Penal Code, Unauthorised Access to an Information System

Article 438(1) punishes any person who, without authorisation, accesses all or part of an information system of which they are not the holder, with imprisonment of up to two years or a fine of up to 240 days.

Article 438(2) raises the penalty to imprisonment of two to eight years where the access is achieved by defeating security measures, or is directed at a 'serviço protegido' (a service whose access is conditional on a subscription or other prior individual authorisation, as Lei n.º 7/17 art. 4(a) defines the term).

Article 438(3) applies the same heavier tier where the actor learns a commercial or industrial secret or confidential data protected by law, or obtains a benefit or advantage of elevated value. Article 438(4) extends the base penalty to a person who, without due authorisation, processes individually identifiable data or transmits it to a third party for a purpose other than the one authorised.

Article 437 defines 'sistema informático' broadly as any device or set of interconnected devices that automates the processing of computer data, together with the network supporting communication between them.

The offence draws no distinction based on whether the accessed system or page is public and unauthenticated, so a plain reading exposes web crawling that accesses a system without the holder's authorisation, regardless of whether a technical barrier was defeated, though the enhanced tier under Article 438(2) requires either a security-measure violation or a conditional-access service.

Lei n.º 7/17 (Lei de Protecção das Redes e Sistemas Informáticos) imposes separate security and data-retention duties on network operators, but its own Article 44 states that, for information systems and data, subsidiarily the legal regime provided by the criminal legislation and criminal procedure legislation in force applies, referring unauthorised-access liability back to this Penal Code article rather than creating a second offence.