Marshall Islands

Section 250.12(1) makes it a misdemeanour, except as authorized by law, to trespass on property with intent to subject anyone to eavesdropping or other surveillance in a private place, to install in a private place, without the consent of the person entitled to privacy there, a device for observing, photographing, recording, amplifying, or broadcasting sounds or events, or to install or use outside a private place a device for hearing, recording, amplifying, or broadcasting sounds originating in that place that would not ordinarily be audible or comprehensible outside, again without that person's consent.

Section 250.12(2) separately makes it a misdemeanour to knowingly intercept, without the consent of the sender or receiver, a message by telephone, telegraph, facsimile, electronic mail, letter, or other means of communicating privately, an offence that does not extend to overhearing a message through a regularly installed telephone party line or extension, or to an interception by the telephone company or a subscriber incident to enforcing regulations that limit use of the facilities.

The section states no penalty of its own; a misdemeanour under the Code's general sentencing provisions carries a fine of up to $1,000 and a definite term of imprisonment, fixed by the court, of up to one year.

The Act applies to core Government ministries and agencies of the Republic that collect, use, store, process, disclose, or transfer personal data of natural persons, and its definitions of data controller and data processor extend to a third party acting on behalf of such a ministry or agency, but it excludes processing for law enforcement or national intelligence and national security purposes, non-personal data, and publicly available information lawfully obtained from government records, voluntarily made available by the data subject without audience restriction, or otherwise lawfully obtained, truthful, and a matter of public concern.

It sets six personal data protection principles binding core Government ministries and agencies: a legitimate-purpose principle requiring lawful, fair, transparent processing for specified purposes; a data-minimization principle; an accuracy principle; a retention principle limiting storage to what the purpose requires; an integrity and security principle requiring appropriate technical and organizational protection and access limitation; and an accountability principle making the data controller responsible for demonstrating compliance.

The Economic Policy, Planning and Statistics Office is designated the competent authority, empowered to issue guidance, coordinate data sharing among ministries, and make implementing rules.

A natural person residing in the Republic who suffers an injury from a core Government ministry's or agency's alleged improper administration of the Act may bring suit for an injunction, mandamus, a corrective order, or a public statement of remedy, but a court may not award compensatory damages against the ministry or agency itself, though a person may separately sue an employee personally for wilful or grossly negligent conduct.

The Act states no penalty or offence provision, and section 417 lets the competent authority make further regulations, with Cabinet approval, for the Chapter's effective performance.