DenmarkStraffeloven Section 263, Unauthorized Access to a Data System
In force since .
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not obtain access to a data system, or to data intended for use in one, without the right to do so, including by defeating an access control while scraping.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 263(1): a fine or imprisonment of up to 1 year and 6 months for unauthorized access to a data system or to data intended for use in one. Section 263(3): the maximum rises to imprisonment of up to 6 years where the access is made with intent to learn a business's trade secrets, under other especially aggravating circumstances, or as part of a systematic or organized operation.
Who enforces it
Settledness
- As of
- Open questions
- Is a person who retrieves pages that the operator serves to every visitor, in breach of its terms of use, someone who 'uberettiget skaffer sig adgang' to 'en andens datasystem' under Section 263(1)?
- Does a rate limit or a login make access 'uberettiget' under Section 263(1), which names no security measure?
What it makes you log
Logging duty
Section 263 defines the offence of gaining unauthorized access to another person's data system or data. It imposes no duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Section 263, subsection 1, punishes with a fine or imprisonment of up to 1 year and 6 months whoever unlawfully obtains access to another's data system or to data intended for use in a data system. The provision does not state that the access must defeat a security measure, so its text does not on its face exclude reading a public, unauthenticated page.
Subsection 3 raises the maximum to imprisonment of up to 6 years where the access is made with intent to learn a business's trade secrets or under other especially aggravating circumstances, including systematic or organized offending. A related section, 263a, separately punishes commercial trafficking in access credentials to a data system.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .