LibyaLaw No. 6 of 2022, supervisory authority, licensing and penalties
Law No. 6 of 2022, arts. 80-82 (Electronic Transactions, licensing and penalties)
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- National Authority for Information Security and Safety
- Obligation class
- Licensing, Prohibition, Governance
- Audit expectation
- none
What it requires
- Obtain a license from the National Authority for Information Security and Safety before providing authentication services that involve collecting personal data.
- Expect the National Authority for Information Security and Safety to accredit and monitor the electronic authentication processes and sites through which you collect personal data.
- Expect imprisonment of at least one year and a fine of three thousand to ten thousand dinars for providing authentication services without a license, rising to a fine of at least ten thousand dinars where the offence disrupts a government, military, security, or banking transaction.
- As the legal representative of a legal person, expect the same penalties where your failure to perform your duties contributed to an offence under this law, and expect the legal person to be jointly liable for any resulting financial penalty.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 81 punishes providing authentication services without a license from the National Authority for Information Security and Safety, and the other acts article 80 lists concerning forged or misused electronic signatures, records, and authentication certificates, with imprisonment of not less than one year and a fine of between three thousand and ten thousand dinars, rising to a fine of not less than ten thousand dinars where the act disrupts a government, military, security, or banking transaction (art. 81). Article 82 extends the same penalties to a legal representative whose failure to perform their duties contributed to the offence, and makes the legal person jointly liable for any financial penalty (art. 82). Article 81's penalty is stated for the offences article 80 lists, not the personal data restrictions article 79 states, so no criminal exposure is recorded for a breach of the personal data duties themselves.
What it makes you log
Logging duty
Article 80 lists prohibited acts (providing authentication services without a licence, giving false information to the authority, forging or misusing electronic records, signatures and certificates), Article 81 sets imprisonment and fines, and Article 82 makes the legal representative and the legal person answerable. The articles name a supervisory authority only as the body that licenses and receives information; they give it no power to demand records and impose no duty to make, keep or produce a log or record. No territorial hook is stated.
- Kind
- None
- As of
What this law does
The law's definitions article names the National Authority for Information Security and Safety as its Authority, and article 27 makes that Authority responsible for accrediting and monitoring the electronic authentication processes and sites through which the entities chapter seven binds collect personal data.
Article 80 bars providing authentication services without a license from that Authority, alongside a further list of prohibited acts concerning forged or misused electronic signatures, records, and authentication certificates.
Article 81 punishes an act listed in article 70 or article 80, which includes the unlicensed provision of authentication services, with imprisonment of not less than one year and a fine of between three thousand and ten thousand dinars, rising to a fine of not less than ten thousand dinars where the act disrupts a government, military, security, or banking transaction.
Article 82 extends the same penalties to the legal representative of a legal person whose failure to perform their duties contributed to the offence, and makes the legal person jointly liable for any financial penalty or compensation where the offence was committed on its behalf.
Article 81's penalty is stated for the offences article 80 lists rather than the personal data restrictions article 79 states, so the text does not clearly arm a separate criminal penalty for a breach of the personal data duties themselves, and no provision gives the Authority or any other body a stated power to investigate or hear a complaint about such a breach.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .