AustraliaCriminal Code Act 1995 (Cth), Part 10.7, Unauthorised Access to Restricted Data
Criminal Code Act 1995 (Cth), Schedule (the Criminal Code), Part 10.7, ss. 476.2, 478.1
In force since .
A computer misuse rule binding public and private bodies.
- Enforcement body
- Australian Federal Police, prosecuted by the Commonwealth Director of Public Prosecutions
- Audit expectation
- none
What it requires
- Do not cause access to, or modification of, data held in a computer where that data is restricted by an access control system and you are not entitled to cause the access, knowing the access is unauthorised.
- Reading a public, unauthenticated page without defeating any access control has not itself been held to violate this section.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A fixed maximum of 2 years imprisonment on conviction under s. 478.1(1); the text of this provision states no accompanying fine.
What it makes you log
Logging duty
Section 478.1 defines the offence of causing unauthorized access to, or modification of, restricted data (data protected by an access control system), and section 476.2 says when access is unauthorized. Neither imposes a duty to create, keep, produce or review a log or record. Section 476.3 applies extended geographical jurisdiction (category A) to the Part by cross-reference to section 15.1 of the Criminal Code, which is not part of the text read for this row, so no territorial hook value is set from it.
- Kind
- None
- As of
What this law does
Section 478.1 makes it an offence, punishable by up to 2 years imprisonment, to cause unauthorised access to, or modification of, restricted data, meaning data held in a computer to which access is restricted by an access control system, intending to cause the access or modification and knowing it is unauthorised.
Access is unauthorised under section 476.2 only if the person is not entitled to cause it, so a scraper reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the offence, and no reported Australian case has tested a scraping fact pattern under this Part. The Criminal Code applies this offence to a body corporate in the same way as it applies to an individual.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .