MalawiElectronic Transactions and Cyber Security Act, 2016, unauthorized access to data
In force since .
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not access, intercept, or interfere with data without authority or permission to do so, or beyond the access you are authorized for.
- Reading a public, unauthenticated page without defeating any access control has not been tested against this section in a reported decision.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A fine of K2,000,000 and imprisonment for five years on conviction (s. 84(3)); imprisonment of not less than ten and not more than fifteen years, with no separate fine, where the data concerns national security or an essential service (s. 84(10)).
Penalty structure
Base offence under s. 84(3); the same subsection also allows imprisonment of up to five years. A separate, more severe imprisonment-only tier of ten to fifteen years applies under s. 84(10) where the data concerns national security or an essential service.
- Rule
- Fixed only
- As of
- Currency
- MWK
- Fixed cap
- 2,000,000
What it makes you log
Logging duty
Section 84 forbids unauthorized access to, interception of, or interference with data, makes intentional access without authority an offence with a fine and five years' imprisonment, and covers devices and codes made to overcome data security. It requires no log or record, and the Minister's regulations under 84(2) only list permitted cases. The Act's rule that a record required by law is satisfied by electronic retention (section 17) and its other chapters sit outside section 84 and are not read into this row. The section states no territorial test, so the hook is empty.
- Kind
- None
- As of
What this law does
Section 84(1) prohibits a person from gaining unauthorized access to, or intercepting, or interfering with data. Section 84(3) makes it an offence for a person to intentionally access or intercept any data without authority or permission to do so, or to exceed authorized access, punishable on conviction by a fine of K2,000,000 and imprisonment for five years; unlike Kenya's neighbouring provision, the offence does not require defeating a security measure to gain access.
Section 84(10) raises the penalty to imprisonment of not less than ten and not more than fifteen years, with no separate fine stated, where the data concerned is data connected with national security or the provision of an essential service. Because the offence turns on accessing data without authority rather than on circumventing a technical control, its reach to a scraper reading a public, unauthenticated page is unsettled.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .