NetherlandsWetboek van Strafrecht, art. 138ab, Computervredebreuk (Computer Trespass)
Wetboek van Strafrecht, art. 138ab (BWBR0001854)
In force since .
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not access an automated work by breaching a security measure, a technical intervention, false signals or a false key, or a false identity; reading a public, unauthenticated page without defeating any access control has not itself been held to violate this article.
- After any access gained that way, do not copy, tap, or record the data stored on, processed by, or transferred through that system.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Imprisonment of up to two years or a fine of the fourth category for the base offense; up to four years for subsequently copying, tapping, or recording data, or for offending through a public telecommunications network for unlawful gain or to reach a third party's system (art. 138ab, second and third paragraphs); the fourth paragraph increases the prison term by one third where the offense is committed for a foreign power.
Who enforces it
Settledness
- As of
- Open questions
- Does an automated request to a public page that an operator has protected only by an IP block or a rate limit come about by 'het doorbreken van een beveiliging' under Article 138ab, paragraph 1, when the scraper changes its address to continue?
- Does a prohibition of automated access in a website's terms make entry 'wederrechtelijk' under Article 138ab, paragraph 1, where no technical barrier stands in the way?
What it makes you log
Logging duty
Article 138ab makes it an offence to intrude intentionally and unlawfully into an automated work, and sets higher penalties where the intruder then copies, intercepts or records data. It imposes no duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Whoever intentionally and unlawfully breaks into an automated work, or part of one, is punished with imprisonment of up to two years or a fine of the fourth category. Breaking in is in any case present where the access is obtained by breaching a security measure, a technical intervention, false signals or a false key, or assuming a false identity.
Copying, tapping, or recording data after that unauthorized access raises the maximum to four years, and doing so through a public telecommunications network for unlawful gain or to pivot to a third party's system also carries a four-year maximum. Where the offense is committed for a foreign power, the prison term is increased by one third.
A scraper reading a public, unauthenticated page without using any of the listed methods falls outside the cases the provision lists, which it introduces with the words "in ieder geval" (in any case), so the list is not stated to be exhaustive. This offense binds both natural and legal persons, since criminal offenses generally can be committed by either under the criminal code's general part.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .