Attacks against Information Systems Law, Articles 3, 4, 7, 11-12 (Illegal Access, System Interference, Tools, Corporate Liability)

The Attacks against Information Systems Law of 2015, transposing EU Directive 2013/40/EU, punishes intentional access without right to the whole or part of an information system where that access is obtained by violating a security measure, by up to five years' imprisonment or a forty thousand euro fine or both (art. 3).

The same maximum penalty punishes intentionally and without right seriously hindering or interrupting an information system's operation by inputting, transmitting, damaging, deleting, deteriorating, altering or suppressing its electronic data, or by blocking access to that data (art. 4).

The same maximum penalty also punishes producing, selling, procuring for use, importing, distributing or otherwise making available a computer program, password, access code or similar tool intended to be used to commit an article 3 to 6 offence (art. 7). A legal person is guilty of an article 3 to 9 offence committed for its benefit by a person in a leading position within it (art. 11).

On conviction, a legal person faces a fine of up to one hundred thousand euro, and the court may also exclude it from public benefits, ban its commercial activity, place it under judicial supervision, order it wound up, or close the premises used for the offence (art. 12). The Law was published in the Official Gazette on 16 October 2015. Cyprus legislation takes effect on the date of its Official Gazette publication unless it provides a different date.