Honduras

Article 182 recognizes the guarantee of Habeas Data for any person whose personal or family data appears in a public or private file, archive or register. It grants the right to access information about oneself or one's property in an expedited and cost-free manner, and, where necessary, to update, rectify or suppress it, and it bars affecting the confidentiality of journalistic sources.

Only the affected person may bring the Habeas Data action, which is heard exclusively by the Constitutional Chamber of the Supreme Court of Justice, without need of a lawyer or formality, verbally or in writing, on any day or hour. The current text of article 182 was introduced by Decreto No. 237-2012, published in La Gaceta No. 33,033 of 24 January 2013, and its ratification, required for a constitutional reform, was published by Decreto No. 10-2013 in La Gaceta No. 33,086 of 27 March 2013.

The second paragraph of article 272 punishes with two to three years' imprisonment and a fine of 360 to 720 day-fines whoever, to the detriment of a third party and without authorization, accesses, appropriates, alters or uses personal data incorporated into files, media, computerized, electronic or telematic registers, or any other type of public or private archive or register.

The first paragraph separately punishes, with one to three years' imprisonment and the same range of day-fines, accessing another's documents or communications, intercepting their telecommunications, or using technical listening, transmission or recording devices to learn a person's secrets or violate their privacy without consent, and a further paragraph punishes disclosing or ceding to third parties the secrets or images obtained this way with two to four years' imprisonment. Article 273 increases these penalties by two thirds where a public official commits the conduct using their office.

Article 3(7) defines confidential personal data as information relating to ethnic or racial origin, physical, moral or emotional characteristics, home address, private telephone number, private email address, political participation or affiliation, political ideology, religious or philosophical beliefs, physical or mental health status, personal or family assets, and anything else touching honor, personal or family privacy, or one's own image.

Article 25 bars any person from forcing another to provide personal data that could cause discrimination or patrimonial or moral harm or risk, a general prohibition not limited to an obligated institution.

Article 24 states personal data shall always be protected, and lets the data subject, the National Human Rights Commissioner acting for the affected party, or the Public Prosecutor's Office bring the legal actions needed for its protection, with access to the data proceeding only by judicial order or at the request of the person whose data it is.

Articles 27 to 29 sanction an obligated institution's staff who improperly collect, transmit, disclose or refuse to correct false personal data with a written warning, suspension, fine, dismissal or removal for administrative infractions, a fine of half to fifty monthly minimum wages imposed by the IAIP, and referral to the Código Penal's public-administration offences where the conduct is a crime.

Article 39 provides that the Habeas Data articles of this law did not take effect on the law's own 2006 commencement date but only once the corresponding constitutional reform was ratified.

Article 398 punishes with six to eighteen months' imprisonment or a fine of 100 to 200 day-fines whoever, infringing the security measures established to prevent it, accesses all or part of a computer system without authorization, with the penalty increased by a third where the system concerns critical community infrastructure.

Article 399 punishes unauthorized introduction, deletion, deterioration, alteration, suppression or serious disabling of computer data with one to two years' imprisonment or a fine of 100 to 300 day-fines, and unauthorized disabling of a computer system's operation with one to three years' imprisonment or a fine of 100 to 400 day-fines, with both penalties increased by a third where the conduct causes grave economic damage or affects critical community infrastructure.

Article 400 punishes manufacturing, importing, selling, facilitating or obtaining devices, software, passwords or access codes intended for committing these offences with six months to one year's imprisonment or a fine of 100 to 200 day-fines, and article 401 punishes identity theft carried out through information and communication technology with fraudulent intent with the same six-months-to-one-year imprisonment range or a fine of 100 to 300 day-fines.

Article 402 raises every penalty in this title by a third where the offender is responsible for or authorized to access the system, or belongs to an organized criminal group, and adds professional disqualification, with absolute disqualification for a public official. Article 403 punishes a legal person responsible for one of these offences with three to five years' suspension of its specific activities and a fine of 300 to 500 day-fines.

Article 404 gives Honduran courts jurisdiction over these offences when committed in Honduras against a system located abroad, or against a system located in Honduras from abroad. Because the article 398 offence turns on infringing a security measure, accessing a public, unauthenticated page that defeats no access control falls outside a plain reading of the provision.

Article 9(5) defines a derivative work to include a collection of works or a collection of simple data, protected only where the collection is original by reason of the selection, coordination or arrangement of its content, a compilation-copyright standard rather than a sui generis, investment-based database right.

The limitations chapter (arts. 44-50) permits, without authorization or payment, press reproduction of articles of current events on economic, political or religious discussion, and of broadcast works of the same character, where not expressly reserved (art. 46(1), as reformed), and reproduction of fragments of works seen or heard during current events for informational purposes (art. 46(2)).

It also permits a single copy for the user's exclusive personal use, made by the user with their own means from a copy of a work they acquired lawfully, in special cases that do not conflict with the work's normal exploitation or unreasonably prejudice the author's legitimate interests (art. 47, as reformed), small-scale photocopying for exclusive personal use (art. 48), library preservation copying of out-of-print works (art. 49), and reprographic reproduction for teaching or examinations without a profit motive (art. 50).

None of these provisions is framed as, or reaches, a text-and-data-mining exception for training a model on scraped text, and no other article of this law creates one. Article 169 refers criminal liability for copyright infringement to the Código Penal without stating a penalty of its own. Article 156 lets the copyright office fine an infringer 10 to 200 monthly minimum wages administratively.

Article 174 lets a rights holder seek judicial seizure of infringing copies and claim damages for the infringement. Article 54 of the Ley de Implementación del Tratado de Libre Comercio, República Dominicana, Centroamérica, Estados Unidos (Decreto 16-2006), published in La Gaceta issue 30,961 of 24 March 2006, reformed article 46(1) and set article 47 out anew.

Under its Article 71 the decree enters into force on the date the Treaty enters into force, the Treaty being the Dominican Republic-Central America-United States Free Trade Agreement (CAFTA-DR). The CAFTA-DR entered into force for Honduras on 1 April 2006. The copy of the Act on the Tribunal Superior de Cuentas site still prints articles 46(1) and 47 in their pre-reform wording. The sections this entry groups came into force on different days.

Article 2 applies the Norms to the institutions supervised by the Comisión Nacional de Bancos y Seguros and to the financial groups they form. Article 18 requires supervised institutions to design, implement, document, monitor and update an information security and cybersecurity management framework. Article 19 requires supervised institutions to manage cybersecurity on international best practices and standards.

Article 20 requires supervised institutions to keep an information security and cybersecurity function with functional and operational independence from the information technology area. The Norms apply from their publication in the Diario Oficial La Gaceta, which the gazette dates 24 December 2022.

Article 2 applies the guidelines to the institutions supervised by the Comisión for transactions and procedures carried out through the digital channels they offer to financial users. Article 17 requires supervised institutions to report to the Comisión cyber fraud incidents against financial users on the business day after the incident is identified. The guidelines apply from their publication in the Diario Oficial La Gaceta.

Article 2 applies the Norms to the institutions supervised by the Comisión Nacional de Bancos y Seguros and to the financial groups they form. Article 21 requires supervised institutions to notify the Comisión of incidents that significantly affect the confidentiality, integrity or availability of their information. Article 21 sets a first communication within two hours after the incident is identified.

Article 21 sets a preliminary report within two business days after the incident is identified, updated every five business days while the incident is unresolved. Article 21 sets a final report within fifteen business days after the final resolution of the incident. Article 37 requires institutions to notify the Comisión within two business days of identifying an incident that significantly affects business continuity. The Norms apply from their publication in the Diario Oficial La Gaceta, which the gazette dates 24 December 2022.

Article 46's opening clause conditions all three of the exceptions it grants on crediting the source and the author's name where the work indicates one, so none of them is a use free of attribution.

Article 46(1), as reformed by Article 54 of the Ley de Implementación del Tratado de Libre Comercio, República Dominicana, Centroamérica, Estados Unidos (Decreto 16-2006), permits, without the rights holder's authorization and without payment, reproducing and distributing by press, or broadcasting or transmitting by cable, articles of current events on economic, political or religious discussion published in newspapers or periodical collections, and broadcast works of the same character, in cases where the reproduction, broadcast or public transmission has not been expressly reserved.

The copy of the Act on the Tribunal Superior de Cuentas site still prints article 46(1) in its pre-reform wording, which names information, news and articles of current events without that subject limit.

Article 46(2) separately permits reproducing and making available to the public, in connection with reporting on current events, fragments of works seen or heard during those events by photography, audiovisual work, broadcasting or cable transmission, to the extent justified by the informational purpose.

Article 46(3) permits using political, judicial or similar public speeches for informational purposes about current events, while reserving the author's exclusive right to publish them for other purposes. None of these clauses states a headline-length or short-extract cap distinct from the current-events and informational-purpose tests themselves, and no reported Honduran decision applies article 46 to a systematic news aggregator as opposed to press republication generally.

The Act's neighbouring rights, covering performers, phonogram producers and broadcasting organizations, do not extend to a print or online news publisher's own reporting, so Honduras has no press-publisher neighbouring right of the kind the European Union's Digital Single Market Directive Article 15 creates. No La Gaceta issue stating the day the Act came into force has been located.

Article 54 of the Ley de Implementación del Tratado de Libre Comercio, República Dominicana, Centroamérica, Estados Unidos (Decreto 16-2006), published in La Gaceta issue 30,961 of 24 March 2006, reformed article 46(1) of the Act. Under its Article 71 the decree enters into force on the date the Treaty enters into force, the Treaty being the Dominican Republic-Central America-United States Free Trade Agreement (CAFTA-DR). The CAFTA-DR entered into force for Honduras on 1 April 2006.