Saint Kitts and Nevis

Section 12 makes it an offence for a person to knowingly publish child pornography through a computer system, produce it for the purpose of publication through a computer system, or possess it in a computer system or on a data storage medium for the purpose of publication, punishable on conviction on indictment by a fine of up to fifty thousand dollars or five years' imprisonment for an individual, or a fine of up to two hundred and fifty thousand dollars for a corporation.

Section 12(3) defines child pornography to include material that visually depicts a minor engaged in sexually explicit conduct, a person who appears to be a minor engaged in sexually explicit conduct, or a realistic image representing a minor engaged in sexually explicit conduct, a definition that does not require the depicted subject to be a real, identifiable child, so a wholly computer-generated or AI-synthesised depiction meeting it can fall within the ban.

A defence applies to publishing and possession, but not to production, where the material was for a bona fide scientific, research, medical or law enforcement purpose.

A note in the Revised Laws text records that the current section 12 was formerly section 13, the original section 12 having been repealed and sections 13 and 14 renumbered by Act 26 of 2012; whether the child-pornography definition's own wording changed at that renumbering, or was carried forward unchanged from the Act's original 2009 text, is not established in the available sources.

Section 4 applies the Act to a private body processing personal data in respect of commercial transactions, and to any other person meeting a territorial nexus test tied to establishment in Saint Christopher and Nevis or use of equipment there. Section 6 binds the State. Section 7(1) requires a data user to obtain a data subject's consent before processing personal data other than sensitive personal data, or to process sensitive personal data only in accordance with section 20.

Section 7(2) lets a data user process personal data without consent where necessary for a contract, a legal obligation other than a contractual one, the vital interests of the data subject, the administration of justice, or a function conferred by law, and section 7(3) requires the processing to be for a lawful purpose directly related to the data user's activity, necessary for or directly related to that purpose, and adequate but not excessive.

Section 8 requires a data user, on a request for personal data, to tell the data subject the purposes of collection, the source of the data where available, the right to request access and correction, the classes of third party to whom it may be disclosed, and whether supplying the data is obligatory or voluntary.

Section 9 bars disclosure of personal data without the data subject's consent for a purpose other than the one it was collected for or a directly related purpose, or to a class of third party not specified under section 8(d). Section 19 lists the circumstances, including the data subject's consent, crime prevention or detection, legal authorisation, and the public interest, in which such a further disclosure is permitted.

Section 10 requires a data user to take practical steps to protect personal data from loss, misuse, unauthorised access, alteration or destruction, and requires a data processor engaged by the data user to give sufficient security guarantees and to comply with them. Section 11 bars keeping personal data longer than the purpose requires and requires a data user to take reasonable steps to destroy or permanently delete personal data no longer needed.

Section 12 requires a data user to take reasonable steps to keep personal data accurate, complete, not misleading and up to date.

Section 21 exempts personal data processed for an individual's own personal, family or household affairs from the Act entirely, and, subject to listed conditions, exempts data processed for crime prevention or detection, taxation, statistics or research, a court order or judgment, regulatory functions, or journalistic, literary or artistic purposes from some or all of the Act's other principles.

Section 1(2) provides that the Act comes into force on a day fixed by the Minister by Order published in the Gazette, and no commencement order has been located, so the Act's substantive duties are not yet confirmed to be in operation.

Section 13 gives a data subject the right to be given access to their personal data held by a data user and to have it corrected where inaccurate, incomplete, misleading or out of date, except where an access or correction request is refused under the Act.

Section 14 requires a public body or private body, on a data subject's written request and payment of the prescribed fee, to confirm whether it holds their personal data and, if so, to describe the data, the purposes of processing, the recipients, and the source of the data.

Section 15 requires the body to give written notice of its access decision within thirty days of the request, extendable by up to thirty days in the listed circumstances, and gives the data subject a right to complain to the Information Commissioner about an extension.

Section 16 lets a body refuse an access request only where it lacks information to identify the requester or locate the data, where compliance would breach a Part IV exemption or a duty of confidentiality, where another identifiable individual has not consented to disclosure, or where the Information Commissioner has not approved the refusal in writing, and gives the data subject a right to complain to the Information Commissioner about a refusal.

Section 17 lets the data subject examine the personal data or obtain a copy, and requires an alternative format for a data subject with a sensory disability where practicable.

Section 18 gives a data subject the right to apply in writing for rectification of personal data they claim is incomplete, incorrect, misleading, excessive, or irrelevant, requires the body to amend the data once satisfied of the claim, and gives a right to complain to the Information Commissioner within twenty eight days of a refusal. No notice appointing the day the Act comes into force has been located.

Sections 23 and 24 make the Information Commissioner the officer appointed under section 35 of the Freedom of Information Act, and give the Information Commissioner functions including monitoring compliance, advising public and private bodies, receiving and investigating complaints, and conducting research and education.

Section 25 lets the Information Commissioner investigate, on a data subject's complaint or on the Commissioner's own initiative, whether a public body or private body has contravened the Act, and requires the Commissioner to notify the data subject of the decision and their right of appeal to the Court. Section 28 lets the Information Commissioner serve an information notice requiring a person to furnish access to personal data, documentation of its processing, or information about its security.

Section 30 lets the Information Commissioner serve an enforcement notice on a body that has contravened or is contravening a provision of the Act whose contravention is an offence, specifying the steps required and the time to take them, including rectifying or erasing personal data, and requires the body to notify the data subject and, where reasonably practicable, anyone the data was disclosed to in the twelve months before the notice, within thirty days of complying if compliance materially modifies the data.

Section 31 lets the Information Commissioner assess a body's processing on request or at the Commissioner's own discretion, and report non-compliance to the body with recommendations. Section 32 lets a data subject who suffers damage from a body's contravention of the Act bring civil proceedings in the Court, subject to a defence that the body took reasonable care to comply.

Section 33 makes it an offence, carrying a fine not exceeding five thousand dollars or imprisonment not exceeding six months, to obstruct the Information Commissioner or an authorised officer. Section 34 bars an employer from dismissing, suspending, demoting, disciplining, harassing, disadvantaging, or denying a benefit to an employee for reporting or refusing to participate in a contravention of the Act in good faith.

Section 35 makes it an offence to wilfully disclose personal information in contravention of the Act, or to collect, store, or dispose of personal information in a manner that contravenes the Act, and section 36 makes it an offence to breach the whistleblower confidentiality obligation section 34 establishes. Section 37 makes an officer, director, or agent of a corporation who directed, authorised, assented to, or participated in an offence the corporation committed a party to that offence.

Section 38 sets the residual penalty for an offence with no penalty otherwise specified at, for an individual, a fine of not more than fifty thousand dollars or imprisonment of three years on summary conviction, or one hundred thousand dollars or five years on indictment, and for a body corporate, two hundred and fifty thousand dollars on summary conviction or five hundred thousand dollars on indictment. No notice appointing the day the Act comes into force has been located.

Section 2 defines sensitive personal data as information about a data subject's physical or mental health or condition, sexual orientation, political opinions, religious or similar beliefs, or the commission or alleged commission of an offence, or any other personal data the Minister determines by order published in the Gazette. Section 20(1) bars a data user from processing sensitive personal data of a data subject except in accordance with the listed conditions.

Section 20(1)(a) permits processing on the data subject's explicit consent, and section 20(1)(b) permits it where necessary for an employment right or obligation, to protect the vital interests of the data subject or another person where consent cannot be given or has been unreasonably withheld, for medical purposes undertaken by a healthcare professional or someone under an equivalent duty of confidentiality, for legal proceedings or advice, for establishing or defending legal rights, for the administration of justice, for a function conferred by law, or for any other purpose the Minister thinks fit.

Section 20(1)(c) also permits processing where the data subject has deliberately made the information public. Section 20(3) makes unlawful processing of sensitive personal data an offence carrying a fine not exceeding two hundred thousand dollars or imprisonment not exceeding two years, or both. No notice appointing the day the Act comes into force has been located.

Section 4 makes it an offence to knowingly access the whole or part of a computer system without lawful excuse or justification, or in excess of one, punishable on summary conviction by a fine of up to five thousand dollars or one year's imprisonment for a first conviction, rising to ten thousand dollars or two years for a subsequent one. Sections 5 and 6 similarly criminalise interfering with data and interfering with a computer system.

Section 11 creates a heavier offence, up to seventy-five thousand dollars or five years for gaining access to a restricted computer system (one the Minister has designated by Order), rising to one hundred thousand dollars or seven years where the access occurs in the course of an offence under sections 4 to 7.

Unlike a computer-misuse offence conditioned on infringing a security measure, section 4's trigger is accessing a system without lawful excuse or justification, which does not by its own terms require circumventing a technical control, so whether reading a public, unauthenticated page falls inside or outside a plain reading of the section is less clear-cut than in a jurisdiction with an explicit security-measure element, and no reported Kittitian or Nevisian case construes the point.

Section 16(1) provides that, unless the parties otherwise agree, an offer and its acceptance may be expressed by an act intended to result in an electronic communication, such as touching or clicking an appropriate icon on a webpage, confirming that a clickwrap acceptance of terms can validly form a contract.

Section 16 does not separately address whether a browsewrap notice, posted without requiring an affirmative click, is enforceable against a person who never accepted it, and no reported case construes that question in this jurisdiction.

Section 17 attributes an electronic record to its originator where it was sent by a person the originator authorised, or by the originator's own 'electronic agent', a program or automated means configured by that person to initiate or respond to an electronic record without individual review.

Section 4(3) makes a compilation of data or other material, in machine-readable or other form, eligible for copyright protection as a literary work only if, by reason of the selection or arrangement of its contents, the compilation constitutes the author's own intellectual creation, and expressly provides that this protection does not extend to any data or other material forming part of the compilation.

The Act creates no separate sui generis database right of the kind some jurisdictions grant to a database's maker regardless of originality, so a non-original compilation, or the underlying data within an original one, is not protected on this ground. The Act was assented to on 25 June 2024 and published in Official Gazette No. 36 of 2024 on 4 July 2024, repealing the prior Copyright Act, Cap. 18.08, but no commencement notice for the Act has been located in the Official Gazette.

The Eastern Caribbean Central Bank issued the Prudential Standard for Electronic Banking in exercise of the powers conferred on it by section 184 of the Banking Act. The standard applies to all institutions licensed under the Banking Act. The standard comes into effect on 1 February 2023.

Paragraph 5.2.1 of the standard requires a licensed financial institution to ensure that the necessary security control infrastructure is in place to secure e-banking systems and data from both internal and external threats. Paragraph 5.2.2 of the standard requires a comprehensive security process, inclusive of policies and procedures that address possible internal and external security threats in terms of incident prevention and the appropriate response.

Paragraph 6.4 of the standard requires the security process implemented by the institution to be submitted to the Central Bank. The standard states that institutions found in violation of it are subject to remedial actions specified in section 75 of the Banking Act.

Section 75(1)(c) of the Banking Act of Saint Kitts and Nevis provides that a licensed financial institution that violates any prudential standard issued by the Central Bank may be subject to the remedial actions specified in section 75(2). Section 75(2) of the Act lets the Central Bank issue a written warning, conclude a written agreement providing for a program of remedial action, issue an order, or issue directions to the management.

Section 80 of the Banking Act of Saint Kitts and Nevis makes it an offence for a licensed financial institution to fail to comply with any requirement or contravene any prohibition imposed on it under the Part of the Act that contains section 80.

Under section 80(a), a licensed financial institution convicted of that offence is liable on summary conviction to a fine of one hundred thousand dollars, with a further penalty of ten thousand dollars for each day a continuing offence continues after conviction.

The Eastern Caribbean Central Bank issued the Prudential Standard on Technology Risk Management in exercise of the powers conferred on it by section 184 of the Banking Act, 2015. The standard comes into effect on 3 January 2023. The standard says it should be applied by all regulated licensed financial institutions, Financial Groups and Conglomerates, unless IT is not a significant function or alternative measures of equal effect have been taken.

The standard says the Board of an institution is ultimately responsible for effective oversight of all IT and cybersecurity risks, systems and processes. The standard says that any deviation from it must be explained in a separate document, to be made promptly available to the ECCB on request. The standard says an institution that relies heavily on its IT systems for daily operations should establish a cybersecurity policy based on its risk assessment.

Section 75(1)(c) of the Banking Act of Saint Kitts and Nevis provides that a licensed financial institution that violates any prudential standard issued by the Central Bank may be subject to the remedial actions specified in section 75(2). Section 75(2) of the Act lets the Central Bank issue a written warning, conclude a written agreement providing for a program of remedial action, issue an order, or issue directions to the management.

Section 80 of the Banking Act of Saint Kitts and Nevis makes it an offence for a licensed financial institution to fail to comply with any requirement or contravene any prohibition imposed on it under the Part of the Act that contains section 80.

Under section 80(a), a licensed financial institution convicted of that offence is liable on summary conviction to a fine of one hundred thousand dollars, with a further penalty of ten thousand dollars for each day a continuing offence continues after conviction.

Section 9(5)(b) of the Virtual Asset Act requires a registrant to implement and maintain measures to protect the operations of the registrant and personal information collected and stored by the registrant from cyber threats. Section 6(2) of the Act requires an application for registration to include policies and procedures for data protection, security and confidentiality and cyber-security safeguards.

The Act applies to any person who offers or operates virtual asset business to residents of Saint Christopher and Nevis or from Saint Christopher and Nevis. Section 16(1)(d) of the Act makes it an offence to otherwise contravene a provision of the Act. Section 16(2) of the Act sets, for an offence for which no penalty is provided, a fine not exceeding one hundred thousand dollars and imprisonment for a period not exceeding five years on summary conviction. The revised edition of the Act shows it in force from 28 January 2020.

The Eastern Caribbean Central Bank issued the Prudential Standard for Electronic Banking in exercise of the powers conferred on it by section 184 of the Banking Act. Paragraph 6.4 of the standard requires all incident reports and the response to be sent to the Central Bank within 3 days of the occurrence. Paragraph 6.4 of the standard also requires any further update on the incident to be reported to the Central Bank.

Paragraph 5.2.7 of the standard requires formal incident response and management procedures for timely reporting and handling of suspected or actual security breaches, fraud, or service interruptions of e-banking services. Paragraph 5.11.2 of the standard requires an incident response plan to include a clear process for alerting the appropriate regulatory authorities in the event of security breaches or disruptive incidents.

The standard states that institutions found in violation of it are subject to remedial actions specified in section 75 of the Banking Act. Section 75(1)(c) of the Banking Act of Saint Kitts and Nevis provides that a licensed financial institution that violates any prudential standard issued by the Central Bank may be subject to the remedial actions specified in section 75(2).

Section 75(2) of the Act lets the Central Bank issue a written warning, conclude a written agreement providing for a program of remedial action, issue an order, or issue directions to the management. Section 80 of the Banking Act of Saint Kitts and Nevis makes it an offence for a licensed financial institution to fail to comply with any requirement or contravene any prohibition imposed on it under the Part of the Act that contains section 80.

Under section 80(a), a licensed financial institution convicted of that offence is liable on summary conviction to a fine of one hundred thousand dollars, with a further penalty of ten thousand dollars for each day a continuing offence continues after conviction.

The Eastern Caribbean Central Bank issued the Prudential Standard on Technology Risk Management in exercise of the powers conferred on it by section 184 of the Banking Act, 2015. Paragraph 12.8.1 of the standard provides that within 24 hours of becoming aware of a cyber-incident, an institution shall alert the ECCB and its Information Security User Group that a cyber-incident occurred.

Paragraph 12.8.1 of the standard also says the compromised institution should complete the incident report in Appendix I and submit it to the ECCB within 48 hours of the incident. The standard lists among the responsibilities of Senior Management notifying directly the customers whose accounts were potentially or actually compromised within seventy-two hours of the discovery of the incident.

The standard lists among the responsibilities of Senior Management notifying the general public about a cybersecurity incident only after notifying the ECCB. Paragraph 12.8.4 of the standard provides that an institution shall provide an update on the incident to the ECCB at a frequency determined by the ECCB. Paragraph 12.8.5 of the standard provides that following the resolution of the cyber-incident an institution shall conduct a post-incident review and submit it to the ECCB.

Section 75(1)(c) of the Banking Act of Saint Kitts and Nevis provides that a licensed financial institution that violates any prudential standard issued by the Central Bank may be subject to the remedial actions specified in section 75(2). Section 75(2) of the Act lets the Central Bank issue a written warning, conclude a written agreement providing for a program of remedial action, issue an order, or issue directions to the management.

Section 80 of the Banking Act of Saint Kitts and Nevis makes it an offence for a licensed financial institution to fail to comply with any requirement or contravene any prohibition imposed on it under the Part of the Act that contains section 80.

Under section 80(a), a licensed financial institution convicted of that offence is liable on summary conviction to a fine of one hundred thousand dollars, with a further penalty of ten thousand dollars for each day a continuing offence continues after conviction.

Section 53(1) permits, without infringing copyright or related rights, fair dealing with a work for the purposes of criticism or review of that or another work, or fair dealing with a work other than a photograph for the purpose of reporting current events, so long as it is accompanied by sufficient acknowledgment (defined in section 51 as identifying the work by its title and identifying the author, subject to exceptions).

Section 55 sets the general factors for determining fair dealing across the Act's exceptions: the nature of the work, the extent and substantiality of the part used relative to the whole, the purpose and character of the use, and the effect on the potential market for or value of the work.

The Act carries no headline-length or short-extract cap distinct from this fair-dealing test, and no reported decision in this jurisdiction applies section 53 to a systematic news aggregator rather than an individual quoting a published work. The Act's neighbouring rights, covering performers and producers of sound recordings, do not extend to a print or online news publisher's own reporting. No commencement notice for the Act has been located in the Official Gazette.