Guam

An individual or entity that owns or licenses computerized data including personal information must disclose a breach of the security of the system to any affected Guam resident without unreasonable delay once it discovers or is notified of the breach and reasonably believes it has caused or will cause identity theft or other fraud; an entity holding such data for another owner or licensee must instead notify that owner or licensee as soon as practicable.

Personal information is a first name or initial and last name combined with a Social Security number, a driver's license or Guam identification card number, or a financial account, credit, or debit card number together with any required access code, and it excludes information lawfully obtained from publicly available sources or government records; the definition carries no biometric-data category.

Guam added this chapter on March 13, 2009 and its own text sets the chapter's effective date at one hundred twenty days after that enactment date, without stating the resulting calendar day; the Office of the Attorney General has exclusive authority to enforce it.

A depicted individual who is identifiable and suffers harm from a person's intentional disclosure, or threatened disclosure, of a private intimate image made without the individual's consent has a civil cause of action against that person, if the person knew of, or acted with reckless disregard for, the lack of consent, the image's private character, or the individual's identifiability.

A prevailing plaintiff may recover the greater of actual and emotional-distress damages or statutory damages up to $10,000 per liable defendant, plus any monetary gain the defendant made from the disclosure, punitive damages, and attorney's fees, and may litigate under a pseudonym.

Guam enacted this civil-remedies chapter on February 12, 2020; its intimate-image definition covers a photograph, film, video recording, or similar medium and does not by its own terms address a depiction that is wholly AI-generated or synthetic rather than a genuine recording of the person.

Section 32201 declares false, misleading, or deceptive acts or practices in trade or commerce unlawful and actionable by the Attorney General or by any aggrieved person, with damages, rescission, or equitable relief available and the chapter to be liberally construed in favor of the consumer.

Section 32201 names no computer access, data collection, or automated conduct, so it reaches a scraper, data reseller, or AI service only where that service's conduct toward a Guam consumer is false, misleading, or deceptive.