
JANUS.NET, e-journal of International Relations
ISSN: 1647-7251
Vol. 1, n.º 1 (Autumn 2010), pp. 70-80
Internet Governance
Pedro Veiga e Marta Dias
77
possibility of data processing to two specific situations: those resulting from the law,
and those stemming from the express free and informed consent of each individual.
Apart from these two situations, we have a muddy field that deserves and awaits legal
regulation. This is where vagueness arises, when, for instance, the applicable legal
system is that of a country where simply there may not be a law regulating personal
data protection. This is the case in the USA, for example, where the accountability
model prevails, in detriment of personal data protection, which we have in countries
like Portugal or Germany.
In 1991, the Computer Crime Law (LCI) was approved as per Law no. 109/91 of 17
August. This law followed the Recommendation 89/9 of the European Council and
adopted the non-compulsory list of crimes listed in the Recommendation, such as:
computer fraud; damage regarding data or computer programmes; computer
sabotage; illegal access; illegal interception and reproduction of protected programmes.
The penalties for basic crimes ranged from imprisonment up to 3 years, except in the
case of qualified crimes, when sentences could be up to 10 years imprisonment (in the
case of informatics sabotage). The Computer Crime Law also foresaw the criminal
responsibility of companies practising this type of crime (as well as several accessory
crimes), with managers and the actual companies being considered responsible. The
national legal system went even further, and the Criminal Code established the legal
system regarding computer fraud where, contrary to what happens with the LCI,
companies are not considered to be accountable.
Meanwhile, on 23 November 2001, Portugal joined the Cybercrime Convention, whose
main goal was to standardise the national legal systems of member states of the
European Union with regard this type of crime, as well as to make international
cooperation and crime investigation easier.
On 15 September 2009, Law no. 109/2009, also known as Cybercrime Law, was
published. This new law set out the material and procedural penal dispositions, and
those on international cooperation on crime matters, regarding cybercrime and the
collection of evidence in electronic format. It transposed into the Portuguese legal
system the Council Framework Decision no. 2005/222/JHA on attacks on information
systems, adapting internal law to the Convention on Cybercrime of the Council of
Europe. The Computer Crime Law, which had been in force for a long time, was, thus,
revoked. On the same day the Cybercrime Law was published, the Convention on
Cybercrime was also approved and ratified (eight years later), as well as the Additional
Protocol to The Convention on Cybercrime Concerning the Criminalisation of Acts of a
Racist and Xenophobic Nature Committed Through Computer Systems, adopted in
Strasbourg on 28 January 2003. This law implemented what Portugal committed to do
as part of the Cybercrime convention. It is an instrument for international cooperation
as it allows over 40 countries to adopt a similar legal system regarding Cybercrime and
electronic collection of evidence on matters of attack against information systems.
This new law brings a new element, in that it sets out types of new crimes that aim to
deal with new Internet paradigms, such as the crime of phishing. Now, the mere
propagation of computer viruses is punished. Even in the absence of computer
damages, Courts may rule the handing over of objects, equipments or devices to the
State, if they were used for the practice of crimes listed. This is a law applicable to
computers crimes, crimes committed by electronic means, or illicit acts whose evidence
is kept electronically. To further stress the points made in this paper, this law