ItalyCodice Penale Art. 615-ter, Unauthorized Access to a Computer or Telematic System
Codice Penale, art. 615-ter, as amended by Legge 28 giugno 2024, n. 90
In force since .
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not access, or remain within after being excluded, a computer or telematic system protected by security measures without the right-holder's consent.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Imprisonment up to three years for the base offence (comma 1, prosecutable only on complaint); two to ten years for the aggravated forms of comma 2 (ex officio); three to ten years, or four to twelve years, where the system is of military, public-order, public-security, health, or civil-protection interest (commi 3-4).
Who enforces it
Settledness
- As of
- Open questions
- Do terms of use that forbid automated collection express 'la volontà espressa o tacita' (the express or tacit will) of the person entitled to exclude, so that a scraper 'vi si mantiene contro' (remains against) that will?
- Is a public web server 'protetto da misure di sicurezza' (protected by security measures) when it runs only a rate limit or a robots.txt file?
What it makes you log
Logging duty
Article 615-ter defines the offence of unauthorized access to a protected computer or telematic system and its aggravated forms. It imposes no duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Whoever abusively enters a computer or telematic system protected by security measures, or remains within it against the express or tacit will of whoever has the right to exclude them, is punished with imprisonment up to three years (comma 1); this base offence is prosecutable only on the victim's complaint.
Imprisonment rises to two to ten years where the offender is a public official or public-service employee abusing their powers or duties, or a person who also unlawfully practises as a private investigator, or an operator abusing their access to the system; where the offender uses threats or violence against people or property or is visibly armed; or where the offence causes destruction, damage, removal, inaccessibility, or interruption of the system, or destruction or damage of the data, information or programmes it holds (comma 2); these aggravated cases are prosecuted ex officio.
Where an offence under comma 1 or comma 2 reaches a system of military, public-order, public-security, health or civil-protection interest, imprisonment rises respectively to three to ten years or four to twelve years (commi 3-4). Legge 90/2024 raised the comma-2 introductory penalty range from one to five years to two to ten years and amended comma 3, effective .
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .