Marshall Islands

Sections 401 to 405 apply this Chapter to core Government ministries and agencies of the Republic that collect, use, store, process, disclose, or transfer personal data of natural persons, and their definitions of data controller and data processor extend to a third party acting on behalf of such a ministry or agency; the Chapter excludes processing for law enforcement or national intelligence and national security purposes, non-personal data, and publicly available information lawfully obtained from government records, voluntarily made available by the data subject without audience restriction, or otherwise lawfully obtained, truthful, and a matter of public concern.

Section 409 sets six personal data protection principles binding core Government ministries and agencies: a legitimate-purpose principle requiring lawful, fair, transparent processing for specified purposes; a data-minimization principle limiting collection to what the purpose requires; an accuracy principle requiring inaccurate personal data to be corrected or deleted without delay; a retention principle limiting storage to what the purpose requires; an integrity and security principle requiring technical and organizational protection against unauthorized or unlawful processing and unintentional loss, destruction, or damage, and limiting staff access to what their duties need; and an accountability principle making the data controller responsible for demonstrating compliance.

Section 415 lets core Government ministries and agencies voluntarily share personal data with each other under a safe harbor, provided the sharing serves a legitimate function of each ministry or agency and complies with the section 409 principles, and lets the competent authority set standards for such sharing agreements.

Section 418 states the Chapter takes effect twelve months after the date of its certification under Article IV, section 21 of the Constitution, which the Act's own commencement note records as 7 October 2025. The Act states no consent requirement, no data-subject access, correction, deletion, or portability right, no heightened rule for sensitive or biometric data beyond the definition, and no cross-border transfer restriction.

Section 250.12(1) makes it a misdemeanor, except as authorized by law, to trespass on property with intent to subject anyone to eavesdropping or other surveillance in a private place, to install in a private place, without the consent of the person entitled to privacy there, a device for observing, photographing, recording, amplifying, or broadcasting sounds or events, or to install or use outside a private place a device for hearing, recording, amplifying, or broadcasting sounds originating in that place that would not ordinarily be audible or comprehensible outside, again without that person's consent; a private place is one a person may reasonably expect to be safe from casual or hostile intrusion or surveillance, but does not include a place to which the public or a substantial group of the public has access.

Section 250.12(2)(a) separately makes it a misdemeanor to knowingly intercept, without the consent of the sender or receiver, a message by telephone, telegraph, facsimile, electronic mail, letter, or other means of communicating privately, an offence that does not extend to overhearing a message through a regularly installed telephone party line or extension, or to an interception by the telephone company or a subscriber incident to enforcing regulations that limit use of the facilities.

Section 250.12(2)(b) makes it a misdemeanor to divulge the existence or contents of such a message without the consent of the sender or receiver, where the person divulging it knows the message was illegally intercepted, or learned of it in the course of employment with an agency engaged in transmitting it.

The section states no penalty of its own; a misdemeanor under the Code's general sentencing provisions carries a fine of up to $1,000 and a definite term of imprisonment, fixed by the court, of up to one year.

Section 406 designates the Economic Policy, Planning and Statistics Office (EPSSO) as the competent authority responsible for administering this Chapter, and section 407 gives it power to develop guidance and capacity-building initiatives, coordinate data sharing among ministries and agencies, require information from them as needed to comply with this Chapter, and make rules or regulations for its implementation.

Section 408 requires any director, employee, consultant, or other person engaged by the competent authority under this Chapter to maintain confidentiality of personal data obtained in the performance of their duties.

Section 410 lets a natural person residing in the Republic who suffers an injury from a core Government ministry's or agency's alleged improper administration of the Chapter bring suit against that ministry or agency, and separately lets that person sue an employee of the public service personally, in the employee's own capacity, for willful or grossly negligent conduct causing the injury, including for compensatory damages against the employee.

Section 411 lists the remedies a court may impose on the ministry or agency itself, an injunction, mandamus, a corrective order, or a public statement of remedy, but bars a court from awarding compensatory relief against the ministry or agency itself. Section 412 requires the competent authority to report yearly to the Minister for presentation to the Nitijela on this Chapter's implementation.

Section 413 requires core Government ministries and agencies to compile and record each calendar year the policies and actions taken to implement the Chapter and the complaints received, and to report that information to the competent authority by July 1 of each year in anonymized form.

Section 414 requires each ministry and agency to establish a process for a natural person residing in the Republic to submit a complaint about an alleged violation, consistent with the competent authority's guidance. Section 417 lets the competent authority, with Cabinet approval, make regulations for the Chapter's effective performance. The Chapter states no penalty or offence provision of its own.

Section 406 requires the owner of a computer or computer system the Director of the Office of National Security has designated critical information infrastructure under section 405 to implement technical, operational, and organizational measures to manage the cybersecurity risks that may affect it, and measures to prevent and mitigate the impact of a cybersecurity incident or threat.

At minimum the owner must conduct rolling cybersecurity risk assessments at a frequency the Chief Information Security Officer prescribes and develop internal cybersecurity policies and procedures, an internal incident-reporting policy, and an internal cybersecurity awareness program. No later than thirty days after completing that risk assessment, the owner must transmit a copy of the resulting cybersecurity mitigation actions to the Director.

The Director may also order, at the owner's own cost and no more than once every two years, an audit of the critical information infrastructure where the Director has reason to believe the owner has not complied with the Act. A person who intentionally and without reasonable excuse fails to comply with this section's obligations commits a petty misdemeanor, and a corporation may separately be convicted of an offense under this Act.

Section 407 requires the same designated owner of critical information infrastructure to immediately notify the Director of the Office of National Security and the computer security incident response team (CSIRT)-MH of a significant cybersecurity incident affecting the critical information infrastructure, of a significant incident on any interconnected computer system under the owner's control, or of any other incident type the Director specifies by written order.

To comply, the owner must submit an early warning within twenty-four hours of becoming aware of the incident, a fuller notification with an initial severity and impact assessment within seventy-two hours, and a final report within thirty days of that notification, or, for an ongoing incident, a thirty-day progress report followed by a final report within thirty days of the incident's resolution.

The owner must also establish mechanisms and processes to promptly detect a cybersecurity threat, vulnerability, or incident affecting the critical information infrastructure. A person who intentionally and without reasonable excuse fails to make a notification under this section commits a petty misdemeanor.