Introduction

Matrix organization

Mergers by absorption

Risks related to the expansion of the scope of criminal liability of legal entities

Validity conditions

Proof of delegation

Exemption from individual liability of delegator

Attribution of offense to legal entity

Delegations of authority

Criminal risk management within business organizations

Complicity in crimes against humanity

Breaches of secrecy

Personal data breaches

Theft

Extortion

Blackmail

Fraud

Misappropriation

Receiving/concealment of unlawfully obtained property (recel)

Attacks on automated data processing systems

Money laundering

Misappropriation by public official (concussion)

Corruption and influence peddling

Unlawful acquisition of an interest

Favoritism

Forgery and use of forgeries

Violation of Criminal Code

Offenses under the Monetary and Financial Code

Offenses under the Commercial Code

Environmental Code violations

Offenses arising from other codes

Types of offenses

Offenses under the Criminal Code, the Commercial Code, or the Environmental Code, Criminal procedure

White Collar Crime (en cours)

Article 323-1 of the Criminal Code prohibits the act of accessing or remaining, fraudulently, in all or part of an automated data processing system,  which is punishable by two years of imprisonment and a fine of EUR 60,000. When this results in either the deletion or modification of data contained in the system, or an alteration of the functioning of this system, the penalty is increased to three …

Fraudulent access or maintenance in an automated data processing system

Article 323-1 of the Criminal Code prohibits the act of accessing or remaining, fraudulently, in all or part of an automated data processing system,  which is punishable by two years of imprisonment and a fine of EUR 60,000. When this results in either the deletion or modification of data contained in the system, or an alteration of the functioning of this system, the penalty is increased to three years of imprisonment and a fine of 100,000 euros, and when the offenses are committed against an automated data processing system of personal data implemented by the State, to five years of imprisonment and a fine of EUR 150,000. Natural persons face the additional penalties of Article 323-5, and legal entities are subject, in addition to the fine of Article 131-38, to the penalties provided by Article 131-39.

The computer system that contains data for a specific result and is protected by a login and password constitutes an automated data processing system within the meaning of Article 323-1 of the Criminal Code, which does not require the system to be operational but applies to a site under construction . This definition excludes from the scope of the text the intentional use of stolen bank cards in highway automatic payment devices, which is not intended to fraudulently access and breach an automated data processing system .

Article 323-1 targets both access and maintenance within the system. To establish fraudulent access, the intrusion into the system by any means must be intentional and unauthorized. This applies to a person who, knowing they are not authorized, enters an automated data processing system , without the victims' knowledge , who, even without forcing entry or using a code, voluntarily accessed the victim's email without their knowledge, accessible from their professional computer and only protected by a password after a period of inactivity , or who illicitly obtained access codes and used them, then communicated them to some employees for their use . It is also the case for defendants who, fully aware, fraudulently connect to a company's computer system for recording and processing files to which they are unrelated, and consult and manipulate the data, even if the purpose is to retrieve data that their company still owns, as this circumstance does not authorize them to access the computer system without the knowledge of the authorized managers .

The act of remaining in an automated data processing system after discovering that it was protected, extracting data from it and using it without the owner's consent  or using a database for two years with a code provided for a trial period, which was only accessible to authorized persons  or, after mistakenly reaching the core of an extranet, browsing the directory tree and returning to the homepage, while noting the presence of access controls and the need for authentication by username and password, and performing downloads of obviously protected data  constitutes the offense of fraudulent access to an automated data processing system.

The defendant cannot rely on his status to install software in the exercise of his activity as a lawyer and his specific functions as a network administrator to use this tool for purposes unrelated to monitoring the proper functioning of the firm , his professional situation and reputation to justify possessing equipment designed or adapted for a fraudulent breach of an automated data processing system , or the exercise of defense rights to connect to his professional computer, despite the deactivation of his account, using a user account created under another name to extract from his former account his email data and the domain directory with the aim of retrieving evidence in anticipation of a potential labor dispute .

On the other hand, an attack on automated data processing systems cannot be attributed to a person who, having the rights to access and modify the data, deletes data—in this case, entries related to cash sales before they are finalized from an accounting perspective—without concealing them from potential other users of the system .

Finally, in the absence of bad faith, the offense of fraudulent retention in an automated data processing system is not established . Thus, the moral element of the offense is lacking when a technical director tries to connect to a site, using a free web page scraper available on the internet to retrieve a web page without using a password or login, accessing the company's site without difficulty, fraud, use of a password or identifier, or warning .

Cass. crim., 12 July 2016, LawLex202200010036JBJ, which specifies that a site under construction or development constitutes a system as long as it contains data that must be preserved and requires a password for access, regardless of whether the username and password are not very secure and were previously known to the intruders, as long as they had no authorization to enter and remain in the automated data processing system.

CA Pau, 28 February 2008, LawLex202200010203JBJ.

Cass. crim., 10 May 2017, LawLex202200003525JBJ.

Cass. crim., 16 January 2018, LawLex202200001625JBJ, which emphasizes that the authorization for possession provided by Article 323-3-1 of the Criminal Code, authorizing such equipment, is limited to persons authorized to ensure the maintenance and security of an IT system.

Cass. crim., 5 April 2022, LawLex202200009852JBJ, which specifies that creating an account in the name of a third party to reactivate one's own, thereby knowingly concealing one's action from other users of the STAD, in the context of a sudden termination of professional relationships, constitutes fraudulent intent.

Cass. crim., 7 January 2020, LawLex202200001626JBJ.

Cass. crim., 22 October 2014, LawLex202200010042JBJ.

Cass. crim., 22 February 2011, LawLex202200010043JBJ.

Cass. crim., 9 March 2016, LawLex202200010038JBJ.

Cass. crim., 16 January 2018, LawLex202200001625JBJ.

Cass. crim., 27 March 2018, LawLex202200006464JBJ.

CA Orléans, 25 November 2008, LawLex202200010039JBJ.

Cass. crim., 22 November 2005, LawLex202200010040JBJ.

Cass. crim., 20 May 2015, LawLex202200001407JBJ.

Cass. crim., 3 October 2007, LawLex202200001627JBJ.

CA Paris, 5 February 2014, LawLex202200010041JBJ, which noted that the defendant was aware of his unlawful retention in the automated data processing system visited.

White Collar Crime (en cours)

96. Fraudulent access or maintenance in an automated data processing system

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise

Les décisions de justice citées dans ce paragraphe :

Les notions juridiques connexes

96. Fraudulent access or maintenance in an automated data processing system

Demandez un accès gratuit au contenu exclusif Livv – juristes d’entreprise

Les décisions de justice citées dans ce paragraphe :

Les notions juridiques connexes

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise