SlovakiaTrestný zákon, Unauthorized Access to a Computer System and Related Offences
Act 300/2005 Coll. (Trestny zakon), ss. 247-247d
In force since .
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not overcome a security measure to gain access to a computer system or part of it without authorization.NIST AI RMFMAP 4.1
- Do not interfere with a computer system's operation or with computer data within it without authorization, including by unauthorized insertion, transmission, damage, deletion, degradation, alteration, suppression, or blocking of computer data.no control in the NIST AI RMF
- Do not intercept a non-public transmission of computer data to, from, or within a computer system without authorization.NIST AI RMFMAP 4.1
- Do not produce, import, procure, sell, exchange, distribute, or otherwise make available a device, computer program, password, access code, or similar data created to enable unauthorized access to a computer system.no control in the NIST AI RMF
- Reading a public, unauthenticated page without defeating any access control has not itself been held to violate these sections.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 247: imprisonment up to two years for the base offence, six months to three years where committed in a more serious manner or causing significant damage, and one to five years where causing large-scale damage or committed as a member of a dangerous grouping. Section 247a and section 247b (unauthorized interference with a system or with data): six months to three years for the base offence, one to five years for an aggravated form (significant damage, serious disruption to a public authority or court, or misuse of another's personal data to gain a third party's trust), and two to eight years where the act causes large-scale damage, causes a serious disruption of critical infrastructure, or is committed by a member of a dangerous grouping. Section 247c (unauthorized interception): up to two years for the base offence, six months to three years where committed by an employee of an electronic communications service provider, one to five years for an aggravated form, and two to eight years for the most serious form. Section 247d (production or possession of an access device): up to two years for the base offence, six months to three years where committed in a more serious manner or causing significant damage, and one to five years where causing large-scale damage or committed as a member of a dangerous grouping. None of sections 247 to 247d attaches a monetary fine.
Who enforces it
Settledness
- As of
- Open questions
- Does an IP block, a rate limit or a CAPTCHA count as a 'bezpečnostné opatrenie' that a scraper 'prekoná' under § 247(1) when it rotates its address to continue?
- Does a prohibition of automated access in a website's terms of use, with no technical measure behind it, leave entry outside § 247(1), which requires that the person 'prekoná bezpečnostné opatrenie'?
What it makes you log
Logging duty
Sections 247 to 247d define offences of unauthorized access to a computer system, interference with it, interference with computer data, interception of computer data, and producing or possessing an access device or password. They impose no duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Section 247 punishes a person who overcomes a security measure and thereby obtains unauthorized access to a computer system or part of it with imprisonment of up to two years, rising to six months to three years where the act is committed in a more serious manner or causes significant damage, and to one to five years where it causes large-scale damage or is committed as a member of a dangerous grouping.
Because the offence applies only where a security measure is overcome, reading a public, unauthenticated page without defeating any access control falls outside the wording of this section.
Section 247a punishes unauthorized interference with a computer system's operation, section 247b unauthorized interference with computer data, section 247c unauthorized interception of non-public computer-data transmissions, and section 247d the production, import, or sale of a device, password, or access code created for unauthorized access to a computer system, each with escalating tiers.
The most serious forms of sections 247a, 247b and 247c carry two to eight years' imprisonment, and the most serious form of section 247d carries one to five years.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .