NorwayPenal Code, Unauthorised Access to a Computer System
In force since .
A computer misuse rule binding public and private bodies.
- Criminal exposure
- Yes
- Private right of action
- No
- Criminal exposure note
- A fine or imprisonment of up to two years, on conviction (§ 204).
- Audit expectation
- none
What it requires
- Do not gain access to a computer system or part of it by breaching a protection measure or by another unauthorised method.
- Reading a public, unauthenticated page without defeating any access control has not itself been held to fall within this section.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Straffeloven § 204 gjor det straffbart a skaffe seg tilgang til et datasystem ved a bryte en beskyttelse eller pa annen uberettiget made; den palegger ingen plikt til a opprette, oppbevare, utlevere eller gjennomga en logg. In English: section 204 makes it an offence to gain access to a data system by breaking a protection or by other unjustified means, and imposes no duty to create, keep, produce or review a log or record. The Penal Code's general territorial provisions are not cited by this row, so no hook value is set.
- Kind
- None
- As of
What this law does
Section 204 punishes, with a fine or imprisonment of up to two years, a person who gains access to a computer system or part of it by breaching a protection measure or by another unauthorised method. The provision sits in Chapter 21 (Protection of Information and the Exchange of Information), added to the Penal Code by the Act of No. 74.
Because the offence's trigger is breaching a protection measure, a scraper reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .