Cyber Law at Vanuatu
Vanuatu has been actively developing its cyber law framework to address the increasing challenges of the digital age, particularly in the areas of cybercrime, data protection, and electronic transactions. As a common law jurisdiction, its legal system is influenced by English common law, but local legislation is the primary source of its cyber laws.
Here are the key components of cyber law in Vanuatu as of July 2025:
1. Cybercrime:
Cybercrime Act No. 22 of 2021: This is the flagship legislation for combating cybercrime in Vanuatu, which came into force on September 22, 2021. It is designed to align with international standards, particularly the Council of Europe's Budapest Convention on Cybercrime. Vanuatu has expressed interest in acceding to the Budapest Convention and the Act reflects this alignment.
The Act criminalizes a wide range of cyber offenses, including:
Offences against the confidentiality, integrity, and availability of computer data and systems:
Illegal access (hacking).
Illegal interception.
Unauthorized interference with data or computer systems.
Misuse of devices (e.g., creating or distributing malware).
Computer-related offences:
Computer-related forgery.
Computer-related fraud.
Content-related offences:
Child pornography (production, distribution, possession, hosting).
Solicitation of children (online grooming).
Posting intimate visual recordings without consent (revenge porn).
Identity-related crimes: Identity theft and related offenses.
Cyberstalking and cyberbullying: Prohibits online harassment that causes harm.
New offenses under Harmful Digital Communications (Amendment) Act 2025: This amendment to the 2024 Act (discussed below) further criminalizes misleading others by impersonating someone online, and using forged or altered identification for fraud. It also explicitly outlaws creating, sharing, or hosting pornographic material (beyond child pornography).
Harmful Digital Communications Act No. 14 of 2024 (as amended by the 2025 Act): This Act was introduced to curb cyberbullying and harassment and has been recently strengthened.
It sets out "10 Communication Principles" for online interaction.
It establishes a Commissioner of Harmful Digital Communications tasked with investigating complaints.
It allows people to take serious complaints to the Magistrates' Courts.
It creates new criminal offenses for causing harm by posting digital communication and specific offenses related to intimate visual recordings without consent.
The Harmful Digital Communications (Amendment) Act of 2025, approved unanimously, significantly broadens the scope to include criminalizing impersonation online, using forged IDs for fraud, and a wider range of offenses related to pornography (beyond child pornography). It also introduces tougher penalties and empowers the Magistrates' Court to order ISPs to block access to adult websites and require social platforms to remove illegal material or ban fake accounts.
2. Data Protection and Privacy:
Bill for the Data Protection and Privacy Act No. of 2024: While details on its full enactment date are still emerging, this Bill indicates Vanuatu's strong commitment to establishing a comprehensive data protection framework. It is designed to be in line with international best practices and ensure respect for fundamental rights and freedoms, particularly the right to privacy regarding personal data processing.
Key aspects of the Bill include:
Definitions: Comprehensive definitions of personal data, sensitive data, data controller, data processor, data subject, etc.
Principles of Data Processing: Lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.
Data Subject Rights: Rights of access, rectification, erasure, restriction of processing, data portability, and objection.
Controller and Processor Obligations: Requirements for security measures, data breach notification, data protection impact assessments (DPIAs), and cross-border data transfer rules.
Designated Authority: The Bill proposes the appointment of a Commissioner of Data Protection and Privacy under the Digital Safety Authority Act No. of 2024. This Commissioner will be responsible for oversight and enforcement.
Extraterritorial Application: The Bill aims for extraterritorial application, meaning it could apply to entities outside Vanuatu if they process the personal data of individuals in Vanuatu.
3. Electronic Transactions:
Electronic Transactions Act No. 24 of 2000 (and Amendments): This Act is foundational for promoting e-commerce and legal certainty in digital interactions. It aims to:
Provide legal recognition for electronic records and electronic signatures. This ensures that digital documents and signatures have the same legal validity as traditional paper-based ones.
Facilitate electronic transactions by clarifying rules around document requirements, delivery, retention, and original form.
Establish contract formation rules specific to electronic messages (attribution, acknowledgement of receipt, time/place of sending/receiving).
Provide for the licensing of Certification Authorities (CAs) to ensure the authenticity and accuracy of electronic messages.
Virtual Assets Services Providers Act No. of 2025 (Bill): This recent Bill aims to regulate virtual assets and virtual asset service providers (VASPs) in Vanuatu. It seeks to create a stable regulatory framework for digital transactions, promote competition, protect consumers, and align with international standards for Fintech activities. The Vanuatu Financial Services Commission (VFSC) is proposed as the licensing authority for VASPs.
Key Characteristics and Challenges:
Proactive Legislative Approach: Vanuatu has shown a clear commitment to developing a modern cyber law framework, evidenced by its recent comprehensive Acts and Bills.
International Alignment: The alignment with the Budapest Convention for cybercrime and GDPR principles for data protection highlights Vanuatu's intention to meet global standards.
Focus on Online Safety: The Harmful Digital Communications Act, with its recent amendments, demonstrates a strong emphasis on protecting individuals, particularly vulnerable groups like children, from online abuse.
Digital Economy Development: Laws like the Electronic Transactions Act and the Virtual Assets Services Providers Act aim to foster a secure and reliable environment for digital commerce and innovation.
Enforcement Capacity: A common challenge for developing nations is ensuring sufficient technical and human capacity for effective enforcement of complex cyber laws, including forensic capabilities for cybercrime investigations and regulatory oversight for data protection.
Public Awareness: As with any new or evolving legal framework, raising public awareness about rights, obligations, and available redress mechanisms is crucial for successful implementation.
Vanuatu's cyber law landscape is robust and actively evolving, reflecting a concerted effort to adapt its legal system to the digital age and ensure a safe and secure online environment for its citizens and businesses.
RELATED Blog
0 comments