Section 4 of the Cybercrime Code Act 2016 states the principle against retrospective criminal law in two subsections.
Section 4 — effect of changes in law
(1) A person cannot be punished for doing or omitting to do an act unless the act or omission constituted an offence under this Act in force when the offence occurred.
(2) This Act does not have retrospective effect on past commissions or omissions of acts that constituted an offence under this Act.
The principle is already constitutional. Section 37 of the Constitution guarantees the protection of the law, and includes the rule that a person may not be convicted of an offence that was not an offence at the time of the act or omission.
Restating it in section 4 does two things. It puts the rule in front of anyone reading this Act rather than requiring them to go to the Constitution. And it makes clear that the Act — passed in 2016, criminalising a great deal of conduct that had not previously been an offence — does not reach backwards.
What section 4 means in practice
A person who did, before the Act commenced, something that the Act now makes an offence cannot be charged under this Act for it. Hacking, posting defamatory material online, sending spam — if done before commencement, none of them can found a charge under the Cybercrime Code Act.
That does not mean such conduct was necessarily lawful. Under section 3(2) this Act is in addition to the Criminal Code Act (Chapter 262) and other criminal law. Conduct that was an offence under the Code, or under another Act, at the time remains prosecutable under that law.
| When the conduct occurred | Can it be charged under this Act? |
|---|---|
| Wholly before commencement | No — s 4(1) and (2) |
| Wholly after commencement | Yes |
| Continuing conduct spanning commencement — for example remaining logged in without authorisation | Yes, as to the part occurring after commencement. The elements must all be satisfied by conduct occurring while the Act was in force |
| Material posted before but still available after commencement | Depends on the offence. Where the offence is constituted by the act of publication, the act occurred before. Where it is constituted by possession — and note that “possession” in section 2 includes having under control in or on any website — possession may continue |
Offences where timing needs care
- Section 11 — illegally remaining. The offence is committed by continuing to use a system after authorisation expires. It is inherently continuing, and the relevant conduct is the continuation.
- Sections 22 and 23 — cyber bullying and harassment. Both refer to supporting such repeated acts, and both contemplate a course of conduct. Only conduct after commencement can be relied on.
- Sections 28 to 30 — intellectual property. Each requires infringement knowingly and repeatedly, or knowingly or repeatedly. Repetition after commencement is what counts.
- Section 18 — child pornography. Because possession extends to material under a person’s control on a website, continued control after commencement is capable of being current conduct.
- Section 21 — defamatory publication. The offence is committed by publishing, defined in section 21(1) as using an electronic system or device to make publicly available defamatory material. A fresh act of making available after commencement is a fresh publication.
Where conduct straddles the commencement date, the prosecution must be able to prove every element of the offence from conduct occurring after the Act came into force. Section 4(1) is expressed in those terms: the act or omission must have constituted an offence under this Act in force when the offence occurred.
Amendments to the Act itself
The heading is “Effect of changes in law”, not “commencement”. The principle applies to any future amendment: conduct is judged against the Act in force when the conduct occurred.
So if a new offence is added, it does not reach earlier conduct. And note the corollary in subsection (1): the question is whether the act constituted an offence under this Act in force at the time — which fixes both liability and, by implication, the offence definition against which conduct is measured.
Where a penalty is increased, the constitutional protection in section 37 of the Constitution against a heavier penalty than was applicable at the time of the offence continues to operate, and section 4 should be read consistently with it.
Section 4 in the scheme of the Act
Section 4 sits in Part II with two other jurisdictional provisions: section 3, which imports the Criminal Code’s procedure, jurisdiction and punishment rules and gives this Act priority on inconsistency; and section 5, which sets the age of criminal culpability.
Together the three answer the questions that arise before any offence is considered: what other law applies, when the Act applies, and to whom it applies.
Note also section 1, which declares the Act to restrict six qualified constitutional rights in the public interest. Section 4 is part of what makes that declaration defensible: an Act that limits expression, privacy and movement at least does so prospectively, so that people can know in advance what is prohibited.
Sources
- Cybercrime Code Act 2016 — ss 1–5, 11, 18, 21–23, 28–30
- Criminal Code Act (Chapter 262)
Before relying on anything here, read the current text of the Cybercrime Code Act 2016 and check for later amendments. If a decision matters to you, get advice — start with the Office of the Public Solicitor, or find a firm in the law firms directory.