SamoaTelecommunications Act 2005, confidentiality and protection of customer personal information
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.paclii.org/ws/legis/consol_act_2020/ta2005214.pdfIn force since .
A comprehensive regime rule binding private bodies.
- Enforcement body
- Office of the Telecommunications Regulator
- Obligation class
- Consent, Disclosure, Security
- Audit expectation
- none
What it requires
- Do not disclose information concerning a telecommunications customer without the customer's written consent, unless disclosure is required or permitted by the Regulator or by law.NIST Privacy FrameworkCT.PO-P1
- Take all reasonable steps to keep customer communications confidential, and do not intercept, monitor, alter, or modify their content except as the Act permits.NIST Privacy FrameworkPR.DS-P2NIST Privacy FrameworkCT.PO-P1
- Identify the purposes for which customer information is collected at or before collection, and do not collect, use, maintain, or disclose customer information for an undisclosed purpose without the customer's consent or legal authority.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkGV.PO-P1
- Do not divulge information overheard from a customer's telephone conversation, or a customer's personal particulars obtained in the course of duties, without good and sufficient cause.NIST Privacy FrameworkPR.PO-P9
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.PO-P9Privacy procedures are included in human resources practices (e.g., deprovisioning, personnel screening).
- PR.DS-P2Data-in-transit are protected.
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
2 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Sections 75A and 75B each make it an offence, punishable on conviction by a fine not exceeding 50 penalty units (WST $5,000) or imprisonment not exceeding 6 months, or both, for a service provider's employee to divulge, without good and sufficient cause, information overheard from a telephone conversation, or a customer's personal particulars obtained in the course of duties.
Penalty structure
Sections 75A(1) and 75B(1) each cap the fine at 50 penalty units, or impose imprisonment not exceeding 6 months, or both. Samoa fixes the penalty unit at WST $100 under section 4 of the Fines (Review and Amendment) Act 1998, so the cap is WST $5,000.
- Rule
- Fixed only
- As of
- Currency
- WST
- Fixed cap
- 5,000
What it makes you log
Logging duty
Sections 48 to 51 and 75A to 75B protect customer information: no disclosure without consent, confidentiality of communications, a limit on collecting or using information for undisclosed purposes, and offences for divulging what an employee overhears or learns. Section 48(2) lets a customer inspect the provider's records about the customer's service, which is access to the data and not a log, and section 48(3) limits how long customer-specific information may be kept, which limits the data and not a record. Section 49(4) has the provider hand the Regulator the numbers, times and dates it learned by monitoring calls, but only after a customer's request and a Regulator direction, so it is a demand over directed monitoring and not a standing record duty.
- Kind
- None
- As of
What this law does
Section 48 bars a telecommunications service provider from disclosing information concerning a customer without the customer's written consent, unless disclosure is required or permitted by the Regulator or by law, and gives the customer a right to inspect the provider's records concerning them.
Section 49 requires a service provider to take all reasonable steps to keep customer communications confidential and bars intercepting, monitoring, altering, or modifying their content except for tracing harassing or illegal calls or as otherwise permitted by the Act. Section 50 requires a service provider to operate its network with due regard for customer privacy and to identify the purposes for which customer information is collected at or before collection.
Except as permitted or required by law or with the customer's consent, a service provider must not collect, use, maintain, or disclose customer information for an undisclosed purpose. Sections 75A and 75B separately make it an offence for a service provider's employee, without good and sufficient cause, to divulge information overheard from a telephone conversation or to disclose or use a customer's affairs or personal particulars obtained in the course of duties.
When LexLint raises it
When your app profile says your app processes voice recordings, provides telecom services or processes personal data.
Back to the example · Lint your app
Page updated .