United KingdomUnauthorised Access to Computer Material
Computer Misuse Act 1990, c. 18, ss. 1 and 17(5), (8)
In force.
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- none
What it requires
- Do not cause a computer to perform a function intended to secure access to a program or data, knowing that access is unauthorised because you are not entitled to control that kind of access and do not have the consent of someone who is.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
On summary conviction in England and Wales, imprisonment for a term not exceeding the general limit in a magistrates' court or a fine not exceeding the statutory maximum, or both; on summary conviction in Scotland, imprisonment for up to 12 months or a fine not exceeding the statutory maximum, or both; on conviction on indictment, imprisonment for a term not exceeding two years or a fine, or both (s. 1(3)).
What it makes you log
Logging duty
Section 1 defines the offence of causing a computer to perform a function with intent to secure unauthorised access to a program or data, with penalties in subsection (3), and section 17(5) and (8) say when access is unauthorised and what securing access means. None of these creates a duty to make, keep, produce or review a log or record. Territorial reach comes from section 4 (the offence applies if at least one significant link with domestic jurisdiction exists) read with section 5(2): the accused was in the home country when he did the act, or the computer holding the program or data was there. Only the accused-presence link maps to a hook value; the computer-location link has none and is left out.
- Kind
- None
- As of
What this law does
Section 1 makes it an offence for a person to cause a computer to perform any function with intent to secure access to a program or data, where that access is unauthorised and the person knows it is unauthorised. Section 17(5) defines access as unauthorised if the person is not themselves entitled to control access of that kind and does not have consent from someone who is; section 17(8) applies the same test, in materially the same words, to an act done in relation to a computer more generally.
Neither definition conditions unauthorised access on defeating a technical security measure. No reported UK case has been located establishing how section 1 applies to the automated collection of content from a public, unauthenticated website that imposes no access control. The sections this entry groups came into force on different days.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .