Article 264 Spanish Criminal Code: Damage to Computer Data and Systems

Article 264 of the Spanish Criminal Code punishes the unauthorised deletion, damage, deterioration, alteration, suppression or rendering inaccessible of another person’s computer data, programs or electronic documents, where both the conduct and the result are serious. It is the provision under which ransomware, the sabotage of a former employer’s systems and the destruction of company records are prosecuted, and it carries two to five years where the damage is of special gravity, affects a large number of systems or affects critical infrastructure. The requirement that both the conduct and the result be serious is what confines it, and it is where the defence begins.

Wording of Article 264 of the Spanish Criminal Code

Elements of the offence

1. Computer data, programs or electronic documents belonging to another. Data belonging to the accused, or data held with the owner’s authority, are outside the article.
2. Absence of authorisation. An employee acting within the scope of his access rights, however unwisely, does not act without authorisation, although exceeding those rights is a different matter.
3. Seriousness of the conduct and seriousness of the result. Both are required, and each must be established by evidence of the actual effect on the system.
4. Intent. Accidental deletion, the loss of data through a defective backup and the consequences of a legitimate technical operation are not this offence.

Defence strategy

Authorisation and the scope of access. In the great majority of cases the accused is a former employee, a partner or an external provider who held credentials. The question is not whether he had access but whether the specific act was authorised. The defence produces the contract, the internal policies, the access log and the evidence of what the accused was expected to do, since deletion of files the accused was responsible for, or the removal of his own work product, is frequently within his authority.

The seriousness of conduct and of result. The article requires both. Where the data were recoverable from backups, where the interruption lasted hours, or where the loss is asserted without a technical report, the threshold is not met and the matter is contractual. The defence commissions an independent examination of the system and of the backup regime, because the complainant’s valuation habitually includes the cost of improvements made afterwards rather than the loss caused.

Attribution to the accused. Attribution rests on logs, network addresses and device evidence. The defence tests whether the credentials were shared, whether the address was dynamic or belonged to a shared network, whether the timestamps are consistent across systems, and whether the material was obtained with the judicial authorisation required for access to traffic data. Where the log evidence has been collected by the complainant itself, its integrity and chain of custody are examined.

Excluding the aggravated circumstances. The circumstances in the second paragraph raise the sentence beyond the threshold for suspension. Damage of special gravity, a large number of systems and critical infrastructure are pleaded far more readily than they are proved: the definition of critical infrastructure in the article is demanding, and a company system is not one merely because the company is large. Each circumstance is contested with the technical evidence rather than accepted as a characterisation.

• Article 263: criminal damage
• Cybercrime and online fraud
• Article 588 ter a: interception of communications
• Spanish-language entry

This entry is provided for information only and does not constitute legal advice. The application of any provision depends on the circumstances of the individual case and requires examination of the case file by a qualified lawyer.