Samoa

Section 82(1) makes it an offence, punishable by imprisonment of up to 7 years, for a person without lawful justification to sell, distribute, exhibit, print, possess, communicate, produce, offer, or knowingly access indecent material on a child, including through an electronic system.

Section 82(2) defines child pornography as pornographic material that depicts, presents, or represents a child engaged in sexually explicit conduct, a person appearing to be a child engaged in sexually explicit conduct, or images representing a child engaged in sexually explicit conduct, and includes any audio, visual, or text pornographic material, so the offence reaches a computer-generated, simulated, or otherwise synthetic depiction of a child in sexually explicit conduct as well as a photograph of a real child. The section defines a child as a person 16 years and under.

Section 48 requires a relying party to notify the Registrar General of a personal data breach within 72 hours of becoming aware of it, describing the categories and approximate number of registered persons and personal data records concerned, and to respond without undue delay to the Registrar General's information requests.

Section 49 requires the Registrar General, on learning of a breach likely to result in a high risk to a registered person's rights, to communicate the breach to that person without undue delay in plain language, including advice on mitigating measures, or, where direct communication is not feasible, through public media.

Section 50 requires every such notification to name the notifying entity's contact details, describe the breach's likely consequences and the measures taken or proposed to address it, and requires the Registrar General, relying parties, and data processors to keep a record of all personal data breaches sufficient to demonstrate compliance.

Section 56 separately makes it an offence for a person engaged for the purposes of the Act, a relying party, a data processor, or any other person to disclose, transmit, copy, or otherwise disseminate personal data collected or processed under the Act to an unauthorised person without lawful excuse.

Section 48 bars a telecommunications service provider from disclosing information concerning a customer without the customer's written consent, unless disclosure is required or permitted by the Regulator or by law, and gives the customer a right to inspect the provider's records concerning them.

Section 49 requires a service provider to take all reasonable steps to keep customer communications confidential and bars intercepting, monitoring, altering, or modifying their content except for tracing harassing or illegal calls or as otherwise permitted by the Act. Section 50 requires a service provider to operate its network with due regard for customer privacy and to identify the purposes for which customer information is collected at or before collection.

Except as permitted or required by law or with the customer's consent, a service provider must not collect, use, maintain, or disclose customer information for an undisclosed purpose. Sections 75A and 75B separately make it an offence for a service provider's employee, without good and sufficient cause, to divulge information overheard from a telephone conversation or to disclose or use a customer's affairs or personal particulars obtained in the course of duties.

Section 51(1) gives a registered person the right to obtain from the Registrar General or a relying party, without constraint or unreasonable delay and at no expense, confirmation of whether their personal data is being processed, a copy of it in a paper-based or commonly used electronic format, correction or deletion of inaccurate, out-of-date, incomplete, or misleading data, and detailed information on what data has been accessed, by whom, for what purpose and duration, how long it will be stored, and whether any profiling or automated decision-making process is being applied to it.

Section 51(2) requires the Registrar General and a relying party to implement measures enabling a registered person to exercise these rights effectively. Section 52 clarifies that registration confers no right of citizenship, and section 53 lets a registered person raise a grievance over any improper use of their data.

Section 54(1) makes a relying party or data processor that fails to comply with any provision of the Act or its regulations liable on conviction to a fine of up to 500 penalty units for a first failure and up to 1,000 penalty units for any later failure. Section 54(2) lets the Registrar General require relying parties and data processors at any time to provide information about their activities under the Act, to verify their compliance.

Section 54(3) requires the Registrar General, on reason to believe that a relying party or data processor has not complied, to notify the appropriate authority and assist it in any investigation. Section 58(1) makes an offence under section 55, 56 or 57 punishable on conviction by a fine of up to 150 penalty units or imprisonment of up to seven years, or both. Section 58(2) sets the same penalty for any other offence under the Act or its regulations for which no specific penalty is provided.

Section 27(4) bars the Identity Database from containing any biometric data or data that directly identifies an individual's race, religion, ethnicity, language, income or medical history. Section 27(3) limits the Identity Database to the data it lists, which are the Samoa Digital Identification Number and any associated token, name, date of birth, place of birth, sex, home address, names of parents, date of death, and data about issued, revoked or cancelled ID credentials.

Section 206 makes it an offence, punishable by imprisonment of up to 7 years, to intentionally access, directly or indirectly, an electronic system without authorisation, or being reckless as to whether the person is authorised, and section 207 similarly bars accessing an electronic system dishonestly or by deception to obtain a benefit or cause loss.

Section 208 bars logging into and remaining logged into, or continuing to access, an electronic system without lawful excuse, and section 209 bars intercepting a non-public transmission of electronic data or the electromagnetic emissions of an electronic system without right and with dishonest intent.

Sections 210 to 212 bar damaging, deleting, or altering electronic data, illegally acquiring electronic data that is specially protected against unauthorised access, and interfering with an electronic system so as to endanger life or affect critical infrastructure. Section 213 bars producing, selling, or distributing a device or access code designed or intended for use in committing one of these offences.

Each of sections 206 to 213 is punishable by imprisonment for a term not exceeding 7 years, with no fine stated as an alternative, and section 214 separately punishes making, selling, distributing, or possessing software for committing a crime by the same 7-year term.

None of the exceptions in section 206(2) or 207(3), covering a person already authorised to access the system for another purpose, or a law-enforcement agency acting under a warrant, reaches an outside crawler accessing a page it has no security-measure-based authorisation to access.

Section 4(1) provides that nothing in the Act requires a person to use, provide, or accept an electronic record without that person's consent, and section 4(2)(b) provides that consent may be inferred from a person's conduct, so a browsewrap-style acceptance by continued use of a service may satisfy a consent requirement without a signed or clicked agreement.

Section 8 lets an electronic signature satisfy a legal requirement for a signature where it adequately identifies the signatory, indicates approval, is as reliable as appropriate to the purpose, and the recipient consents to receiving it, with reliability presumed where the means of creating the signature is linked to and under the control of the signatory alone and no alteration is detectable after signing.

Section 5 makes the Act binding on the Government, subject to an exception for the Controller and Auditor General. The Act creates no offence and states no penalty for its own breach.

Section 4(1)(b) protects, as a derivative work, a collection of works and a collection of mere data, including a database, whether in machine-readable or other form, provided the collection is original by reason of the selection, coordination, or arrangement of its contents. Section 3(2) confirms that a work, and by extension a qualifying collection, is protected by the sole fact of its creation, irrespective of its mode or form of expression, content, quality, or purpose.

The protection under section 4(1)(b) attaches only where the collection is original by reason of the selection, coordination, or arrangement of its contents, so a scraper that extracts the underlying data without copying that original selection or arrangement is not reached by it.

Prudential Statement 11 applies to all entities licensed under the Financial Institutions Act 1996. Paragraph 1 of Prudential Statement 11 requires a licensed financial institution to have a framework for cybersecurity risk management, which should be an integral part of its enterprise risk management framework. Paragraph 2 of Prudential Statement 11 requires the framework to be documented and approved by the Board and reviewed regularly.

Paragraph 3 of Prudential Statement 11 requires a licensed financial institution to have a designated cybersecurity risk management function. Paragraph 3(e) of Prudential Statement 11 requires the function to be headed by a person designated as the Chief Information Security Officer or an equivalent senior officer. Paragraph 5 of Prudential Statement 11 requires a licensed financial institution to develop and document an enterprise wide cybersecurity risk strategy approved by the Board.

Paragraph 8 of Prudential Statement 11 requires a licensed financial institution to have in place a cybersecurity policy framework commensurate with its exposures to vulnerabilities and threats. Paragraph 103(a) of Prudential Statement 11 requires a licensed financial institution to conduct security audits and tests, including vulnerability scans and penetration tests, at regular intervals for high risk systems and processes and before such systems are put in production.

Paragraph 99 of Prudential Statement 11 requires a licensed financial institution to have a cybersecurity incident management process governed by documented policy and procedures. Paragraph 107 of Prudential Statement 11 provides that non-compliance with it is subject to corrective actions as provided by the Central Bank and the administrative penalties outlined in the Financial Institutions Act 1996.

Prudential Statement 1 of the Commercial Banks Prudential Statements states that it is made under section 3(2) of the Financial Institutions Act 1996. Section 3(2) of the Financial Institutions Act 1996 allows the Central Bank to issue in writing prudential statements and guidelines in connection with the implementation of provisions of the Act.

Section 3(3) of the Financial Institutions Act 1996 provides that non-compliance with the prudential statements and guidelines may lead the Central Bank to conclude that an institution is following unsound or unsafe practices. Section 13 of the Financial Institutions Act 1996 allows the Central Bank to issue a directive to a licensed financial institution it finds to be following unsound or unsafe practices.

Paragraph 105 of Prudential Statement 11 requires a licensed financial institution to provide quarterly reporting on all cybersecurity incidents in the format prescribed in Appendix 1.

Paragraph 106 of Prudential Statement 11 requires a licensed financial institution to notify the Central Bank as soon as possible but not later than sixty minutes after becoming aware of an information security incident that materially affects or has the potential to materially affect the institution or the interests of depositors.

Paragraph 107 of Prudential Statement 11 provides that non-compliance with it is subject to corrective actions as provided by the Central Bank and the administrative penalties outlined in the Financial Institutions Act 1996. Section 3(3) of the Financial Institutions Act 1996 provides that non-compliance with the prudential statements and guidelines may lead the Central Bank to conclude that an institution is following unsound or unsafe practices.

Section 10 requires a person to hold a licence from the Film Control Board before exhibiting or lending a film, and section 10(3) lets the Board determine licence classes for exhibitors including broadcast, cable or satellite television service providers, picture theatres, educational institutions, and internet or other computer-based suppliers.

Section 19 requires the Principal Censor, on approving a film for public exhibition, to classify it either for general exhibition or for exhibition restricted to a specified class of persons only, being persons of or over the age of 5 years, or for specified purposes or occasions only, and section 19(2) bars exhibiting a film contrary to that classification.

Section 3A makes the Act binding on the Government, and section 21 requires the owner, manager, or occupier of exhibition premises to display the Principal Censor's certificate notifying the public of the film's classification.

Section 9 permits reproducing a short part of a published work in the form of a quotation, without the copyright owner's authorisation, provided the reproduction is compatible with fair practice and does not exceed the extent justified by the purpose, and the quotation is accompanied by an indication of source and the author's name where it appears in the source.

Section 12(a) permits reproducing, in a newspaper or periodical, or broadcasting or otherwise communicating to the public, an article published in a newspaper or periodical on a current economic, political, or religious topic, or a broadcast work of the same character. This permission does not apply where the right to authorise reproduction or broadcasting is expressly reserved by the author or other copyright owner.

Section 12(b) separately permits reproducing, and broadcasting or otherwise communicating to the public, short excerpts of a work seen or heard in the course of reporting current events, to the extent justified by that purpose. Section 8B similarly lets a work be reproduced or used for the purposes of reporting Parliamentary or judicial proceedings or an inquiry under an enactment, without infringing copyright.

Section 27 makes wilful, for-profit infringement of a protected right an offence, punishable on conviction by a fine of up to 250 penalty units or imprisonment of up to 5 years, or both, doubled for a second or further infringement within 5 years, and section 26(5) separately lets the Court order that a threatened continuing act of infringement not be committed, breach of which is itself an offence punishable by a fine not exceeding 50 penalty units.