Parliament has just approved a new law establishing a regulatory framework for crimes committed in the digital environment, with the aim of addressing the challenges posed by cybercrime. This legislation will provide tools to prevent and punish illegal digital activities, in a challenging context with the emergence of new forms of crime.

The law is structured into four main chapters:

I. Classification of computer crimes
Defines and penalizes new illegal conduct:

Cyberbullying: This occurs when electronic means (such as the Internet, social networks, text messages, etc.) are used to persistently stalk, monitor or try to approach another person, seriously disrupting their life.

Computer fraud: occurs when electronic means are used to deceive another person and obtain a financial benefit, causing harm to the victim (for example, unauthorized transfers, use of cards).

Computer damage: This occurs when a person destroys, alters or disables computer systems with the aim of causing damage. This may include, for example, deleting files, introducing viruses, or blocking access to computer systems.

Unlawful access to computer data: criminal conduct consisting of unauthorized access to third-party computer systems in order to obtain, manipulate or distribute the information contained therein.

Unlawful interception: This occurs in cases of total or partial interception of communications that are in transit through computer networks or systems.

Data breach: This occurs when a person, using any type of technology, accesses, appropriates, uses or modifies confidential information of third parties without their authorization.

Identity theft: occurs when a person falsely assumes the identity of an individual or entity, using social networks, emails, bank accounts, digital platforms and any other computer system that allows obtaining personal information and access credentials.

Device abuse: This occurs when a person creates, acquires, introduces into the country, sells or provides to other individuals, programs, credentials or passwords whose main objective is to facilitate the commission of a crime.

II. Prevention and education measures

It establishes the obligation of the State to promote awareness campaigns on computer security and to foster education in cybersecurity. It also provides mechanisms for collaboration between the public and private sectors in the implementation of preventive measures.

III. Cybercriminal Registry

It enables financial intermediation institutions and electronic money issuing entities to create records of people involved in illegal activities in cyberspace. In this context, the law exempts these entities from banking secrecy, so they can share their records among themselves and with the competent authorities in order to file complaints or take steps to prevent and mitigate cybercrimes.

IV. Prevention of non-consensual transactions

It empowers financial intermediation institutions and electronic money issuing entities to freeze funds in client accounts originating from unknown and unauthorized transactions from third-party accounts.

This new Law will surely promote, among others, the following aspects:

Strengthening the legal framework and prevention: provides authorities with tools to investigate and punish these crimes more effectively. Prevention and education measures should help reduce their incidence.
Tools for the financial system: grants the financial system the power to, among other measures, freeze accounts in the event of unauthorized transactions, enabling timely action to prevent or mitigate their effects.
International cooperation: establishes a legal framework that enables international cooperation, facilitating the exchange of information and assistance between countries. It also brings Uruguay closer to joining the “Budapest Convention”, an international treaty designed to combat cybercrime.

For it to come into force, it remains for the Presidency to promulgate it and publish it in the Official Gazette (coming into force 10 days later).