The legal framework
Directive 2013/40/EU obliges member states to criminalise illegal access to an information system, illegal data interference and illegal interception, with harmonised minimum penalties and aggravating circumstances where the offence is committed within a criminal organisation or by misusing another person's identity. Creating a fake profile is a matter for national criminal law, which varies widely, and for data protection.
The Directive targets computer intrusion, not social imposture. A fake profile built from your photographs, without any account being hacked, falls outside it: national law and the GDPR apply.
The round-the-clock contact points required by the Directive serve cross-border investigations. For a victim the practical route remains a complaint at home, which triggers cooperation.
Key points
| Instrument | Directive 2013/40/EU of 12 August 2013 |
|---|---|
| Subject | Illegal access, data interference, illegal interception |
| Penalties | Harmonised minimum thresholds, aggravated where identity is misused |
| Fake profiles | Governed by national law and the GDPR |
| Cooperation | Round-the-clock national contact points |
| Removal | The Digital Services Act imposes notice and reasons |
In practice
- Check first what kind of instrument it is: a regulation applies directly, a directive must be transposed and leaves differences between states.
- Consult the consolidated version on EUR-Lex, which incorporates every amendment.
- Identify the national transposing statute: that is what a court will actually apply.
- Where the meaning is disputed, look for Court of Justice judgments on the point.
- For a cross-border dispute, check whether a national contact point or a European network can help.
Cost and coverage
Consulting Union law costs nothing: EUR-Lex publishes every text free of charge, in twenty-four official languages and in consolidated form. Any cost lies in legal advice, where the interaction between the European text and the national transposing statute becomes decisive — common with directives, rare with regulations.
Where to go
- EUR-Lex, the official portal of Union law, publishing every text in twenty-four languages
- The European e-Justice Portal, for cross-border procedures
- Your Europe, the Commission's information service for citizens
- SOLVIT, the network that resolves misapplication of Union law by an administration
- The European Consumer Centre in your country, for cross-border consumer disputes
Worth knowing
Do not confuse the European Union with the Council of Europe: the European Convention on Human Rights and the Strasbourg Court are not EU bodies and cover forty-six states, including Switzerland and the United Kingdom.
Frequently asked questions
Is identity theft a European offence?
Not as such. The Union harmonises illegal access to information systems; creating a fake profile is a matter of national law.
What if my account was hacked?
Report it in your own country: illegal access is an offence throughout the Union under the 2013 Directive.
And if someone uses my photos without hacking anything?
That is an interference with your personal data and, in some states, a criminal offence. Reporting to the platform is governed by the Digital Services Act.
Does police cooperation work?
The Directive requires contact points available at all times; in practice everything starts with the complaint filed at home.
Official sources and links
- UN Human Rights Office — ratified treaties and country reviews
- ILO NATLEX — national legislation database