FranceCode pénal STAD Offenses, Unauthorized Access to and Interference with Automated Data Processing Systems
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://www.legifrance.gouv.fr/codes/id/LEGISCTA000006149839In force since .
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not defeat an access control, password, or other security measure to reach a French computer system; reading a public, unauthenticated page without doing so has not itself been held to violate Article 323-1.NIST AI RMFMAP 4.1
- Do not impair, falsify, corrupt, or delete data on a French computer system in the course of an automated crawl, which Articles 323-2 and 323-3 punish separately from unauthorized access itself, with a higher penalty where the system is a State personal-data system.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 323-1 (fraudulent access to or remaining within a system): five years' imprisonment, though the base tier is three years and EUR 100,000, rising where access causes the deletion or alteration of the data held. Article 323-2 (impairing or falsifying a system's functioning) and Article 323-3 (fraudulently introducing, extracting, holding, reproducing, transmitting, deleting or altering data): five years' imprisonment and a fine of EUR 150,000 each, rising to seven years and EUR 300,000 where the system targeted is a State-operated system processing personal data. Article 323-4 punishes conspiring to prepare any of these offenses with the same penalty as the offense itself, or the most severe if several are contemplated, rising to ten years and EUR 300,000 where committed by an organized group (Article 323-4-1). Article 323-7 punishes an attempt with the same penalties as the completed offense. Article 323-6 exposes a corporate defendant to the fine under Code penal Article 131-38 (which multiplies the individual fine by five) plus the additional penalties listed in Article 131-39, including up to a five-year prohibition on issuing checks and publication of the judgment.
Penalty structure
Article 323-1's base tier for fraudulent access to or remaining within an automated data processing system: three years' imprisonment and a fine of EUR 100,000. The chapter's other offenses carry higher fixed caps: Articles 323-2 and 323-3 (impairing a system's functioning, or introducing, extracting or altering its data) each carry EUR 150,000 and five years, rising to EUR 300,000 and seven years where the system targeted is a State-operated personal-data system; Article 323-4-1 raises an organized-group offense to EUR 300,000 and ten years.
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 100,000
Who enforces it
Enforcement body
French criminal courts (tribunaux correctionnels), on prosecution by the public prosecutor (parquet); no dedicated regulator enforces this chapter.
Settledness
- As of
- Open questions
- Does a person who retrieves pages that the operator serves without authentication, but whose terms of use forbid automated collection, 'accède ou se maintient frauduleusement' in a 'système de traitement automatisé de données'?
- Does continuing to crawl after a technical block, such as a blocked address or a challenge page, supply the element of 'frauduleusement' (fraudulently) in article 323-1?
What it makes you log
Logging duty
Articles 323-1 to 323-8 define the offences against automated data processing systems, their penalties and one exclusion for intelligence services. They impose no duty to create, keep, produce or review a log or record. Article 323-3-2 refers to obligations in article 6 V of Law 2004-575 for an online platform provider but sets none itself.
- Kind
- None
- As of
What this law does
Article 323-1 punishes fraudulently accessing or remaining within all or part of an automated data processing system with three years' imprisonment and a fine of EUR 100,000.
Article 323-2 punishes impairing or falsifying the functioning of such a system, and Article 323-3 punishes fraudulently introducing, extracting, holding, reproducing, transmitting, deleting or altering data within one, each with five years' imprisonment and a fine of EUR 150,000, rising to seven years and EUR 300,000 where the targeted system is a State-operated system processing personal data.
Article 323-1's own penalty rises in the same pattern where the access results in the deletion or alteration of data held in the system. The base Article 323-1 offense requires fraudulent access, so a scraper reading a public, unauthenticated page, with no deception or circumvention of any control involved, is not the fraudulent access this article punishes.
Article 323-3-1 separately punishes possessing or supplying a tool or program designed to commit these offenses, Article 323-4 punishes conspiring to commit them, and Article 323-7 punishes an attempt with the same penalties as the completed offense. Article 323-8 exempts measures carried out by authorized state intelligence services for protecting national security interests abroad, an exemption added later, in 2015, than the chapter's original 1994 commencement.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .