IcelandAlmenn hegningarlög nr. 19/1940, Art. 229, Unauthorized Access to Computer-Stored Data
In force since .
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not obtain access to another's data or programs stored in computer-readable form without authorization, including by defeating a security measure, under Almenn hegningarlög Article 229.
- Reading a public, unauthenticated page that carries no access control has not itself been held to violate this article.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Fines or imprisonment of up to one year (229. gr., 1. mgr.); the offense is publicly prosecutable rather than resting on the victim's own complaint (242. gr., 1. tölul.).
What it makes you log
Logging duty
Article 229 makes unauthorized access to another person's computer-stored data or programs an offence, punishable by a fine or imprisonment of up to one year, with an exception where the conduct is justified by public or private interests. It imposes no duty to create, keep, produce or review a log or record. The Penal Code's general rules on where it applies are not invoked by the article, so no territorial hook is read from it.
- Kind
- None
- As of
What this law does
Article 229 punishes whoever without authorization obtains access to data or programs of others stored in computer-readable form, with fines or imprisonment of up to one year, unless the conduct is justified by reference to public or private interests. The provision names no security-measure element and no carve-out for a page that carries no access control, and no reported Icelandic decision addresses whether reading such a page without any barrier satisfies the without-authorization element.
This text replaced an earlier version of Article 229 by Act No. 8/2021, which took effect immediately upon its own publication; the same 2021 amendment rewrote the former Article 228 into a separate privacy-intrusion offense, so a citation to "Article 228" for this duty predates the current numbering.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .