Section 45 of the Cybercrime Code Act 2016 is the second and final provision of Part V.
Section 45
An ICT Service Provider who is in receipt or has knowledge of a Court Order relating to an investigation or proceeding which explicitly stipulates that confidentiality is to be maintained, or such obligation is required by law, intentionally and without lawful excuse or justification or in excess of a lawful excuse or justification, or recklessly discloses —
(a) the fact that an order has been made; or
(b) anything done or required to be done under the order; or
(c) any data collected or recorded pursuant to that order,
is guilty of a crime.
Penalty: natural person — a fine up to K100,000 or imprisonment up to 25 years, or both; body corporate — a fine up to K500,000.
When the obligation arises
| Condition | Detail |
|---|---|
| An ICT service provider | Within Schedule 1 — including a website master or administrator |
| Receipt or knowledge | Either is enough. A provider that learns of an order without receiving it is bound |
| A court order | Relating to an investigation or proceeding |
| Confidentiality | Explicitly stipulated in the order, or required by law |
| Mental element | Intentionally or recklessly, without lawful excuse or in excess of one |
Unlike section 44(1)(a) and (b), which require intention or knowledge, section 45 includes “or recklessly”.
A provider that discloses carelessly — an internal email forwarded, a note in a customer service record, an oblique warning to an account holder — can commit the offence without intending to defeat the investigation.
Note also that the obligation attaches on knowledge, not only on receipt. Staff who learn of an order through internal channels are within the section.
Three separate prohibitions
The existence of the order is itself confidential. A provider may not say that an order has been made, and may not confirm it if asked.
This forecloses indirect disclosure: telling a customer that their account is subject to a legal process, or that the provider cannot discuss a matter, may communicate the fact of the order.
Anything done or required to be done is confidential. A provider may not disclose what data it produced, what it was asked for, what it collected, or what steps it took.
Data collected or recorded pursuant to the order may not be disclosed. That protects the material gathered under section 39, section 40 or section 41, which may be highly sensitive.
Where it conflicts with a duty to the customer
A provider ordinarily owes contractual and general law duties of confidence to its customer, and many services promise to notify users of legal demands.
Where a court order stipulates confidentiality, section 45 makes performance of that promise a crime carrying 25 years. Compliance with the order is the lawful course, and a contractual promise to notify cannot be a lawful excuse for breaching a confidentiality stipulation made by a court.
A provider drafting terms of service should therefore qualify any notification commitment by reference to legal restrictions on disclosure.
Two limits worth noting
Section 45 applies where the order explicitly stipulates confidentiality, or where the obligation is required by law. An order that says nothing about confidentiality, and attracts no statutory obligation, does not engage the section.
A provider receiving an order should therefore read it for a confidentiality direction, and where the position is unclear, ask — and take advice before disclosing anything.
Nothing in section 45 prevents a provider from taking legal advice about the order, or from applying to the Court to vary or discharge it. Communications with its own lawyers for the purpose of obtaining advice are not the mischief the section addresses, and are made with lawful justification.
Practical steps
- Route orders to a single point. Limiting who knows reduces the risk of inadvertent or reckless disclosure.
- Flag confidentiality on receipt. Record on the file whether the order stipulates it.
- Suppress automatic notifications. Systems that alert a user when their account is accessed or exported can themselves disclose the order.
- Train the people who talk to customers. The recklessness limb catches a careless answer at a service desk.
- Draft terms of service accordingly. Qualify any promise to notify users of legal process.
- Remember section 44(1)(e). Negligently allowing an employee to commit a section 44 offence is itself a crime — and prudent providers apply the same discipline to section 45.
Sources
- Cybercrime Code Act 2016 — ss 2, 35–41, 44, 45; Schedule 1
- Constitution — s 49
Before relying on anything here, read the current text of the Cybercrime Code Act 2016 and check for later amendments. If a decision matters to you, get advice — start with the Office of the Public Solicitor, or find a firm in the law firms directory.