VenezuelaLey Especial contra los Delitos Informáticos, privacy of personal data and communications (Arts. 20-22)
LECDI, Gaceta Oficial N° 37.313, 30/10/2001, arts. 20-22
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- Do not appropriate, use, modify, or delete a person's personal data or information held in a computer system without their consent.
- Do not access, intercept, or reproduce a person's private data message, transmission, or communication signal without authorization.
- Do not reveal, disseminate, or transfer facts, images, audio, or data obtained through either of the conduct above.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 20 (data privacy): imprisonment of two to six years and a fine of two hundred to six hundred tax units (unidades tributarias), increased by a third to a half if harm results. Article 21 (communications privacy): the same imprisonment and fine range. Article 22 (improper disclosure): the same range, increased by a third to a half if made for profit or if harm results.
What it makes you log
Logging duty
Articles 20 to 22 are offences: taking, using, modifying or deleting another person's personal data without consent, accessing or intercepting another person's data message or communication, and disclosing what was obtained that way. They require no log or record, and the Act names no retention period or audit in these articles. Article 3 of the Act reaches offences committed abroad that have effects in Venezuela, but Articles 20 to 22 do not invoke it, so no hook is coded.
- Kind
- None
- As of
What this law does
Article 20 punishes anyone who intentionally appropriates, uses, modifies, or deletes, by any means and without the owner's consent, another person's personal data or information, or data in which they have a legitimate interest, held in a computer or system that uses information technology, with the penalty increased by a third to a half if the conduct causes harm to the data's holder or a third party.
Article 21 separately punishes accessing, capturing, intercepting, interfering with, reproducing, modifying, diverting, or deleting another person's data message or transmission or communication signal through the use of information technology.
Article 22 punishes revealing, disseminating, or transferring, in whole or in part, the facts discovered, images, audio, or data or information obtained through the conduct articles 20 and 21 describe, with a heavier penalty where the disclosure was for profit or caused harm to another. No dedicated data-protection supervisory authority exists; these criminal offences are the operative statutory sanction for a privacy violation in the absence of a civil regime.
When LexLint raises it
When your app profile says your app processes personal data or processes voice recordings.
Back to the example · Lint your app
Page updated .