Bhutan

Section 424 makes it a felony of the fourth degree for a person to publish, distribute, or transmit an obscene communication or material depicting children engaged in a sexually explicit act, or to create text or digital images, collect, seek, browse, download, advertise, promote, exchange, or distribute material in any form depicting children in an obscene, indecent, or sexually explicit manner, or to record own or another's abuse of a child in a sexually explicit act.

The offence's second limb criminalises creating a digital image or text depicting a child in that manner without requiring that the depicted child be a real, identifiable person, so on the section's own text it reaches a computer-generated or AI-synthesized depiction of a child in the same terms as one derived from a real photograph.

Chapter 21 imposes a general consent-for-collection duty (s.384: express written permission of the subject, unless permitted or required by law), a non-disclosure duty absent authorization or legal requirement (s.385), and a duty to delete or destroy obsolete personal information, including sensitive personal data (s.386), on "a person" generally.

Chapter 17 imposes a fuller set of duties specifically on an ICT and Media facility or service provider and vendor: a duty to respect and protect privacy (s.336), a mandatory published privacy policy disclosing data types, sources, purposes, use, disclosure recipients, and opt-out options (ss.337-338), collection and use limited to what a reasonable person would consider appropriate (s.339), storage and use limited to the intended purpose (s.340), no disclosure to affiliates or third parties beyond the transaction absent written authorization (s.341), and continuing responsibility, with contractual binding, for personal data a provider transfers to a third party (ss.342-343).

Section 2 ("Commencement") gives 8 January 2018 as the date from which the Act comes into force. Section 7 ("Transitional Clause") provides that the Act becomes effective six months from the date of adoption. The adoption date meant is the one fixed under section 2, and all existing regulations and rules continue to be effective and valid until then. Six months after 8 January 2018 is 8 July 2018, the day the whole Act took effect, with no chapter-by-chapter schedule.

Section 338(3) requires the privacy policy of an ICT and Media facility or service provider and vendor to include details on how users or consumers may review and, when necessary, have their information amended or removed. Section 340 provides that the information collected may be removed or withdrawn upon the request of the users.

These provisions run specifically against an ICT/Media provider under Chapter 17; no equivalent named right was found running against a general Chapter 21 data handler. No express portability right was found.

Issued by BICMA under section 58 of the ICM Act as a binding code of practice for licensed Telecom Service Providers and other ICT service providers operating critical information infrastructure, in force since 10 October 2024.

Section 8.6 requires a licensee to establish and communicate a topic-specific policy on privacy and protection of Personally Identifiable Information (PII), to implement procedures for preserving that privacy, and to put in place appropriate technical and organizational measures, expressly deferring compliance to "relevant legislation and regulations" (the ICM Act's own Chapter 21 duties).

Section 5 defines personally identifiable information as any information that can be used to establish a link between the information and the natural person to whom it relates, or that can be directly or indirectly linked to a natural person, without naming biometric data as an example, and its incident-response requirement (s.12.1) requires only that a licensee's Incident Response Plan include a reporting structure aligned with "its reporting obligations under the Act and any other laws and regulations"; it creates no independent breach-notification threshold, recipient, or timeline of its own.

It is a separate, more recent, government-issued instrument, not a republication of the ICM Act.

The Bhutan InfoComm and Media Authority (BICMA) is the autonomous regulatory authority this Act establishes to carry out the responsibilities entrusted under the Act.

Section 387 ("Failure to protect data") makes a person possessing, dealing with, or handling personal data, including sensitive personal data, who is negligent in implementing reasonable security practices and thereby causes wrongful loss or gain, liable to pay court-determined compensation to the victim, a genuine private right of action in substance.

Section 388 ("Unlawful Disclosure of data or information") separately makes it an offence to disclose another's personal data without consent or in breach of a lawful contract, intending or knowing it likely to cause wrongful loss or gain; the offender is liable for the offence of misdemeanour and must also pay the victim compensation as determined by the Court.

Definitions item (89) lists biometric information as a Sensitive Personal Data or Information category, alongside password, financial information, physical/physiological/mental health condition, sexual orientation, medical records, and a residual "other information legally deemed to be private" category.

The item's own proviso carves information that is freely available or accessible in the public domain, or available under another existing national law, out of the sensitive-personal-information classification, though this does not obviously rescue a voiceprint or faceprint derived from public material, since the derived identifier is a distinct data element from its source recording.

No standalone definition of "biometric information" exists; the term is not otherwise defined, and neither "voice" nor "voiceprint" nor "facial image" appears anywhere in the Act as its own named term. Creating and storing an identity-linked voiceprint or faceprint would be handling Sensitive Personal Data, triggering Chapter 21's consent, non-disclosure, and destruction duties, and, where done by an ICT/media provider, Chapter 17's fuller duties.

Section 415 makes it an offence, keyed to intent to cause or knowledge that it is likely to cause wrongful loss, gain, or damage, to access a computer, computer system, network, or computer, content, or traffic data and thereby cause a stoppage or denial of service, delete or alter data, diminish a system's value or utility, or introduce a computer contaminant; the section labels this "tampering with computer material", punishable under the Penal Code of Bhutan.

Section 416 separately makes unauthorized access to a computer, computer system, network, or computer, content, or traffic data an offence in its own right, without requiring the loss, gain, or damage element of section 415, graded a felony of the fourth degree with court-determined compensation to the victim.

The Code applies to the Telecom Service Providers and other ICT Service providers having critical information infrastructure. The Bhutan InfoComm and Media Authority issued the Code under section 58 of the Information, Communications and Media Act of Bhutan 2018. The Code came into force on the 10th day of October, 2024.

Where an audit identifies non-compliance with the Act or a code of practice issued under it, the Code requires a licensee to submit an audit finding remediation plan to the Authority within 30 working days from the date that the licensee receives the audit report, unless the Authority indicates otherwise in writing. The Code requires a licensee to conduct a vulnerability assessment at least once every 12 months.

The Code requires a licensee to conduct a penetration test on its ICT facilities at least once every 12 months. The Code requires a licensee to establish a Cybersecurity Incident Response Plan that sets out how it should respond to a cybersecurity incident. The Code requires a licensee to conduct scenario-based cybersecurity exercises at least once every 12 months.

Section 127 of the Act provides that where a licensee is in contravention of the terms and conditions of its license, the Authority shall by an order make such provision, including payment of fine, as it appears necessary for the purpose of securing compliance.

The Code applies to the Telecom Service Providers and other ICT Service providers having critical information infrastructure. The Code requires a licensee to establish and implement mechanisms and processes to share information on cybersecurity threats and vulnerabilities, and on measures that can be taken in response to them, with the relevant Authorities for threat monitoring and analysis.

The Code requires the Cybersecurity Incident Response Plan to include an incident reporting structure that guides the licensee on compliance with its reporting obligations under the Act and any other laws and regulations. Section 127 of the Act provides that where a licensee is in contravention of the terms and conditions of its license, the Authority shall by an order make such provision, including payment of fine, as it appears necessary for the purpose of securing compliance.

Section 348 requires that a communication addressed to children, or likely to be of particular interest to children, be age-appropriate, and prohibits exploiting the credulity, lack of experience, or sense of loyalty of children. Section 349 requires an ICT and Media facility or service provider and vendor to take all reasonable steps to prevent offensive communications being delivered to children and to prevent children from being drawn into conducting business transactions of any kind.

Section 351 bars an advertisement, in any form, that is aimed at taking advantage of a child's vulnerabilities. A separate provision in the same chapter, section 350, additionally bars an ICT or media provider from collecting or disclosing a child's personal information without a parent's or guardian's express, verifiable consent; because that duty attaches to personal data rather than to content or advertising, it is not carried on this instrument.

Section 11 permits, without the copyright owner's authorization, the reproduction of a short part of a published work in the form of a quotation in another work, provided the reproduction is compatible with fair practice and its extent does not exceed the extent justified by the purpose. The quotation must be accompanied by an indication of its source and the author's name where that name appears on the work quoted.

Section 14(a) permits a newspaper or periodical to reproduce, or to broadcast or otherwise communicate to the public, an article published in a newspaper or periodical on a current economic, political, or religious topic, or a broadcast work of the same character, without the author's authorization, subject to the obligation to indicate the source and the author's name; this permission does not apply where the original rightsholder has expressly reserved the right to authorize such reproduction.

Section 14(b) separately permits reproducing and broadcasting short excerpts of a work seen or heard in the course of an event, for the purpose of reporting current events, to the extent justified by that purpose. Section 14(c) covers reproduction of a political speech, lecture, address, sermon, or similar public work.