Samoa

Section 82(1) makes it an offence, punishable by imprisonment of up to 7 years, for a person without lawful justification to sell, distribute, exhibit, print, possess, communicate, produce, offer, or knowingly access indecent material on a child, including through an electronic system.

Section 82(2) defines child pornography as pornographic material that depicts, presents, or represents a child engaged in sexually explicit conduct, a person appearing to be a child engaged in sexually explicit conduct, or images representing a child engaged in sexually explicit conduct, and includes any audio, visual, or text pornographic material, so the offence reaches a computer-generated, simulated, or otherwise synthetic depiction of a child in sexually explicit conduct as well as a photograph of a real child. The section defines a child as a person 16 years and under.

Section 48 requires a relying party to notify the Registrar General of a personal data breach within 72 hours of becoming aware of it, describing the categories and approximate number of registered persons and personal data records concerned, and to respond without undue delay to the Registrar General's information requests.

Section 49 requires the Registrar General, on learning of a breach likely to result in a high risk to a registered person's rights, to communicate the breach to that person without undue delay in plain language, including advice on mitigating measures, or, where direct communication is not feasible, through public media.

Section 50 requires every such notification to name the notifying entity's contact details, describe the breach's likely consequences and the measures taken or proposed to address it, and requires the Registrar General, relying parties, and data processors to keep a record of all personal data breaches sufficient to demonstrate compliance.

Section 56 separately makes it an offence for a person engaged for the purposes of the Act, a relying party, a data processor, or any other person to disclose, transmit, copy, or otherwise disseminate personal data collected or processed under the Act to an unauthorised person without lawful excuse.

Section 48 bars a telecommunications service provider from disclosing information concerning a customer without the customer's written consent, unless disclosure is required or permitted by the Regulator or by law, and gives the customer a right to inspect the provider's records concerning them.

Section 49 requires a service provider to take all reasonable steps to keep customer communications confidential and bars intercepting, monitoring, altering, or modifying their content except for tracing harassing or illegal calls or as otherwise permitted by the Act. Section 50 requires a service provider to operate its network with due regard for customer privacy and to identify the purposes for which customer information is collected at or before collection.

Except as permitted or required by law or with the customer's consent, a service provider must not collect, use, maintain, or disclose customer information for an undisclosed purpose. Sections 75A and 75B separately make it an offence for a service provider's employee, without good and sufficient cause, to divulge information overheard from a telephone conversation or to disclose or use a customer's affairs or personal particulars obtained in the course of duties.

Section 51(1) gives a registered person the right to obtain from the Registrar General or a relying party, without constraint or unreasonable delay and at no expense, confirmation of whether their personal data is being processed, a copy of it in a paper-based or commonly used electronic format, correction or deletion of inaccurate, out-of-date, incomplete, or misleading data, and detailed information on what data has been accessed, by whom, for what purpose and duration, how long it will be stored, and whether any profiling or automated decision-making process is being applied to it.

Section 51(2) requires the Registrar General and a relying party to implement measures enabling a registered person to exercise these rights effectively. Section 52 clarifies that registration confers no right of citizenship, and section 53 lets a registered person raise a grievance over any improper use of their data.

Section 206 makes it an offence, punishable by imprisonment of up to 7 years, to intentionally access, directly or indirectly, an electronic system without authorisation, or being reckless as to whether the person is authorised, and section 207 similarly bars accessing an electronic system dishonestly or by deception to obtain a benefit or cause loss.

Section 208 bars logging into and remaining logged into, or continuing to access, an electronic system without lawful excuse, and section 209 bars intercepting a non-public transmission of electronic data or the electromagnetic emissions of an electronic system without right and with dishonest intent.

Sections 210 to 212 bar damaging, deleting, or altering electronic data, illegally acquiring electronic data that is specially protected against unauthorised access, and interfering with an electronic system so as to endanger life or affect critical infrastructure. Section 213 bars producing, selling, or distributing a device or access code designed or intended for use in committing one of these offences.

Each of sections 206 to 213 is punishable by imprisonment for a term not exceeding 7 years, with no fine stated as an alternative, and section 214 separately punishes making, selling, distributing, or possessing software for committing a crime by the same 7-year term.

None of the exceptions in section 206(2) or 207(3), covering a person already authorised to access the system for another purpose, or a law-enforcement agency acting under a warrant, reaches an outside crawler accessing a page it has no security-measure-based authorisation to access.

Section 4(1) provides that nothing in the Act requires a person to use, provide, or accept an electronic record without that person's consent, and section 4(2)(b) provides that consent may be inferred from a person's conduct, so a browsewrap-style acceptance by continued use of a service may satisfy a consent requirement without a signed or clicked agreement.

Section 8 lets an electronic signature satisfy a legal requirement for a signature where it adequately identifies the signatory, indicates approval, is as reliable as appropriate to the purpose, and the recipient consents to receiving it, with reliability presumed where the means of creating the signature is linked to and under the control of the signatory alone and no alteration is detectable after signing.

Section 5 makes the Act binding on the Government, subject to an exception for the Controller and Auditor General. The Act creates no offence and states no penalty for its own breach.

Section 4(1)(b) protects, as a derivative work, a collection of works and a collection of mere data, including a database, whether in machine-readable or other form, provided the collection is original by reason of the selection, coordination, or arrangement of its contents. Section 3(2) confirms that a work, and by extension a qualifying collection, is protected by the sole fact of its creation, irrespective of its mode or form of expression, content, quality, or purpose.

The protection under section 4(1)(b) attaches only where the collection is original by reason of the selection, coordination, or arrangement of its contents, so a scraper that extracts the underlying data without copying that original selection or arrangement is not reached by it.

Section 10 requires a person to hold a licence from the Film Control Board before exhibiting or lending a film, and section 10(3) lets the Board determine licence classes for exhibitors including broadcast, cable or satellite television service providers, picture theatres, educational institutions, and internet or other computer-based suppliers.

Section 19 requires the Principal Censor, on approving a film for public exhibition, to classify it either for general exhibition or for exhibition restricted to a specified class of persons only, being persons of or over the age of 5 years, or for specified purposes or occasions only, and section 19(2) bars exhibiting a film contrary to that classification.

Section 3A makes the Act binding on the Government, and section 21 requires the owner, manager, or occupier of exhibition premises to display the Principal Censor's certificate notifying the public of the film's classification.

Section 9 permits reproducing a short part of a published work in the form of a quotation, without the copyright owner's authorisation, provided the reproduction is compatible with fair practice and does not exceed the extent justified by the purpose, and the quotation is accompanied by an indication of source and the author's name where it appears in the source.

Section 12(a) permits reproducing, in a newspaper or periodical, or broadcasting or otherwise communicating to the public, an article published in a newspaper or periodical on a current economic, political, or religious topic, or a broadcast work of the same character. This permission does not apply where the right to authorise reproduction or broadcasting is expressly reserved by the author or other copyright owner.

Section 12(b) separately permits reproducing, and broadcasting or otherwise communicating to the public, short excerpts of a work seen or heard in the course of reporting current events, to the extent justified by that purpose. Section 8B similarly lets a work be reproduced or used for the purposes of reporting Parliamentary or judicial proceedings or an inquiry under an enactment, without infringing copyright.

Section 27 makes wilful, for-profit infringement of a protected right an offence, punishable on conviction by a fine of up to 250 penalty units or imprisonment of up to 5 years, or both, doubled for a second or further infringement within 5 years, and section 26(5) separately lets the Court order that a threatened continuing act of infringement not be committed, breach of which is itself an offence punishable by a fine not exceeding 50 penalty units.