RwandaLaw on Prevention and Punishment of Cybercrimes, unauthorized access
Law N° 60/2018 of 25/09/2018 on Prevention and Punishment of Cyber Crimes art. 16 (Unauthorized access to a computer or a computer system data)
In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Place of effect
- Audit expectation
- none
What it requires
- Do not access computer or computer system data without the consent of a person entitled to give it, without being entitled to control or access it yourself, or by accessing another person's computer system without authorization.
- Reading a public, unauthenticated page has not itself been held, in a reported Rwandan decision, to violate this article.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Imprisonment of not less than six months and not more than two years and a fine of not less than RWF 1,000,000 and not more than RWF 2,000,000, on conviction (art. 16, para. 2).
Penalty structure
Fine only; the same paragraph also allows imprisonment of six months to two years instead of or alongside the fine.
- Rule
- Fixed only
- As of
- Currency
- RWF
- Fixed cap
- 2,000,000
What it makes you log
Logging duty
Article 16 criminalizes intentional and unlawful access to computer or computer system data without consent, without entitlement, or into another person's system without authorization, with imprisonment of six months to two years and a fine. It states an offence and a penalty and imposes no duty to create, keep or produce a log or record. Duties of record and retention sit in articles outside the row: article 5(2) requires a service provider whose system is being used to commit an offence to preserve information showing the communication's origin, destination, route, time, date, size, duration and type of service, with no period stated; article 12 lets an order require a computer to be preserved for up to thirty days, extendable once; and article 15 requires the prosecution authority to log the technical means used, the system modified and the information obtained when it uses a forensic method. Article 2 of the Law applies it to cyber-crimes committed in Rwanda or outside Rwanda if they have produced effect in Rwanda.
- Kind
- None
- As of
What this law does
Article 16 makes it an offence for a person to intentionally and unlawfully get access to computer or computer system data where the person does not have consent from someone entitled to give it, is not entitled to control or access the data, or accesses another person's computer system without authorization to know recorded or transmitted data, by any means and regardless of location. The offence carries imprisonment of six months to two years and a fine of RWF 1,000,000 to 2,000,000.
None of article 16's three grounds requires infringing a technical security measure; each turns instead on the absence of consent, entitlement, or authorization.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .