15.2 Basic Cybercrime, Privacy, and Copyright Laws
Three Pillars, Three Different Targets
Cybercrime law criminalizes conduct against systems: the US Computer Fraud and Abuse Act punishes unauthorized access and exceeding authorized access, while the Budapest Convention is the coordinating treaty that lets member states share evidence and extradite. Privacy law regulates the processing of personal data rather than the intrusion itself: the EU GDPR requires a legal basis, data minimization, and breach reporting; the California Consumer Privacy Act and its amendment (CPRA) give residents rights to know, delete, and opt out. Copyright law protects works including code: the WIPO Copyright Treaties set the international baseline, and the US DMCA adds notice-and-takedown for hosting providers plus anti-circumvention rules against defeating access controls such as DRM.
Jurisdiction Follows the Data, Not the Server
The GDPR's territorial mechanism is targeting and monitoring: if you offer goods to or observe people in the EU, the rules attach regardless of where your servers sit. US state breach-notification laws and the sector-specific HIPAA rules for health data attach by data type and resident status. One SaaS stack therefore often sits under several regimes at once, and the practical compliance posture is to implement the strictest common denominator -- usually minimization, documented processing records, and a rehearsed notification procedure.
Clocks and Takedowns Are the Real Mechanisms
Abstract obligations change little; deadlines change behavior. GDPR Article 33 requires notifying the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach, with Article 34 adding people-notification when risk to them is high; fines can reach 4% of global annual turnover. DMCA takedowns run on counter-notice timers measured in business days. Software licensing compliance -- for example GPL copyleft source-disclosure duties or commercial audit clauses -- is copyright at the organizational level, caught by license scanning rather than legislation.
Reading a Regime in Five Questions
When a new law lands, ask: whose data or systems does it cover; what trigger event starts a clock; who must be told, in what channel; what records must exist before the incident; and what is the penalty ceiling. Those five answers map almost any regime onto concrete engineering work: logging retention, contact lists, template notices, and a decision tree that survives a bad night.
Architecture Diagram
Key Takeaways
- Cybercrime law (CFAA, Budapest Convention) punishes intrusions; privacy law (GDPR, CCPA/CPRA) regulates data processing; copyright (DMCA, WIPO treaties) protects works and controls.
- Jurisdiction attaches by targeting, data type, and resident status -- not by where your servers sit.
- GDPR Article 33's 72-hour authority-notification clock is the archetype: deadlines, not principles, change behavior.
- Multi-regime stacks should implement the strictest common denominator: minimization, records, rehearsed notices.
- Read any new regime through five questions: scope, trigger, notice channel, required records, penalty ceiling.