Section 38 of the Cybercrime Code Act 2016 closes Division 2 — Preservation of Evidence.
Section 38
Where the Court, on application by a member of the Police Force or the Public Prosecutor, is satisfied that there are sufficient grounds to believe that an electronic system or device, data or thing reasonably required for the purposes of an investigation or proceeding is likely to be removed, destroyed, deleted or otherwise tampered with or dealt with,
it may make an order restraining or preventing such removal, destruction, deletion, tampering or dealing.
“Sufficient grounds to believe”
Compare the tests across Division 2:
- Section 35 — data is “reasonably required”;
- Section 36 — “reasonable grounds to suspect”;
- Section 37 — the Court is “satisfied” that data is required;
- Section 38 — “sufficient grounds to believe”.
Belief is a higher state than suspicion. Section 38 requires the Court to be satisfied that the material is likely to be removed, destroyed, deleted, tampered with or dealt with — not merely that it might be.
The higher threshold matches the greater burden: a restraining order can freeze a working system indefinitely, where a preservation notice merely requires specified data to be kept for 14 days.
Section 38 compared with section 36
| s 36 preservation notice | s 38 restraining order | |
|---|---|---|
| Who makes it | A member of the Police Force, by written notice | The Court, on application |
| Threshold | Reasonable grounds to suspect | Sufficient grounds to believe |
| Covers | Data specified in the notice | An electronic system or device, data or thing |
| Duration | 14 days, extendable once | No period stated in the section |
| Non-compliance | Offence under s 36(4) — 12 months, K10,000 | Contempt of court; for a provider, s 44(1)(d) — 25 years |
Reach. Section 38 covers the system or device itself, not just data. It can restrain dealings with a server, a phone or a storage array.
Duration. Section 38 states no maximum period, in contrast with the express 14-day limits in section 36. The duration is a matter for the Court, and a person affected may apply to vary or discharge the order.
Sanction. Breach of a court order is contempt, which carries no statutory ceiling. Section 36(4) caps the penalty for ignoring a preservation notice at 12 months.
“Otherwise tampered with or dealt with”
The section names four specific acts — removal, destruction, deletion, tampering — and then adds “or dealt with”.
On its ordinary meaning, dealing with property includes selling it, transferring it, encrypting it, moving it to another jurisdiction, or wiping and reissuing it. An order in those terms can therefore prevent a business disposing of equipment, or a person transferring an account, while an investigation runs.
Because the section states no limit on duration and no procedure for review, the terms of the order matter greatly. A person affected should seek an order that is specific as to what is restrained, and that provides for review or expiry.
Where a business is affected
An order restraining dealing with a production system could halt a business. Two things reduce that risk:
- The order is the Court’s. A person affected may appear and ask that it be confined — for example, to a forensic image rather than the live system, or to specified accounts rather than the whole environment.
- Copying is often sufficient. Where a forensic image is taken, the evidentiary purpose is served and the original may be released. Section 33(c) and (d) contemplate copying as the ordinary course.
An organisation served with a section 38 order should take legal advice the same day, comply in the meantime, and record everything done.
For victims and rights owners
Section 38 is often the most useful order for a complainant. Where material is being circulated — intimate images under section 24(2), infringing copies under section 28, defamatory material under section 21 — a restraining order can be sought as part of the investigation, alongside a preservation notice and a production order.
Note that the application must be made by a member of the Police Force or the Public Prosecutor, so a complainant works through the investigating officer. See what to do if you are a victim of cybercrime.
Sources
- Cybercrime Code Act 2016 — ss 2, 21, 24, 28, 33, 35–38, 44
- Constitution — ss 37, 49
Before relying on anything here, read the current text of the Cybercrime Code Act 2016 and check for later amendments. If a decision matters to you, get advice — start with the Office of the Public Solicitor, or find a firm in the law firms directory.