer's name, address, and listed telephone number in a directory.NIST Privacy FrameworkCT.PO-P1
- Comply with any order or direction the Telecommunications Commission issues under section 72(3) requiring you to retain, or prohibiting you from retaining beyond a specified period, information relating to a consumer, including billing information.NIST Privacy FrameworkCT.PO-P2
- Take all reasonable steps to keep a consumer's communications confidential, and do not intercept, monitor, alter, or modify the content of a message without authorisation.NIST Privacy FrameworkPR.DS-P2NIST Privacy FrameworkCT.PO-P1
- Disclose to a consumer the purpose of collecting information about them, and do not use or maintain that information for an undisclosed purpose.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkGV.PO-P1
- Let a consumer inspect the records you hold about them, and correct or remove information shown to be incorrect.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.DS-P2Data-in-transit are protected.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
4 more
- AIR-PREV-020MCP Server Security Governance
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Contravening the consent duty (s. 72(1)) or the confidentiality duty (s. 73(2)) is an offence under s. 120(1)(j); on conviction a natural person is liable to a fine not exceeding 50,000 penalty units for a first offence and 100,000 penalty units for any second or subsequent offence, or to imprisonment for up to seven years, and a company or other entity is liable to a fine not exceeding 500,000 penalty units for a first offence and 2,500,000 penalty units for any second or subsequent offence (s. 121). Failing to comply with a Telecommunications Commission order or direction issued under s. 72(3) on retention of consumer information is also an offence, under s. 120(1)(k), carrying the same s. 121 penalties.
What it makes you log
Who may demand the log
Data subject
Logging duty
Section 72(3) lets the Telecommunications Commission order a service provider to retain specified consumer information, including billing information, or not to retain it beyond a specified period, and section 72(5) makes the provider permit a consumer to inspect its records of the service provided to that user. Both presuppose a record the provider keeps, but the Act names no log, no contents and no standing duty to keep one until the Commission issues an order. The retention period is left to the Commission's order and the Act states no figure, so no retention is coded. Sections 72 to 74 contain no scope clause of their own.
- Kind
- Implicit
- As of
- Provision
- Section 72(3) and (5)
- Trigger
- personal_data_processing
What this law does
Section 72(1) bars a telecommunications service provider from collecting, using, maintaining, or disclosing information about a consumer for any purpose without that consumer's consent, subject to a narrow exception permitting disclosure of a consumer's name, address, and listed telephone number in a directory.
Section 72(3) lets the Telecommunications Commission order a service provider to retain, or to stop retaining beyond a specified period, specified information relating to a consumer, including billing information. Section 120(1)(k) makes failing to comply with an order made under section 72(3) an offence.
Section 72(4)-(6) requires the information to be accurate and complete, lets a consumer inspect the provider's records about them and require correction or removal of incorrect information, and requires the provider to disclose the purpose of collection and not use the information for an undisclosed purpose.
Section 73(1) requires a service provider to take all reasonable steps to ensure the confidentiality of a consumer's communications, and section 73(2) bars intercepting, monitoring, altering, or modifying the content of a message except as authorised under section 97 or another law. Section 120(1)(j) of Part 19 makes a contravention of section 72(1) or section 73(2) an offence, and section 121 sets the penalty.
Section 74 preserves the lawful access rights of government authorities under other Solomon Islands law, so the confidentiality duty does not itself restrict lawful government access. These duties bind a person licensed as a telecommunications service provider in that person's dealings with its own consumers; the Act does not create a general personal-data duty reaching a business outside the telecommunications sector. Section 4 provides that the Act binds the Crown, so these duties are not confined to private service providers.
When LexLint raises it
When your app profile says your app provides telecom services.
Back to the example · Lint your app
Page updated .