GermanyAusspaehen, Abfangen und Manipulation von Daten (Computer Misuse and Data Interference)
Strafgesetzbuch (StGB), §§ 202a, 202b, 202c, 202d, 303a, 303b
In force.
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not gain access to data that is specially secured against unauthorised access by overcoming that security measure.NIST AI RMFMAP 4.1
- Do not intercept non-public data transmissions or a computer's electromagnetic emissions using technical means.NIST AI RMFMAP 4.1
- Do not produce, obtain, sell, or distribute passwords, security codes, or software designed to commit these offences.no control in the NIST AI RMF
- Do not obtain, pass on, or distribute data that another person has unlawfully obtained, for enrichment or to cause harm.NIST AI RMFMAP 4.1
- Do not unlawfully delete, suppress, render unusable, or alter data.no control in the NIST AI RMF
- Do not substantially disrupt a data-processing operation of essential significance to another person, business, or public authority.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 202a: imprisonment up to 3 years or a fine. Section 202b: imprisonment up to 2 years or a fine, subsidiary to a more severely punished provision. Section 202c: imprisonment up to 2 years or a fine. Section 202d: imprisonment up to 3 years or a fine. Section 303a: imprisonment up to 2 years or a fine; attempt is punishable. Section 303b: imprisonment up to 3 years or a fine, rising to up to 5 years where the processing affects an outside business, undertaking or public authority, and to imprisonment of 6 months to 10 years in especially serious cases (large-scale financial loss, commercial or gang commission, or impairment of essential public supply or national security).
Who enforces it
Settledness
- As of
- Open questions
- Is data that a website shows to any visitor 'nicht für ihn bestimmt' under Section 202a(1) when the operator's terms of use forbid automated retrieval?
- Does a CAPTCHA, a rate limit or a login make data 'gegen unberechtigten Zugang besonders gesichert' so that getting past it is 'Überwindung der Zugangssicherung'?
What it makes you log
Logging duty
Sections 202a to 202d, 303a and 303b define offences against data and data-processing systems. They impose no duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Section 202a punishes, with imprisonment of up to three years or a fine, unlawfully obtaining access, for oneself or another, to data that is not intended for oneself and is specially secured against unauthorised access, by overcoming that access security.
Section 202b punishes, with imprisonment of up to two years or a fine, unlawfully obtaining such data for oneself or another using technical means from a non-public data transmission or from a data-processing installation's electromagnetic emissions, unless a more severe provision applies.
Section 202c punishes, with imprisonment of up to two years or a fine, preparing such an offence by producing, obtaining, selling, supplying, distributing or otherwise making accessible passwords or other security codes enabling access to such data, or computer programs designed to commit such an offence.
Section 202d punishes, with imprisonment of up to three years or a fine, obtaining, passing on, distributing or otherwise making accessible data that is not generally accessible and that another person obtained through an unlawful act, in order to enrich oneself or a third party or to harm another, with an exemption for acts performed exclusively in fulfilment of lawful official or professional duties.
Section 303a punishes, with imprisonment of up to two years or a fine, unlawfully deleting, suppressing, rendering unusable or altering data, and the attempt is itself punishable.
Section 303b punishes substantially disrupting a data-processing operation of essential significance to another through such conduct, with imprisonment of up to three years or a fine, rising to up to five years where the data processing is of essential significance to an outside business, undertaking or public authority, and, in especially serious cases, to imprisonment of six months to ten years, a category the statute names as including causing a loss of great magnitude, acting commercially or as a member of a gang formed for repeated computer sabotage, or impairing the population's supply of essential goods or services or the Federal Republic's security.
Sections 202b and 202c took effect on , the day after the promulgation of the Forty-first Criminal Law Amendment Act. That Act was issued in the Federal Law Gazette, Part I, Number 38, on . The same Act rewrote section 202a(1), a section that already existed. Section 202d took effect on , the day after the promulgation of the Act introducing a data-retention duty and a maximum retention period for traffic data.
That Act was issued in the Federal Law Gazette, Part I, Number 51, on . Because section 202a's offence turns on overcoming an access-security measure, a scraper reading a public, unauthenticated page without defeating any technical access control falls outside a plain reading of the provision.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .