Solomon Islands

Section 72(1) bars a telecommunications service provider from collecting, using, maintaining, or disclosing information about a consumer for any purpose without that consumer's consent, subject to a narrow exception permitting disclosure of a consumer's name, address, and listed telephone number in a directory.

Section 72(3) lets the Telecommunications Commission order a service provider to retain, or to stop retaining beyond a specified period, specified information relating to a consumer, including billing information. Section 120(1)(k) makes failing to comply with an order made under section 72(3) an offence.

Section 72(4)-(6) requires the information to be accurate and complete, lets a consumer inspect the provider's records about them and require correction or removal of incorrect information, and requires the provider to disclose the purpose of collection and not use the information for an undisclosed purpose.

Section 73(1) requires a service provider to take all reasonable steps to ensure the confidentiality of a consumer's communications, and section 73(2) bars intercepting, monitoring, altering, or modifying the content of a message except as authorised under section 97 or another law. Section 120(1)(j) of Part 19 makes a contravention of section 72(1) or section 73(2) an offence, and section 121 sets the penalty.

Section 74 preserves the lawful access rights of government authorities under other Solomon Islands law, so the confidentiality duty does not itself restrict lawful government access. These duties bind a person licensed as a telecommunications service provider in that person's dealings with its own consumers; the Act does not create a general personal-data duty reaching a business outside the telecommunications sector. Section 4 provides that the Act binds the Crown, so these duties are not confined to private service providers.

Section 120(1) makes it an offence to, among other things: intentionally and without right or with dishonest or otherwise wrongful intent, access the whole or any part of any telecommunications facilities by infringing a security measure, with the intent of obtaining telecommunications data (paragraph (b)); or intercept by technical means a transmission not intended for the accused or for public reception, except as authorised (paragraph (c)).

Paragraph (d) separately makes it an offence to damage, delete, deteriorate, alter or suppress telecommunications data without right and with dishonest or otherwise wrongful intent, where this results in serious harm. Paragraph (e) makes it an offence to seriously hinder the functioning of any telecommunications facilities by inputting, transmitting, damaging, deleting, deteriorating, altering or suppressing telecommunications data, without right and with dishonest or otherwise wrongful intent.

Section 121 sets the penalty. The Act's stated purpose is to regulate the telecommunications sector and establish the Telecommunications Commission, and section 120's operative terms are "telecommunications facilities" and "telecommunications data" rather than a computer system generally. Section 1 provides that the Act commences on a date appointed by the Minister by notice in the Gazette. Legal Notice No. 561 of 2009 appoints 11 September 2009 as that date.

Prudential Guideline No. 13 on Information Technology Security Risk Management applies to financial institutions licensed and deemed licensed by the Central Bank of Solomon Islands. A financial institution must mitigate in its information technology security risk management existing internal and external threats such as unauthorised access to critical financial data, service interruptions, impersonating clients and theft or alteration of information.

It must have a proper plan in place to respond to an adverse event, and must submit to the Central Bank a copy of its IT security risks, including risk profiles, exposure analysis and incident analysis. A financial institution that fails to comply is considered in breach and shall be subject to a monetary penalty, and the Central Bank shall pursue the corrective measures in section 16 of the Financial Institutions Act 1998 (as amended). The guideline was issued on 16 April 2018 and its effective date is July 1, 2018.

Prudential Guideline No. 20 on Cybersecurity, which describes itself as a Prudential Standard, applies to financial institutions licensed and deemed licensed by the Central Bank of Solomon Islands under the Financial Institutions Act 1998 (as amended) or any other relevant laws, and is issued under section 28(1) of the Central Bank of Solomon Islands Act 2012.

A financial institution must have a framework for cybersecurity risk management, which should be an integral part of its enterprise risk management framework, and the framework must be documented, approved by the board and reviewed regularly. It must have a designated cybersecurity risk management function headed by a Chief Information Security Officer or an equivalent senior officer.

It must obtain information about technical vulnerabilities of its information systems in a timely fashion and must test and evaluate security updates before installing them on critical systems. A financial institution that fails to comply is considered in breach and may be subject to a monetary penalty, and the Central Bank may pursue the corrective measures in section 16 of the Financial Institutions Act 1998 (as amended). The standard's effective date is October 1, 2020.

Section 72(1) of Part 11 (Relations with Consumers) binds a telecommunications service provider with two duties under the same subsection: paragraph (a) bars collecting, using, maintaining, or disclosing a consumer's information without consent, already researched as this jurisdiction's privacy row, and paragraph (b), researched here, separately requires the service provider to apply appropriate security safeguards to prevent the collection, use, maintenance, or disclosure of that information.

Section 120(1)(j) of Part 19 makes a contravention of section 72(1), covering both paragraphs, a criminal offence, and section 121 sets the penalty. Section 113(2) of Part 18 separately makes any contravention of the Act, including of paragraph (b), a civil violation. Section 117 lets a person who sustained loss or damage from a violation sue in court to recover an amount equal to that loss from the person who committed or is vicariously liable for it.

Section 119 bars proceeding against the same contravention as both an offence and a violation. The Telecommunications Commission of Solomon Islands enforces the Act generally, including this duty, and no order, direction, or regulation implementing paragraph (b)'s safeguards standard was found in the Commission's own published library. Section 1 sets the Act's own commencement as a date the Minister appoints by notice in the Gazette. Legal Notice No. 561 of 2009 appoints 11 September 2009 as that date.

Under paragraph 112 of Prudential Guideline No. 20 on Cybersecurity, a financial institution licensed or deemed licensed by the Central Bank of Solomon Islands must notify the Central Bank as soon as possible but not later than sixty minutes after becoming aware of an information security incident that materially affects or has the potential to materially affect, financially or non-financially, the institution or the interests of depositors.

Paragraph 111 also requires quarterly reporting on all cybersecurity incidents in the format prescribed in Appendix I. A financial institution that fails to comply is considered in breach and may be subject to a monetary penalty, and the Central Bank may pursue the corrective measures in section 16 of the Financial Institutions Act 1998 (as amended). The standard's effective date is October 1, 2020.

Section 7(1) of the Copyright Act (Chapter 138) permits, without infringing copyright, fair dealing with a literary, dramatic, musical or artistic work for the purposes of research or private study, or for criticism or review, if accompanied by a sufficient acknowledgement.

Section 7(2) separately permits fair dealing with a literary, dramatic or musical work for the purpose of reporting current events in a newspaper, magazine or similar periodical, or by means of broadcasting or in a cinematograph film, again if accompanied by a sufficient acknowledgement. Neither provision states a headline-length or short-extract cap distinct from the fair-dealing and acknowledgement conditions themselves.

"Literary work" is defined in section 2 to include any written table or compilation, so a compilation of news content attracts ordinary copyright protection under the Act. The Act's other Parts create neighbouring rights only for sound recordings, cinematograph films, broadcasts, and published editions, not for a news publisher's compiled text distinct from the copyright it holds as author or assignee of the underlying articles.