Legal position applicable in Luxembourg regarding certain IT-related offences (Art. 509-1 to 509-7 of the Luxembourg Criminal Code):
- Art. 509-1. Anyone who fraudulently accesses or remains in all or part of an automated data processing or transmission system shall be punished by imprisonment for between 2 months and 2 years and a fine of between €500 and €25,000, or one of these two penalties.
- When this results in either the deletion or modification of data contained in the system, or disruption to the operation of said system, the term of imprisonment shall be between 4 months and 2 years and the fine shall be between €1,250 and €25,000.
- Art. 509-2. Anyone who, intentionally and in disregard of the rights of others, hinders or disrupts the operation of an automated data processing or transmission system shall be punished by imprisonment for between 3 months and 3 years and a fine of between €1,250 and €12,500, or one of these two penalties.
- Art. 509-3. Anyone who, intentionally and in disregard of the rights of others, directly or indirectly adds data to an automated data processing or transmission system, or deletes or modifies the data contained therein or the modes of processing or transmitting data, shall be punished by imprisonment for between 3 months and 3 years and a fine of between €1,250 and €12,500, or one of these two penalties.
- The same penalties shall apply to anyone who, intentionally and in disregard of the rights of others, intercepts data during non-public transmission to, from or within an automated data processing or transmission system.
- Art. 509-4. When, in the situations set out in Articles 509-1 to 509-3, money or monetary value is transferred, causing a third party loss of ownership with the aim of giving the person committing the offence or another person a financial advantage, the penalty incurred shall be imprisonment for between 4 months and 5 years and a fine of between €1,250 and €30,000.
- Art. 509-5. Anyone who, with fraudulent intent, produces, sells, obtains, holds, imports, distributes or provides an information technology device for the purpose of committing any of the offences set out in Articles 509-1 to 509-4, or any electronic key enabling access to all or part of an automated data processing or transmission system, in disregard of the rights of others, shall be punished by imprisonment for between 4 months and 5 years and a fine of between €1,250 and €30,000.
- Art. 509-6. Any attempt to commit any of the offences set out in Articles 509-1 to 509-5 shall be punishable by the same penalty as the offence in question.
- Art. 509-7. Anyone who takes part in an association formed or a conspiracy entered into for the preparation, manifested by one or more acts, of one or more offences set out in Articles 509-1 to 509-5, shall be punished by the penalties prescribed for the offence itself or for the most severely punishable offence.