Cybersecurity Act · 2024 Revised Edition · Part · General
33. Preservation of secrecy
Official textFrom Attorney General's Chambers, unchanged
Subject to subsections (3) and (7), every specified person shall preserve, and aid in preserving, the secrecy of —
all matters relating to a computer or computer system of any person;
all matters relating to the business, commercial or official affairs of any person;
all matters that have been identified as confidential under subsection (5); and
all matters relating to the identity of persons furnishing information to any specified person, that may come to the knowledge of the specified person in the performance of his functions or the discharge of his duties under this Act.
The specified person shall not communicate any matter mentioned in subsection (1) to any person, except insofar as such communication —
is necessary for the performance of any such function or the discharge of any such duty; or
Cybersecurity 48
is lawfully required by any court or lawfully required or allowed by or under this Act or any other written law.
This section does not apply to any information provided in compliance with a direction or requirement under section 25.
Any person who fails to comply with subsection (1) or (2) is guilty of an offence and liable on conviction to a fine not exceeding $10,000, imprisonment for a term not exceeding 12 months or both.
Any person, when furnishing any information to a specified person, may identify information that the person claims to be confidential information.
Every claim made under subsection (5) shall be supported by a written statement giving reasons why the information is confidential.
Notwithstanding subsection (1), the Commissioner may disclose any information relating to any matter mentioned in subsection (1) in any of the following circumstances —
Commissioner
“Commissioner” means the Commissioner of Cybersecurity appointed under section 5(1);
where the written consent of the person to whom the information relates has been obtained;
for the purposes of —
a prosecution under this Act;
subject to subsection (8), enabling the Commissioner to give effect to any provision of this Act;
enabling the Commissioner or any authorised officer to investigate a suspected offence under this Act or to enforce a provision of this Act;
disclosing to any police officer any information which discloses the commission of an offence under the
Computer Misuse Act (Chapter 194); or
complying with such provision of an agreement between Brunei Darussalam and a country or territory outside Brunei Darussalam (referred to in this section as a foreign country) as may be prescribed, where the conditions specified in subsection (9) are satisfied.
Cybersecurity 49
If the Commissioner is considering whether to disclose any information under subsection (7)(b)(ii), the Commissioner shall have regard to —
the need to exclude, so far as is practicable, information the disclosure of which would in his opinion be contrary to the public interest;
the need to exclude, so far as is practicable —
commercial information the disclosure of which would, or might, in his opinion, significantly harm the legitimate business interests of the undertaking to which it relates; or
information relating to the private affairs of an individual the disclosure of which would, or might, in his opinion, significantly harm the interest of the individual; and
the extent to which the disclosure is necessary for the purposes for which the Commissioner is proposing to make the disclosure.
The conditions referred to in subsection (7)(b)(v) are —
the information or documents requested by the foreign country are available to the Commissioner;
unless the Government otherwise allows, the foreign country undertakes to keep the information or documents given confidential at all times; and
the disclosure of the information or documents is not likely to be contrary to the public interest.
In this section, “specified person” means a person who is or has been —
the Commissioner, the Deputy Commissioner, an Assistant
Commissioner, a cybersecurity officer or a person appointed or employed to assist the Commissioner;
Cybersecurity 50
an authorised officer appointed under section 7;
a member of an Appeals Advisory Panel established under section 20;
a cybersecurity technical expert appointed under section 24;
or
the Minister, or a person appointed or employed to assist the
Minister.
Terms defined in s 2
Assistant Commissioner
Defined · s 2“Assistant Commissioner” means any Assistant Commissioner of Cybersecurity appointed under section 5(3);
Commissioner
Defined · s 2“Commissioner” means the Commissioner of Cybersecurity appointed under section 5(1);
computer
Defined · s 2“computer” means an electronic, magnetic, optical, electrochemical or other data processing device performing logical, arithmetic or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but does not include such device as the Minister may, by notification published in the Gazette, prescribe;
computer system
Defined · s 2“computer system” means an arrangement of interconnected computers that is designed to perform one or more specific functions, and includes — (a) an information technology system; and (b) an operational technology system such as an industrial control system, a programmable logic controller, a supervisory control and data acquisition system or a distributed control system;
cybersecurity
Defined · s 2“cybersecurity” means the state in which a computer or computer system is protected from unauthorised access or attack, and because of that state — (a) the computer or computer system continues to be available and operational; (b) the integrity of the computer or computer system is maintained; and (c) the integrity and confidentiality of information stored in, processed by or transmitted through the computer or computer system is maintained;
cybersecurity officer
Defined · s 2“cybersecurity officer” means any cybersecurity officer appointed under section 5(5);
Deputy Commissioner
Defined · s 2“Deputy Commissioner” means the Deputy Commissioner of Cybersecurity appointed under section 5(3);