Revised Laws of Saint Lucia (2021)

7.   Unauthorized access to and interception of computer service

1.  

   (1)   Subject to section 13 and subsection (4), a person shall not, by any means, knowingly—

   1.  

      (a)     secure access, without authority, to a computer system for the purpose of obtaining, directly or indirectly, any computer service;

   1.  

      (b)     intercept or cause to be intercepted, directly or indirectly, without authority, any function of, or any data within, a computer system; or

   1.  

      (c)     communicate directly or indirectly a number, code, password or other means of access to a computer system to any person other than a person to whom he or she is duly authorized to communicate.

1.  

   (2)   A person who contravenes subsection (1), commits an offence and is liable, on summary conviction—

   1.  

      (a)     in case of a first offence—

      1.  

         (i)     subject to subparagraph (ii), to a fine not exceeding $10,000 or to imprisonment for a term not exceeding 3 months or to both, and

      1.  

         (ii)     where the computer system is damaged, impaired, or where data contained in the computer system is suppressed or modified, to a fine not exceeding $20,000 or to imprisonment for a term not exceeding 6 months;

   1.  

      (b)     in the case of a second or subsequent offence—

      1.  

         (i)     subject to subparagraph (ii), to a fine not exceeding $25,000 or to imprisonment for a term not exceeding one year or to both, and

      1.  

         (ii)     where the computer system is damaged impaired, or where data contained in the computer system is suppressed or modified, to a fine not exceeding $50,000 or to imprisonment for a term not exceeding 18 months.

1.  

   (3)   For the purpose of this section, it is immaterial that the unauthorized access or interception is not directed at—

   1.  

      (a)     any particular program or data;

   1.  

      (b)     a program or data of any kind; or

   1.  

      (c)     a program or data held in any particular computer system.

1.  

   (4)   A person is not liable under subsection (1) if that person—

   1.  

      (a)     has the express or implied consent of both the person who sent the data and the intended recipient of that data;

   1.  

      (b)     is acting in reliance of any statutory power.