Background

Jordan's new Cybercrime Law No. 17 of 2023 (Cybercrime Law) was recently issued in the Official Gazette on 13 August 2023 and came into effect on 13 September 2023, repealing and replacing Jordan's old 2015 cybercrime law. The Cybercrime Law consists of 41 articles as opposed to the old law's 15 articles and implements additional measures to combat online-related crimes.

Overview

As the public and private sector's reliance on technology continues to increase, and after extensive consultation with concerned parties and experts, the Jordanian government issued a new Cybercrime Law in an effort to remain in line with continued technological developments and the legal issues connected therewith.

The Cybercrime Law criminalises various activities, including but not limited to:

• gaining unauthorised access to information networks, software, accounts and websites;
• creating fake accounts, websites or applications and falsely attributing them to legal or natural persons;
• spreading misinformation and hate speech through networks, websites or social media platforms;
• creating phishing schemes for illegally obtaining financial, banking and electronic banking information;
• creating, managing or supervising a website, publishing information online, or managing an electronic wallet calling for or promoting the collection of donations or charity without a licence from the relevant authorities or in a manner that violates or exceeds the licence;
• promoting a competition, creating, managing or supervising a website, publishing information online, or managing an electronic wallet with the aim of receiving or collecting money from the public with the intention of investing or managing the money without a licence from the competent authorities;
• creating, distributing, promoting, downloading, selling or purchasing pornographic material or services (taking into consideration the age and mental disabilities (if any) of those involved in the pornographic material);
• promoting or inciting prostitution and immoral sexual behaviour;
• creating, managing or supervising a website or social media platform, or publishing information on an information network or by any means of information technology, promoting, trading or sharing information on how to manufacture weapons, ammunition or explosives; and
• possessing, producing, distributing, importing, exporting or promoting, without permission, a device, program, any prepared electronic data, password or access codes for the purposes of committing any of the crimes stipulated in the Cybercrime Law.

Article (12) of the Cybercrime Law introduces restrictions on online anonymity and criminalises engaging in actions circumventing IP addresses by using a fictitious address or an address belonging to a third party, or by any other means, with the intent of committing a crime or preventing its discovery.

Article (25)(a) of the Cybercrime Law provides that those responsible for the actual management of the website or social media platform, or responsible for any account, public page, group, channel or similar platform, are responsible for the illegal content published thereon, and are liable for the actions committed in violation of the provisions of the Cybercrime Law.

Article (27) provides that anyone who intentionally participates in or incites committing any of the crimes stipulated in the Cybercrime Law will be treated the same as the perpetrators of such crimes.

It is important to note that Article 37(a) of the Cybercrime Law requires any social media platform, outside Jordan, with more than 100,000 subscribers in Jordan, to establish an office inside Jordan, in order to deal with any requests and notices issued by the competent Jordanian judicial and official authorities. Platforms that fail to abide by this requirement, despite notification from the Telecommunications Regulatory Commission, will incur a ban on their advertisements for 60 days, and later a reduction in the bandwidth of internet traffic by 25%, 50% or 75% on those platforms for a period of 60 days for continued failure to comply.

Finally, in determining the appropriate recourse, the Cybercrime Law takes into account the identity of the perpetrator(s), the intention behind the offence, the nature of information obtained or shared (if any) and the potential impact it will have, and the nature and identity of the affected party(ies).