New ZealandCrimes Act 1961, Accessing a Computer System Without Authorisation
Crimes Act 1961 (NZ), No 43, s. 252
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.legislation.govt.nz/act/public/1961/0043/latest/DLM330430.htmlIn force since .
A computer misuse rule binding public and private bodies.
- Enforcement body
- New Zealand Police, prosecuted by the Crown
- Audit expectation
- none
What it requires
- Do not intentionally access, directly or indirectly, a computer system without authorisation, knowing or being reckless as to whether you are authorised to access it.
- Accessing a public, unauthenticated page has not itself been held to violate this section, since the offence does not extend to a person authorised to access a system who merely uses that access for an unintended purpose.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Under s. 252(1), a fixed maximum of 2 years imprisonment on conviction; the section states no accompanying fine.
What it makes you log
Logging duty
Section 252(1) makes it an offence intentionally to access a computer system without authorisation, knowing or reckless as to the lack of authority, and subsection (2) excepts an authorised user who accesses it for another purpose. It imposes no duty to create, keep, produce or review a log or record. The Act's general territorial provisions are not cited by this row and section 252 carries no territorial clause of its own, so no hook value is set.
- Kind
- None
- As of
What this law does
Makes it an offence, punishable by up to 2 years imprisonment, to intentionally access, directly or indirectly, any computer system without authorisation, knowing or being reckless as to the lack of authorisation.
The section expressly does not apply to a person who is authorised to access a computer system but does so for a different purpose than the one for which access was given, which leaves open whether accessing a public, unauthenticated page (for which no authorisation was ever required) falls within the offence at all; no reported New Zealand decision has tested a scraping fact pattern under this section.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .