Jordan Cybercrime Law No. 17 of 2023: Key Offences and Penalties

Cybercrime Law No. 17 of 2023 was introduced to address offences committed through networks, information systems and modern technological means. It creates a criminal-law framework for the digital environment and the risks it presents to property, data, privacy, security and social interests.

The law criminalises unauthorised access to information systems and websites, as well as exceeding the limits of permission granted to a user. Article 3 provides for more serious consequences depending on the result of the conduct. This covers access or use without permission or outside the user's authorised scope.

The law addresses attacks on government, financial, banking and critical-infrastructure systems. Article 4 provides penalties in view of the nature of the interests protected and the serious impact of disrupting, manipulating or interfering with these systems.

Protection extends to payment methods and electronic financial transactions. Article 8 addresses conduct involving the taking, obtaining or unlawful use of payment-method data. This protection is increasingly important as individuals and businesses rely on digital banking and electronic services.

In relation to online content, Article 15 regulates certain conduct involving false news, defamation, insult and disparagement. Article 17 addresses publishing material capable of provoking discord or hatred, or calling for violence. Applying these provisions requires an assessment of the content, its context, purpose and consequences in the circumstances of each case.

Article 18 criminalises electronic blackmail and threats, with enhanced penalties in certain situations where a threat is accompanied by a demand or allegations damaging to honour or reputation. Messages, links, accounts and communication data may need to be preserved properly so that digital evidence can be presented to the competent authorities.

The law prohibits certain forms of publishing or circulating private content for the purpose of defamation, harm or obtaining a benefit, as regulated by Article 20. Personal data should therefore be protected, and private images, recordings or correspondence should not be redistributed without a legal basis. Legal advice may be appropriate where privacy has been violated.

The law does not address only the direct perpetrator. Article 25 regulates the responsibility of a person who has actual management responsibility for certain websites, platforms and public accounts in relation to unlawful content, within the limits and safeguards set by the provision. This does not mean that every platform manager is automatically liable for every item of content; the person's actual role, knowledge and statutory duties must be examined.

The law gives the courts powers relating to securing digital evidence, preserving data and taking measures concerning content or systems connected with offences, subject to its safeguards. Cybercrime cases often require a careful approach to devices, accounts, messages and access data because the integrity of digital evidence may affect the assessment of liability.

The Jordanian Cybercrime Law represents a legislative attempt to create a criminal-law framework for the digital environment as a new field in which property, data, privacy, security and social interests may be harmed. The applicable provisions and penalties vary according to the conduct, the act and the resulting harm.