Member Article

New Cybercrime Law is enacted by the Brazilian President and provides for a considerable increase in penalties for hacking into computer devices, theft and embezzlement perpetrated electronically or through the Internet.

In addition to providing more severe penalties for cybercrimes, Law No. 14,155 of May 28, 2021 establishes the victim's place of residence as the competent jurisdiction to prosecute cybercrime.

The new law does not create new crimes but rather increases the punishment for offenses already provided for in the Criminal Code, in response to the significant increase in internet fraud over the last year, involving more sophisticated and widespread schemes.

The main legislative changes are described below: 

Criminal act of hacking into a computer device 

According to the new wording of article 154-A of the Criminal Code, the action of hacking into someone's computer device, whether or not connected to the internet, in order to obtain, modify or destroy data or information without the user's authorization, or to install vulnerabilities on the device in order to obtain unlawful advantages, is now a crime punishable by imprisonment ranging from one (1) to four (4) years, plus fine. Previously, the imprisonment penalty for said conducts was considerably lower, ranging from three (3) months to one (1) year of detention. 

The wording of the offence has been modified to clarify that criminal law applies even if the victim is merely a lawful user but not the owner of the device, a recurrent condition during the home office period. 

If the hacking results in economic losses, the penalty is increased by 1/3 to 2/3 (previously, the increase ranged from 1/3 to half). 

If the hacking results in the acquisition of of private electronic communications, commercial or industrial secrets, confidential information, or allows for the unauthorized remote control of the hacked device, the penalty is even higher: confinement, from two (2) to five (5) years of impresionment plus fine (previously, it was from six (6) months to two (2) years and a fine). 

Aggravated theft 

Law No. 14,155/2021 added a new hypothesis of aggravated theft: while simple theft entails a penalty of imprisonment from one (1) to four (4) years and a fine, theft perpetrated by fraud perpetrated through electronic means, with or without the breach of security or the use of malicious software, or by any other similar fraudulent means, carries a penalty of imprisonment from four (4) to eight (8) years and a fine. 

Electronic fraud 

The crime of embezzlement, set forth in article 171 of the Criminal Code, entails a penalty that ranges from one (1) to five (5) years of imprisonment and a fine. The new law includes, in § 2-A, that if the fraud is committed with the use of information supplied by the victim or by a third party fraudulently induced by social networks, telephone contacts, electronic mail or similar means, the penalty of imprisonment is augmented, ranging from four (4) to eight (8) years and a fine. 

If such crimes are perpetrated with the use of a server located abroad, the penalties are increased by 1/3 to 2/3. Supposing that the crime targets the elderly or vulnerable victims, the penalties are increased by 1/3 to the double. 

Jurisdiction 

In the Brazilian system, as a rule, jurisdiction for processing a crime is set at the place where the crime was committed. 

Now, specifically in relation to the offence of fraud, Law No. 14,155/2021 departs from the general rule to provide that when the fraud is accomplished by means of deposit, overdraft or suspended checks, or by wire transfer, jurisdiction shall be given by the victim's place of residence. 

Click here to read the full text of Law No. 14,155/2021. 

Veirano's Criminal Law and Data Protection & Privacy teams are experienced in the matter and are available to clarify questions and provide advice on the subject.