Saint Kitts and Nevis

Section 12 makes it an offence for a person to knowingly publish child pornography through a computer system, produce it for the purpose of publication through a computer system, or possess it in a computer system or on a data storage medium for the purpose of publication, punishable on conviction on indictment by a fine of up to fifty thousand dollars or five years' imprisonment for an individual, or a fine of up to two hundred and fifty thousand dollars for a corporation.

Section 12(3) defines child pornography to include material that visually depicts a minor engaged in sexually explicit conduct, a person who appears to be a minor engaged in sexually explicit conduct, or a realistic image representing a minor engaged in sexually explicit conduct, a definition that does not require the depicted subject to be a real, identifiable child, so a wholly computer-generated or AI-synthesised depiction meeting it can fall within the ban.

A defence applies to publishing and possession, but not to production, where the material was for a bona fide scientific, research, medical or law enforcement purpose.

A note in the Revised Laws text records that the current section 12 was formerly section 13, the original section 12 having been repealed and sections 13 and 14 renumbered by Act 26 of 2012; whether the child-pornography definition's own wording changed at that renumbering, or was carried forward unchanged from the Act's original 2009 text, is not established in the available sources.

Section 4 applies the Act to a private body processing personal data in respect of commercial transactions, and to any other person meeting a territorial nexus test tied to establishment in Saint Christopher and Nevis or use of equipment there. Section 6 binds the State. Section 7(1) requires a data user to obtain a data subject's consent before processing personal data other than sensitive personal data, or to process sensitive personal data only in accordance with section 20.

Section 7(2) lets a data user process personal data without consent where necessary for a contract, a legal obligation other than a contractual one, the vital interests of the data subject, the administration of justice, or a function conferred by law, and section 7(3) requires the processing to be for a lawful purpose directly related to the data user's activity, necessary for or directly related to that purpose, and adequate but not excessive.

Section 8 requires a data user, on a request for personal data, to tell the data subject the purposes of collection, the source of the data where available, the right to request access and correction, the classes of third party to whom it may be disclosed, and whether supplying the data is obligatory or voluntary.

Section 9 bars disclosure of personal data without the data subject's consent for a purpose other than the one it was collected for or a directly related purpose, or to a class of third party not specified under section 8(d). Section 19 lists the circumstances, including the data subject's consent, crime prevention or detection, legal authorisation, and the public interest, in which such a further disclosure is permitted.

Section 10 requires a data user to take practical steps to protect personal data from loss, misuse, unauthorised access, alteration or destruction, and requires a data processor engaged by the data user to give sufficient security guarantees and to comply with them. Section 11 bars keeping personal data longer than the purpose requires and requires a data user to take reasonable steps to destroy or permanently delete personal data no longer needed.

Section 12 requires a data user to take reasonable steps to keep personal data accurate, complete, not misleading and up to date.

Section 21 exempts personal data processed for an individual's own personal, family or household affairs from the Act entirely, and, subject to listed conditions, exempts data processed for crime prevention or detection, taxation, statistics or research, a court order or judgment, regulatory functions, or journalistic, literary or artistic purposes from some or all of the Act's other principles.

Section 1(2) provides that the Act comes into force on a day fixed by the Minister by Order published in the Gazette, and no commencement order has been located, so the Act's substantive duties are not yet confirmed to be in operation.

Section 13 gives a data subject the right to be given access to their personal data held by a data user and to have it corrected where inaccurate, incomplete, misleading or out of date, except where an access or correction request is refused under the Act.

Section 14 requires a public body or private body, on a data subject's written request and payment of the prescribed fee, to confirm whether it holds their personal data and, if so, to describe the data, the purposes of processing, the recipients, and the source of the data.

Section 15 requires the body to give written notice of its access decision within thirty days of the request, extendable by up to thirty days in the listed circumstances, and gives the data subject a right to complain to the Information Commissioner about an extension.

Section 16 lets a body refuse an access request only where it lacks information to identify the requester or locate the data, where compliance would breach a Part IV exemption or a duty of confidentiality, where another identifiable individual has not consented to disclosure, or where the Information Commissioner has not approved the refusal in writing, and gives the data subject a right to complain to the Information Commissioner about a refusal.

Section 17 lets the data subject examine the personal data or obtain a copy, and requires an alternative format for a data subject with a sensory disability where practicable.

Section 18 gives a data subject the right to apply in writing for rectification of personal data they claim is incomplete, incorrect, misleading, excessive, or irrelevant, requires the body to amend the data once satisfied of the claim, and gives a right to complain to the Information Commissioner within twenty eight days of a refusal.

Sections 23 and 24 make the Information Commissioner the officer appointed under section 35 of the Freedom of Information Act, and give the Information Commissioner functions including monitoring compliance, advising public and private bodies, receiving and investigating complaints, and conducting research and education.

Section 25 lets the Information Commissioner investigate, on a data subject's complaint or on the Commissioner's own initiative, whether a public body or private body has contravened the Act, and requires the Commissioner to notify the data subject of the decision and their right of appeal to the Court. Section 28 lets the Information Commissioner serve an information notice requiring a person to furnish access to personal data, documentation of its processing, or information about its security.

Section 30 lets the Information Commissioner serve an enforcement notice on a body that has contravened or is contravening a provision of the Act whose contravention is an offence, specifying the steps required and the time to take them, including rectifying or erasing personal data, and requires the body to notify the data subject and, where reasonably practicable, anyone the data was disclosed to in the twelve months before the notice, within thirty days of complying if compliance materially modifies the data.

Section 31 lets the Information Commissioner assess a body's processing on request or at the Commissioner's own discretion, and report non-compliance to the body with recommendations. Section 32 lets a data subject who suffers damage from a body's contravention of the Act bring civil proceedings in the Court, subject to a defence that the body took reasonable care to comply.

Section 33 makes it an offence, carrying a fine not exceeding five thousand dollars or imprisonment not exceeding six months, to obstruct the Information Commissioner or an authorised officer. Section 34 bars an employer from dismissing, suspending, demoting, disciplining, harassing, disadvantaging, or denying a benefit to an employee for reporting or refusing to participate in a contravention of the Act in good faith.

Section 35 makes it an offence to wilfully disclose personal information in contravention of the Act, or to collect, store, or dispose of personal information in a manner that contravenes the Act, and section 36 makes it an offence to breach the whistleblower confidentiality obligation section 34 establishes. Section 37 makes an officer, director, or agent of a corporation who directed, authorised, assented to, or participated in an offence the corporation committed a party to that offence.

Section 38 sets the residual penalty for an offence with no penalty otherwise specified at, for an individual, a fine of not more than fifty thousand dollars or imprisonment of three years on summary conviction, or one hundred thousand dollars or five years on indictment, and for a body corporate, two hundred and fifty thousand dollars on summary conviction or five hundred thousand dollars on indictment.

Section 2 defines sensitive personal data as information about a data subject's physical or mental health or condition, sexual orientation, political opinions, religious or similar beliefs, or the commission or alleged commission of an offence, or any other personal data the Minister determines by order published in the Gazette. Section 20(1) bars a data user from processing sensitive personal data of a data subject except in accordance with the listed conditions.

Section 20(1)(a) permits processing on the data subject's explicit consent, and section 20(1)(b) permits it where necessary for an employment right or obligation, to protect the vital interests of the data subject or another person where consent cannot be given or has been unreasonably withheld, for medical purposes undertaken by a healthcare professional or someone under an equivalent duty of confidentiality, for legal proceedings or advice, for establishing or defending legal rights, for the administration of justice, for a function conferred by law, or for any other purpose the Minister thinks fit.

Section 20(1)(c) also permits processing where the data subject has deliberately made the information public. Section 20(3) makes unlawful processing of sensitive personal data an offence carrying a fine not exceeding two hundred thousand dollars or imprisonment not exceeding two years, or both.

Section 4 makes it an offence to knowingly access the whole or part of a computer system without lawful excuse or justification, or in excess of one, punishable on summary conviction by a fine of up to five thousand dollars or one year's imprisonment for a first conviction, rising to ten thousand dollars or two years for a subsequent one. Sections 5 and 6 similarly criminalise interfering with data and interfering with a computer system.

Section 11 creates a heavier offence, up to seventy-five thousand dollars or five years for gaining access to a restricted computer system (one the Minister has designated by Order), rising to one hundred thousand dollars or seven years where the access occurs in the course of an offence under sections 4 to 7.

Unlike a computer-misuse offence conditioned on infringing a security measure, section 4's trigger is accessing a system without lawful excuse or justification, which does not by its own terms require circumventing a technical control, so whether reading a public, unauthenticated page falls inside or outside a plain reading of the section is less clear-cut than in a jurisdiction with an explicit security-measure element, and no reported Kittitian or Nevisian case construes the point.

Section 16(1) provides that, unless the parties otherwise agree, an offer and its acceptance may be expressed by an act intended to result in an electronic communication, such as touching or clicking an appropriate icon on a webpage, confirming that a clickwrap acceptance of terms can validly form a contract.

Section 16 does not separately address whether a browsewrap notice, posted without requiring an affirmative click, is enforceable against a person who never accepted it, and no reported case construes that question in this jurisdiction.

Section 17 attributes an electronic record to its originator where it was sent by a person the originator authorised, or by the originator's own 'electronic agent', a program or automated means configured by that person to initiate or respond to an electronic record without individual review.

Section 4(3) makes a compilation of data or other material, in machine-readable or other form, eligible for copyright protection as a literary work only if, by reason of the selection or arrangement of its contents, the compilation constitutes the author's own intellectual creation, and expressly provides that this protection does not extend to any data or other material forming part of the compilation.

The Act creates no separate sui generis database right of the kind some jurisdictions grant to a database's maker regardless of originality, so a non-original compilation, or the underlying data within an original one, is not protected on this ground. The Act was assented to on 25 June 2024 and published in Official Gazette No. 36 of 2024 on 4 July 2024, repealing the prior Copyright Act, Cap. 18.08, but its text does not separately state a commencement day distinct from its enactment.

Section 53(1) permits, without infringing copyright or related rights, fair dealing with a work for the purposes of criticism or review of that or another work, or fair dealing with a work other than a photograph for the purpose of reporting current events, so long as it is accompanied by sufficient acknowledgment (defined in section 51 as identifying the work by its title and identifying the author, subject to exceptions).

Section 55 sets the general factors for determining fair dealing across the Act's exceptions: the nature of the work, the extent and substantiality of the part used relative to the whole, the purpose and character of the use, and the effect on the potential market for or value of the work.

The Act carries no headline-length or short-extract cap distinct from this fair-dealing test, and no reported decision in this jurisdiction applies section 53 to a systematic news aggregator rather than an individual quoting a published work. The Act's neighbouring rights, covering performers and producers of sound recordings, do not extend to a print or online news publisher's own reporting.