LexLint.ioBeta

Know the law your code answers to.

Law / Hungary

Büntető Törvénykönyv (Criminal Code), Sections 423-424, Violation of Information Systems or Data

2012. évi C. törvény (Btk.), 423-424. § (Információs rendszer vagy adat megsértése)

archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://njt.hu/jogszabaly/en/2012-100-00-00

In force since .

A computer misuse rule binding public and private bodies.

Obligation class
Access restriction
Audit expectation
none

What it requires

  • Do not log into, or remain logged into, an information system by violating or circumventing a technical measure safeguarding it; unauthorized access is a criminal offense under Btk. Section 423(1) regardless of whether any data is altered.NIST AI RMFMAP 4.1
  • Do not hinder an information system's operation, or modify, delete, or render inaccessible data stored in it, without authorization; Btk. Section 423(2) makes this a felony independent of Section 423(1)'s access offense.no control in the NIST AI RMF

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
NIST AI 600-1
OWASP LLM Top 10
OWASP Agentic Top 10
  • ASI03Identity and Privilege Abuse
MIT mitigations Draft
  • 2.1Model & Infrastructure Security
  • 3.2Data Governance
FINOS AIGF
ETSI EN 304 223
  • 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.

Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.

If you get it wrong

Criminal exposureYes

Criminal exposure note

Section 423(1) carries up to two years' imprisonment for unauthorized access or overstaying authorized access; Section 423(2) carries up to three years for unauthorized interference with an information system's functioning or its data; Section 423(3) raises this to one to five years where a significant number of systems are affected or significant harm to interests results; Section 423(4) raises it to two to eight years where the offense is committed against a public-interest facility. Section 424(1) separately punishes, by up to two years, making, handing over, or acquiring a password or program built to facilitate an offense under Section 375, 422(1)(d), or 423.

Who enforces it

Settledness

As of
Open questions
  • Does a rate limit or bot challenge on a public page count as 'a technical measure safeguarding that information system' that a client 'violat[es] or circumvent[s]' under section 423(1)?
  • Do terms of use that forbid automated collection set 'the limits of his authorisation to log in' within the meaning of section 423(1), so that a client which stays on the site beyond them commits the offence?

What it makes you log

Logging duty

Sections 423 and 424 define offences against information systems and data and the making or supplying of passwords and programs to commit them. They impose no duty to create, keep, produce or review a log or record.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 423(1) makes it a misdemeanour, punishable by up to two years' imprisonment, to log into an information system without authorization by violating or circumventing a technical access-control measure, or to stay logged in beyond one's authorization.

Section 423(2) makes it a felony, punishable by up to three years, to hinder an information system's functioning or to modify, delete, or render data inaccessible without authorization, with Section 423(3)-(4) raising the term to one to five years where a significant number of systems are affected or significant harm results, and to two to eight years where the target is a public-interest facility.

Section 424 separately criminalizes making, handing over, or acquiring a password or program built to facilitate one of these offenses. Section 423's current text derives from Act LXXII of 2014, Section 86. That Act's own closing provisions bring Section 86 into force on . The Criminal Code as a whole took effect on . Section 423(3) was later replaced by Act LX of 2022, Section 43.

When LexLint raises it

When your app profile says your app crawls the web.

Back to the example  ·  Lint your app

Page updated .