IrelandCriminal Justice (Offences Relating to Information Systems) Act 2017
In force since .
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not intentionally access an information system by infringing a security measure, without lawful authority or reasonable excuse (s. 2).NIST AI RMFMAP 4.1
- Do not intentionally hinder or interrupt an information system, or delete, damage, alter, suppress or intercept data on it, without lawful authority (ss. 3-5).no control in the NIST AI RMF
- Do not produce, distribute or make available a computer programme, password, code or similar data designed for committing any of the section 2 to 5 offences (s. 6).no control in the NIST AI RMF
- Reading a public, unauthenticated page without defeating any access control has not itself been held to violate section 2.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Offences under ss. 2, 4, 5 or 6: on summary conviction, a class A fine or imprisonment up to 12 months, or both; on conviction on indictment, a fine or imprisonment up to 5 years, or both. An offence under s. 3 (interference with an information system) carries the same summary tier but up to 10 years on indictment (s. 8(1)-(2)).
Who enforces it
Settledness
- As of
- Open questions
- Does a rate limit or IP block on a public web page count as 'a security measure' whose infringement makes access an offence under section 2?
- What amounts to a 'reasonable excuse' under section 2 for a person who collects data from a public site against the operator's terms of use?
What it makes you log
Logging duty
Sections 2 to 6 create offences of accessing an information system, interfering with a system or its data, intercepting transmissions and supplying tools, and section 8 sets the penalties. They impose no duty to create, keep, produce or review a log or record. A search warrant power for evidence of these offences sits in section 7, which is not among the sections covered.
- Kind
- None
- As of
What this law does
Section 2 makes it an offence to intentionally access an information system without lawful authority or reasonable excuse by infringing a security measure. Section 3 criminalises intentionally hindering or interrupting the functioning of an information system without lawful authority. Section 4 criminalises intentionally deleting, damaging, altering or suppressing data on an information system without lawful authority.
Section 5 criminalises intentionally intercepting a non-public transmission of data to, from or within an information system, without lawful authority. Section 6 criminalises producing, selling, procuring, importing, distributing or otherwise making available a computer programme, password, code or similar data designed for committing any of the section 2 to 5 offences.
Because section 2's trigger is infringing a security measure, reading a public, unauthenticated page without defeating any access control falls outside a plain reading of that offence; no reported Irish case has tested the point. The Act repealed the earlier 'unauthorised accessing of data' offence at section 5 of the Criminal Damage Act 1991. That earlier offence rested on operating a computer with intent to access data, rather than on defeating a security measure.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .