Tuvalu

Tuvalu has no scraping-specific statute and no dedicated computer-misuse law: the Penal Code (1965) predates computers and contains no unauthorised-access, hacking, or cybercrime provision, and a draft Cybersecurity Bill had not been tabled in Parliament.

The closest analogue is the Tuvalu Telecommunications Corporation Act 1993, which criminalises intentionally intercepting, disclosing, or interfering with a message carried on the state telecommunications system and operating a competing telecommunications service without authorisation; its offences are aimed at the state telecommunications monopoly rather than at unauthorised computer access generally, and no reported case has applied it to web crawling.

No Tuvaluan court has ruled on the enforceability of a browsewrap or clickwrap terms-of-service against a scraper. The Copyright Ordinance (Chapter 40.24, Revised Edition 2008) sets local infringement penalties and incorporates the United Kingdom Copyright Act 1956's importation-restriction provision, but its own text carries no text-and-data-mining exception, and Tuvalu's copyright statute confers no sui generis database right.

No statute or reported case establishes a scraping-specific unfair-competition or misappropriation doctrine, and none assigns legal weight to a robots.txt directive or imposes an AI-training-specific rule.

Tuvalu's Telecommunications Corporation Act 1993 (Act 4 of 1993), as amended by the Telecommunications Corporation (Amendment) Act 2012, is the country's only telecommunications statute and creates no safeguards duty on the Tuvalu Telecommunications Corporation or on any licensed operator comparable to Liberia's Telecommunications Act 2007 section 51(5) or Solomon Islands' Telecommunications Act 2009 section 72(1)(b): its Part V offences provision, section 33, lists acts committed against a telecommunications system (dishonestly obtaining service, sending an offensive or false message, intercepting or disclosing a message, damaging or interfering with telecommunication apparatus, assisting an unlicensed station, and similar conduct), each binding the person who commits the act against the system rather than binding the Corporation's or an operator's own security posture, so the whole of Part V belongs to the scraping topic's computer-misuse family rather than to this one.

The three subsidiary regulations made under the Act (the Telephone Regulations, the Telecommunications (Radio) Regulations, and the Television Licence Regulations) govern service contracts, radio licensing and interference, and broadcast licensing respectively, and none imposes a security-safeguards, vulnerability-handling, or incident-reporting duty on the Corporation, a licensee, or a manufacturer.

The 2012 amendment ended the Corporation's exclusive right to supply telecommunications services and let the Minister license other providers, but its own text adds no safeguards obligation to either the Corporation or a newly licensed provider.

The Foreign Direct Investment Act 1996 mentions security once, in a Companies Act amendment requiring a foreign investor to supply "financial, character, and security information" when registering a company, a personal background-check disclosure rather than any criterion tied to a system's or product's security posture, so it sets no security-of-systems gate on an investment incentive.

A Data Protection and Privacy Act 2020 is named in secondary commentary on Tuvalu's digital-government initiatives, but its enactment could not be confirmed against a primary source: PacLII's own Tuvalu sessional and consolidated legislation index pages both return a Cloudflare CAPTCHA challenge on direct request, a stop rather than a wall to read past, and the Wayback Machine's archived crawl of every slug PacLII has ever served under its Tuvalu sessional and 2008 consolidated legislation paths, a set spanning acts from 1917 to 2021, contains no entry beginning with "data", "privacy", "cyber", or any "d"-initial acronym for 2020.

The World Intellectual Property Organization's WIPO Lex member profile for Tuvalu, which lists 23 national laws across IP, framework and other categories, does not list a data-protection or cybersecurity statute either. Whether the Data Protection and Privacy Act 2020 was in fact enacted, and if so what security-of-processing or safeguards duty it might carry, is an open research gap rather than a confirmed absence.

No Cybercrime Act or standalone cybersecurity statute for Tuvalu was located by the same slug-level check of PacLII's archived Tuvalu legislation, though the CAPTCHA wall on PacLII's own live index means that check cannot rule out a very recently enacted instrument PacLII has not yet had crawled.

Tuvalu has no telecommunications regulator independent of the Corporation and the responsible Minister: the Act's own section 10 subjects the Corporation to ministerial policy direction, and the 2012 amendment vests the power to license a second operator in the Minister rather than in a separate regulatory body, so there is no regulator publishing a network-security code or licence condition to check as a distinct source.

The Banking Commission Act's security duties on banks that offer computer access and on Internet banks (sections 38(4) and 39) are filed as a row of their own. Section 38(4) of the Banking Commission Act provides that banks providing computer access must maintain adequate security for their Internet or proprietary platforms.