Cuba

Ley 149/2022 is Cuba's first comprehensive personal-data statute, binding natural persons with respect to their own data and any natural or legal person that processes personal data.

Article 15 lists sex, gender identity, sexual orientation, ethnic origin and skin color, health status, disability, genetic information, diagnostic test results, religious belief, political affiliation, and criminal record as sensitive data requiring the data subject's express consent to process, absent a statutory exception. Data subjects hold rights to access, rectify, and cancel their personal data, including data held in public as well as private registries.

They may also object to processing, automated or not, that evaluates their professional performance, economic situation, health, reliability, or behavior, or that risks harming them. A person or entity responsible for a registry, file, archive, or database must notify the competent authority of cybersecurity incidents affecting the personal data in its custody. National and international transfer of personal data is permitted only on an enumerated list of grounds rather than as a general rule.

Violations draw administrative sanctions from a warning up to a fine of up to 20,000 pesos, suspension of the database for up to five days, or closure of the registry, file, archive, or database, imposed by officials the responsible state body or entity has expressly authorized, without prejudice to any civil or criminal liability that may separately arise.

Resolución 58/2022 of the Ministry of Communications implements Ley 149/2022's security duties for personal data processed in electronic form and binds public telecommunications and ICT operators and service providers, hosting providers, application providers, and private-network holders.

Article 7 requires that any registry, file, archive, or database containing personal data in electronic form be hosted or replicated only on servers located within the national territory, absent a case the law provides for. Controllers must guarantee the security of electronic personal data, adopt the necessary technical and administrative measures, and notify the competent authorities of cybersecurity incidents affecting personal data under their custody.

Controllers must also let data subjects who are users of public telecommunications, applications, and internet services access, update, and cancel their data on request, and disclose, in plain terms, the purpose of collection, privacy configuration options, and use of tracking elements such as cookies.

Article 289 punishes violating legally established computer-security measures to use information technology media and affect the confidentiality, integrity, or availability of digital assets, with imprisonment of six months to two years or a fine of 200 to 500 cuotas, or both.

Article 290 punishes accessing or using, or letting another access or use, an information system, storage device, software, or database without due authorization, with the purpose of appropriating, using, knowing, disclosing, or disseminating the information it stores, transmits, or captures, with imprisonment of one to three years or a fine of 300 to 1,000 cuotas, or both; because the offense turns on lacking due authorization for a specific purpose rather than on defeating a technical access control, a scraper reading a public, unauthenticated page falls outside a plain reading of the provision unless it is shown to lack authorization for one of the stated purposes.

Article 291 punishes using equipment or procedures to obstruct lawful access to information systems, or scanning telecommunications and ICT services to detect security vulnerabilities, interrupt services, or obtain information about their operation or users, without authorization. Article 292 punishes any act intended to compromise the security of ICT-using systems and knowingly providing a service toward that end.

Article 293 punishes intercepting, manipulating, or interfering with an information or telematic system without authorization and with intent to cause damage, with an aggravated bracket where illegally obtained passwords or similar means are used. Article 294 punishes producing, trafficking, or introducing computer viruses or malicious code intended to disable ICT infrastructure.

Article 296 allows the sanction to be doubled where a grave harm results, an international or foreign system is affected, or a vital or strategic system is put at risk, and increased by half where the offender is an official or employee with custody of the affected system, and allows the accessory sanction of confiscation of property.

Each cuota's monetary value is fixed by the sentencing court between 10 and 200 pesos according to the convicted person's income, so the fine bracket named in each article above is not itself a single peso amount.

Cuba's separate telecommunications framework, Decreto-Ley 35/2021, and its implementing Resolución 105/2021 on cybersecurity-incident response (issued under the earlier Decreto 360/2019) impose incident-notification duties on network operators but create no distinct authorization or access regime for a third party reading data from a system.

Article 38 permits, without the author's consent and without remuneration but with mandatory credit to the author's name and the source, and provided the work is already known to the public: reproducing citations or fragments in written, sound, or visual form for teaching, informational, critical, illustrative, or explanatory purposes, to the extent the purpose pursued justifies; using a work, even in full where its brief length and nature justify it, as teaching illustration in publications or broadcasts; and reproducing, broadcasting, or otherwise communicating to the public any political speech, report, conference, or judicial debate, or other work of the same character, that has already been communicated or made known to the public, though including such a speech in a compiled collection of one author's works or in a collective work still requires the author's consent and remuneration.

The stored text of this 1977 law is a scanned, optical-character-recognized copy whose transcription is degraded throughout; the provisions above are read from that scan.