necessary and appropriate to receive additional information or clarifications. All the information gathered was taken into consideration for the analysis. Beyond the issues identified in this report, there may be further challenges in transposition and other provisions not reported to the Commission or future legislative and non-legislative developments. Therefore, this report does not prevent the Commission from further evaluating some provisions and from continuing to support Member States in the transposition and implementation of the Directive. 2. Transposition measures 2.1 Legal definitions (Article 2 of the Directive) Article 2 of the Directive provides legal definitions for 'information system' (a)), 'computer data' (b)), 'legal person' (c)) and 'without right' (d)). Only CY and UK (Gibraltar) have introduced legislation covering all aspects of the definitions listed above. In detail, this means: a) Information system The Directive`s definition builds on the definition of the term ‘computer system’ as provided by Article (1)(a) of the Budapest Convention, adding computer data itself as part of the information system. CY, EL, IE, FI, HR, MT, PT and UK (Gibraltar) have introduced legislative provisions with the definition of an information system, while the information provided by DE, ES, FR, LU, LV, PL, SE and SK was not conclusive. For the remaining Member States, i.e. AT, BE, BG, CZ, EE, HU, IT, LT, NL, RO, SI and UK (except for Gibraltar), the respective legal definitions do not specifically mention ‘computer data’. This implies a reference to Article 1(a) of the Budapest Convention with an identical scope for the definition of a computer system. b) Computer data The term ‘computer data’ is provided by the legislation of AT, BG, CY, CZ, DE, EE, EL IE, FI, HR, LT, MT, NL, PT, RO and UK (Gibraltar), while the information provided by ES, FR, IT, LU, LV, PL, SE, SK and UK (except for Gibraltar) was not conclusive. However, in the case of SE, the specific set-up of the referring articles make this definition redundant. As for the remaining Member States, HU refers the definition of computer data only to offences described in Articles 4 and 5 of the Directive, while both BE and SI lack the inclusion of ‘a programme suitable for causing an information system to perform a function’ in the definition of computer data. c) Legal person Except for LU, which provided no conclusive information on the transposition of Article 2(c), the transposition of the definition of ‘legal person’ did not cause any problems. This is because, in general, it is already found in mostly civil law or commercial law provisions of the Member States. Only CY has a specific provision in the measures adopted to transpose the Directive. d) Without right As to the definition of the term ‘without right’ in Article 2(d), only CY, IE, RO and UK (Gibraltar) notified transposition, leaving 23 Member States without any transposition measures for this definition. However, it must be observed that in all Member States, there is the general principle of no criminal liability for whatever action if this action is carried out with according rights. 6