Article 319b of the Criminal Code – Unlawful Acts in Respect of Computer Data

Article 319b of the Criminal Code addresses one of the most dynamic forms of modern criminality — unlawful interference with computer data. The law penalizes any person who, without authorization, adds, copies, uses, degrades, conceals, destroys, deletes, damages, alters, or blocks access to information stored in a computer system.

This is often described as “digital vandalism”: it may appear virtual, but it frequently causes serious real-world consequences — loss of business information, disruption of commercial processes, collapse of governmental systems, and compromise of sensitive personal data.

Illustrative examples under Article 319b CC (unlawful interference with computer data):

• Deleting entries in an electronic time-tracking system — an employee with admin access modifies or deletes records to conceal lateness or absences.

• Manipulating electronic grades in a school system — a student or parent with hacking skills accesses the school platform and changes grades or attendance.

• Deleting a customer database — a dismissed employee accesses the system before their access is revoked and destroys client lists, commercial terms, and contracts.

• Installing spyware — a person with access installs software that secretly copies and exfiltrates sensitive information (passwords, photos, business correspondence).

• Altering records in accounting software — a person with credentials manipulates accounting entries to hide abuse or falsify financial results.

• Downloading and disseminating personal data from a medical system — unlawful access to an electronic health record and export of sensitive patient data (conditions, diagnoses, prescriptions).

• Altering results of a tender or competition on an e-platform — access is used to change submitted bids or results to favor a particular candidate.

• “Black-hat” security testing without authorization — a programmer intrudes into another’s network under the pretext of testing but alters data or leaves backdoors.

Penalties

The sanction depends on the circumstances. In its basic form, the law provides imprisonment of up to six years and a fine of up to BGN 10,000. If the act is repeated, committed in complicity, or causes significant damage, the sanction increases to up to seven years’ imprisonment and a fine of up to BGN 20,000. The most serious cases — e.g., acts on behalf of or pursuant to a decision of an organized criminal group, or attacks against government administration computer systems or critical infrastructure — are punishable by up to twelve years’ imprisonment and a fine of up to BGN 30,000.

Practice

Bulgarian case-law includes numerous instances. An illustrative case involved a young IT specialist who, after a dispute with his employer, encrypted the company’s server and demanded payment in exchange for the decryption key (ransomware). The case ended with an effective prison sentence, despite the damage later being compensated.

This offence highlights how vulnerable even well-protected systems can be when the human factor intervenes with bad faith. Article 319b is therefore crucial in contemporary digital justice: it protects not merely “computers,” but the economic, institutional, and personal stability that depends on them.

If you or a relative has been a victim of a computer crime, consult a criminal-law attorney who can advise and represent you in court. This article does not constitute legal advice by Attorney Mihail Tomov and is not related to any specific situation or subject. For legal assistance in matters involving computer crimes, or any criminal-law case, you should obtain a dedicated legal consultation.