Criminal law reflections on the information security law

Abstract

In everyday discourse, we often equate “modern” with “informational”. The great and undeniable benefits of modern technologies carry with them various concerns and risks. Thus, the facilitated payment of bills to obtain discounts or the inspection of the title deed to verify a contract can be threatened by attacks on information and communication systems (ICT). Such activities affect the average citizen. However, more serious attacks, such as those targeting critical systems, can disrupt the functioning of the entire country. Risk management in information security is one of the fundamental principles of the new Law on Information Security (ZIB) adopted in 2025. However, even with the best risk assessments and preventive measures, some consequences may exceed the scope of this law and fall within the purview of criminal law. Several provisions of the ZIB refer to incidents that threaten information and communication systems to such an extent that they constitute the characteristics of certain criminal offenses. According to the "letter of the law", all criminal offenses come into consideration. Still, the analysis of potential unlawful actions will identify criminal offenses that warrant special attention. The emphasis will be on criminal offenses related to the security of computer data, commercial and industrial activities, the environment, and the general safety of people and property. Given the prescribed obligation to report incidents by ICT operators, and in particular the one relating to the "assessment of whether the incident is a consequence of a criminal offense", we will highlight the importance of understanding and providing this assessment to support further action by the competent authorities. Therefore, it is important to present the limits of criminal law protection, and to consider the actual scope of the applicable regulations and their compliance with the basic criminal law principles.