SpainCódigo Penal Article 197 bis, Unauthorized Access to an Information System
Ley Organica 10/1995 de 23 de noviembre, del Codigo Penal, art. 197 bis, added by Ley Organica 1/2015, de 30 de marzo, art. unico.107 (BOE-A-1995-25444, BOE-A-2015-3439)
In force since .
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not circumvent a technical security measure, such as authentication, to access an information system without authorization; Article 197 bis does not reach access to a page that carries no such measure.
These lines are LexLint's reading of the law's text. Also read by: Fiscalía General del Estado, Circular 3/2017 (guidance, recorded ).
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Imprisonment of six months to two years for unauthorized access achieved by vulnerating a security measure, or for remaining against the will of the person entitled to exclude the actor (art. 197 bis.1); imprisonment of three months to two years or a three-to-twelve-month fine for unauthorized interception of non-public data transmissions to, from, or within an information system (art. 197 bis.2).
Who enforces it
Settledness
- As of
- Guidance link
- https://www.boe.es/buscar/doc.php?id=FIS-C-2017-00003
- Guidance body
- Fiscalía General del Estado, Circular 3/2017
- Open questions
- Does a technical block aimed at automated clients, such as an IP block, a rate limit or a bot challenge, count as a 'medida de seguridad establecida para impedirlo' under Article 197 bis.1 of the Código Penal when the site stays open to ordinary visitors?
- Does continuing to access a system after its operator's written objection, with no security measure breached, amount to 'se mantenga en él en contra de la voluntad de quien tenga el legítimo derecho a excluirlo' under Article 197 bis.1 of the Código Penal?
What it makes you log
Logging duty
Article 197 bis defines the offences of unauthorized access to an information system by breaching security measures and of intercepting non-public data transmissions. It imposes no duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Accessing or facilitating access to all or part of an information system, or remaining in it against the will of whoever has the legitimate right to exclude the actor, is a crime carrying six months to two years' imprisonment, but only where the actor breaches security measures established to prevent that access and lacks due authorization.
Intercepting non-public data transmissions to, from, or within an information system by technical means, without authorization, carries a separate penalty of three months to two years' imprisonment or a fine. Because the offense in the first paragraph requires vulnerating an established security measure, accessing a page with no access control in place, the ordinary case of public-web crawling, does not fall within Article 197 bis on the text of the article alone.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .