VPNs with servers in Panama

The duty to keep the data ends six months after it was generated; on a judicial authority’s request for specific data, the period may be extended for those data by up to six further months (art. 6). Retention never entails intercepting or accessing the content of communications (art. 7). Whether the law reaches a VPN operator is not established.

The prosecutor requests data by reasoned resolution, subject to later judicial review (art. 12). Operators must answer within five working days for data inside six months and fifteen for the extended period (art. 13). Retained data are confidential (art. 10) and may not be used for other purposes, on pain of criminal penalty (art. 8).

Law 51 of 2009 places no blocking duty on operators; its one provision touching content, article 7, keeps retention away from the content of communications.

The Penal Code punishes insult, an offence to a person’s dignity, honour or decorum in writing or any form, with 60 to 120 day-fines (art. 193), and false imputation of a punishable act with 90 to 180 day-fines (art. 194). Through a mass medium or a computer system the penalty becomes six to twelve months’ imprisonment for insult and twelve to eighteen for calumny, or the equivalent in day-fines (art. 195).

Proof of the truth exempts the accused of calumny (art. 197), and a public retraction consented to by the offended person excludes liability (art. 196). Where the offended person is a public servant named in article 304 of the Constitution, an elected official or a governor, no criminal penalty is imposed (art. 196). Unauthorised entry to a database, network or system carries two to four years (art. 289).

Law 51 puts data access behind a prosecutor’s reasoned resolution reviewed by a court.

The order of the rows is the security score, and a server’s location is not a recommendation.