LexLint.ioBeta

Know the law your code answers to.

Law / Latvia

Krimināllikums Sections 241, 243, 244, Automated Data Processing System Offences

Krimināllikums, 241., 243. un 244. pants

In force.

A computer misuse rule binding public and private bodies.

Obligation class
Access restriction
Audit expectation
none

What it requires

  • Do not breach an automated data processing system's protective means, access it without permission, or use rights granted to another person to access it, where doing so causes substantial harm; whether an ordinary, unauthenticated page with no such protective means falls outside the without-permission ground is untested.NIST AI RMFMAP 4.1
  • Do not modify, damage, destroy, impair, or conceal information in an automated data processing system without authorization, or knowingly enter false information into it, per Section 243.no control in the NIST AI RMF
  • Do not manufacture, adapt, distribute, acquire, transport, or store a tool, device, software, password, or access code intended to influence such a system's resources, or to gain unauthorized access to it for committing a crime, per Section 244.no control in the NIST AI RMF

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
NIST AI 600-1
OWASP LLM Top 10
OWASP Agentic Top 10
  • ASI03Identity and Privilege Abuse
MIT mitigations Draft
  • 2.1Model & Infrastructure Security
  • 3.2Data Governance
FINOS AIGF
ETSI EN 304 223
  • 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.

Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.

If you get it wrong

Criminal exposureYes

Criminal exposure note

Section 241 (arbitrary access) carries up to two years' deprivation of liberty where substantial harm is caused, four years where committed for financial gain, and seven years where committed by an organized group, causing serious consequences, or against a state-security system. Section 243 (interference with system data) carries up to three years, rising to seven for serious consequences, a state-security system, or an organized group. Section 244 (illicit tools) carries up to two years, rising to five for an organized group or serious consequences.

Who enforces it

Settledness

As of
Open questions
  • Does access to public pages that breaches only the operator's terms of use count as access 'bez attiecīgas atļaujas' (without the relevant permission) under Section 241 paragraph 1?
  • What amounts to 'būtisks kaitējums' (substantial harm) under Section 241 paragraph 1 when a client merely reads data that the operator serves to the public?

What it makes you log

Logging duty

Sections 241, 243 and 244 define offences of unauthorized access to an automated data processing system, interference with it or unlawful handling of the information in it, and unlawful acts with devices that affect its resources. They impose no duty to create, keep, produce or review a log or record.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 241 makes arbitrary access to the resources of an automated data processing system a crime where it involves breaching the system's protective means, or is carried out without permission, or by using rights granted to another person, and in every case only where it causes substantial harm; the maximum penalty rises from two to four years where the access is for financial gain, and to seven years where committed by an organized group, causing serious consequences, or directed at a system processing state-security-related information.

Section 243 separately criminalizes unauthorized modification, damage, destruction, impairment, or concealment of information in such a system, or knowingly entering false information into it, at penalties up to three years, rising to seven for an organized group or serious consequences.

Section 244 criminalizes the unauthorized manufacture, adaptation, distribution, acquisition, transport, or storage of a tool, device, software, password, or access code intended to influence such a system's resources or to gain access to it for committing a crime, at penalties up to two years, rising to five for an organized group or serious consequences. The current wording of each of these sections took effect on a different day.

When LexLint raises it

When your app profile says your app crawls the web.

Back to the example  ·  Lint your app

Page updated .