TunisiaDecree-Law on Cybercrime, unauthorised access
Décret-loi n° 2022-54 du 13 septembre 2022 relatif à la lutte contre les infractions se rapportant aux systèmes d'information et de communication, art. 16
In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Place of effect
- Audit expectation
- none
What it requires
- Do not access, or remain in, a computer system, in whole or in part, without authorization.
- Do not exceed the limits of any access right that has been granted to you.
- Reading a public, unauthenticated page that defeats no access control has not itself been held to violate this article.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Three months to one year's imprisonment and a fine of 10,000 dinars for knowingly accessing or remaining in a computer system without authorization, or for exceeding a granted access right (art. 16); an attempt is also punishable.
Penalty structure
Article 16's illegal-access and access-limit offence; the same decree-loi's other Chapter III offences carry separate, higher fixed penalties, up to five years' imprisonment and a 100,000-dinar fine for computer falsification (art. 23) and five years and 50,000 dinars for knowingly spreading false news or data through an information system (art. 24).
- Rule
- Fixed only
- As of
- Currency
- TND
- Fixed cap
- 10,000
Who enforces it
Enforcement body
Ministère public (public prosecutor) and judicial police, through the ordinary criminal courts
What it makes you log
Logging duty
Article 16 punishes knowingly accessing or remaining unlawfully in a computer system and knowingly exceeding the access right granted, and the attempt is punishable (English as in the pinpoint above). It imposes no duty to create, keep, produce or review a log or record. Article 6, outside the cited article, requires telecommunications service providers to keep the data stored in an information system (user identification, traffic, terminal and location data) for a period set by joint order and not less than two years from the date of recording, and article 27 punishes a provider that fails to do so; the controller adds it to the traffic-data retention table. Article 34 is the decree-law's own clause for offences under it committed outside Tunisia.
- Kind
- None
- As of
What this law does
Article 16 punishes anyone who knowingly accesses or remains illegally in a computer system, in whole or in part, and imposes the same penalty on anyone who knowingly exceeds the limits of an access right they have been granted; an attempt is also punishable. The offence carries three months to one year of imprisonment and a fine of 10,000 dinars.
Because the offence's trigger is illegal access or exceeding a granted access right, reading a public, unauthenticated page that defeats no access control falls outside a plain reading of the provision. Article 37 repeals the former articles 199 bis and 199 ter of the Penal Code, which the decree-loi's Chapter III offences supersede.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .