LuxembourgCode penal, Computer Misuse Offences (Unauthorized Access, Interference, Data Introduction, Devices, Attempt, Association)
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Prohibition
- Audit expectation
- none
What it requires
- Do not fraudulently access or remain in all or part of an automated or non-automated data-processing or transmission system located in Luxembourg.NIST AI RMFMAP 4.1
- If you hold an authorization to access a system that processes personal data, do not process that data for purposes other than those for which the authorization was granted.NIST AI RMFMEASURE 2.10
- Do not intentionally interfere with, falsify, or introduce, suppress, alter or intercept data in an automated or non-automated data-processing or transmission system, to the prejudice of another person's rights.NIST AI RMFMAP 4.1
- Escalated penalties apply where unauthorized access or interference results in a transfer of money or monetary value for economic gain, is committed against an information system of a critical infrastructure, or causes serious harm to such a system, and to producing, selling or holding a device or electronic key intended to commit these offences.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Fraudulent access to or remaining in a computer system draws two months to two years of imprisonment and a fine of 500 to 25,000 euros, or either penalty alone, rising to four months to two years and 1,250 to 25,000 euros where data is suppressed or modified or the system's functioning is altered (art. 509-1). Interference with a system's functioning and the intentional introduction, suppression, modification or interception of its data draw three months to three years and 1,250 to 12,500 euros (arts. 509-2 and 509-3). Where any of these offences causes a transfer of money or monetary value for economic gain, is committed against a critical infrastructure's information system or causes serious harm to one, or involves producing, selling, holding, importing, distributing or making available a device or electronic key intended to commit them, the penalty rises to four months to five years and 1,250 to 30,000 euros (arts. 509-4 and 509-5). Attempt and participation in an association formed to commit these offences draw the same penalty as the completed offence, or the most severely punished offence within the association's object (arts. 509-6 and 509-7).
Penalty structure
30,000 euros is the ceiling of the most severe tier, articles 509-4 and 509-5 (also carrying four months to five years of imprisonment), for an aggravated offence involving a money transfer, an offence against or causing serious harm to a critical infrastructure's information system, or a device or key intended to commit these offences. The base offence under article 509-1 carries a lower ceiling of 25,000 euros (two months to two years, or four months to two years where data is altered), and articles 509-2 and 509-3 carry 12,500 euros (three months to three years).
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 30,000
Who enforces it
Settledness
- As of
- Open questions
- Do terms of use that forbid automated collection make access to a public page 'frauduleusement' (fraudulent) within the meaning of article 509-1?
- Does continuing to crawl after a technical block mean that the client 'se sera maintenu' (remained) in a system 'frauduleusement' under article 509-1?
What it makes you log
Logging duty
Articles 509-1 to 509-7 define offences of fraudulent access to a data system, interference with its operation, data introduction, devices, attempt and association. They impose no duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Article 509-1 punishes fraudulently accessing or remaining in all or part of an automated or non-automated data-processing or transmission system with two months to two years of imprisonment and a fine of 500 to 25,000 euros, rising to four months to two years and 1,250 to 25,000 euros where data is suppressed or modified or the system's functioning is altered.
A second paragraph, added by the Loi du 29 juillet 2023, punishes with the same penalties a person who holds authorisation to access a system processing personal data but processes that data for purposes other than those for which the access was granted. Because the offence's trigger is fraudulent access, a scraper reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision.
Article 509-2 punishes intentionally interfering with or falsifying the functioning of an automated or non-automated data-processing or transmission system, and article 509-3 punishes intentionally introducing, suppressing or altering its data, each with three months to three years of imprisonment and 1,250 to 12,500 euros.
Article 509-3 also punishes, with the same penalties, intentionally intercepting data during non-public transmissions to, from or within such a system, a paragraph the Loi du 18 juillet 2014 added.
Article 509-4 raises the penalty to four months to five years and 1,250 to 30,000 euros where any of these offences causes a transfer of money or monetary value for economic gain, and a amendment added the same penalty for committing any of the article 509-1 to 509-3 offences against an information system of a critical infrastructure, or causing serious harm to such a system by committing them; article 509-5 punishes producing, selling, holding or distributing a device or electronic key intended to commit these offences at the same level.
Attempt and participation in an association formed to commit these offences are punished the same as the completed offence, under articles 509-6 and 509-7. Article V of the Loi du 15 juillet 1993 inserted into the Code penal a section on certain computer offenses, Articles 509-1 to 509-7. That Law took effect on .
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .