Section 40 of the Cybercrime Code Act 2016 deals with the metadata of communications rather than their content.
Section 40
Where, on application by a member of the Police Force or the Public Prosecutor, the Court is satisfied upon sworn evidence that traffic data associated with a specified communication is reasonably required for the purposes of an investigation or proceeding, the Court may order a person in control of such data to —
(a) collect or record traffic data associated with a specified communication during a specified period; or
(b) enable and assist a member of the Police Force to collect or record that data.
A forward-looking power
Most of Part IV deals with data that already exists. Section 40 is different: paragraph (a) requires traffic data to be collected or recorded during a specified period.
That is prospective. It requires the person in control to capture data as it is generated, for as long as the order runs.
The section states no maximum period. Compare section 36, capped at 14 days plus one 14-day extension, and section 41(7), capped at six months. Section 40 leaves the duration entirely to the Court.
What traffic data reveals
Section 2 defines traffic data: in substance, the data generated by a communication system about a communication, as distinct from what it said.
Typically that includes the origin and destination, the route, the time and date, the duration, the volume, the service used, and the network equipment involved.
Traffic data does not carry the words of a message. But over a period it establishes a great deal: who a person communicates with, how often, at what hours, from which locations, and how those patterns change. It is often more revealing of associations than content is.
That is the reason section 40 sits in Division 3 with interception and forensic tools, and carries the same sworn evidence requirement, rather than in Division 2 with production and preservation.
Sections 37, 39 and 40
| s 37 partial disclosure | s 40 traffic data | s 39 interception | |
|---|---|---|---|
| Subject | Traffic data | Traffic data | Data or communication — including content |
| Time frame | Existing | Prospective — during a specified period | Prospective |
| Purpose limit | Only to identify providers and path | None stated beyond the specified communication | Specified communications |
| Sworn evidence | No | Yes | Yes |
| “May” or “shall” | May | May | Shall |
Section 40 says the Court “may” order. Section 39 says it “shall”.
So even where satisfied that the traffic data is reasonably required, a court may decline to make an order under section 40, or may confine it — as to duration, as to the communications covered, or as to what is to be recorded.
“A person in control of such data”
Section 40 is directed at a person in control of such data — not, as in section 39(a), at an ICT service provider.
That reaches a telecommunications operator or internet provider in the ordinary case, but also an employer running a corporate network, a university operating a campus system, or any organisation whose equipment generates traffic data about the communication in question.
For an organisation in that position the order creates a real burden — capturing data it may not ordinarily retain, for a period fixed by the Court. Section 40 provides no compensation for the cost of compliance, and no exemption for small operators.
Where the recipient is an ICT service provider, section 44(1)(d) makes failure to comply with a court order a crime carrying 25 years. For anyone else, breach is contempt of court.
If you receive a section 40 order
- Identify precisely what is specified. The order attaches to traffic data associated with a specified communication.
- Do not collect content. Section 40 authorises traffic data only. Collecting content without a section 39 order is capable of engaging section 7.
- Note the period. The obligation ends when the specified period ends.
- Protect what you collect. Data gathered under the order is sensitive; unauthorised disclosure may engage section 25.
- Check for a confidentiality direction. Section 45 makes disclosure of the order a crime for a provider.
- Take advice on scope or cost. A person affected may ask the Court to confine the order.
See also privacy protections in PNG cybercrime law.
Sources
- Cybercrime Code Act 2016 — ss 2, 7, 25, 36, 37, 39, 40, 41, 44, 45
- Constitution — s 49
Before relying on anything here, read the current text of the Cybercrime Code Act 2016 and check for later amendments. If a decision matters to you, get advice — start with the Office of the Public Solicitor, or find a firm in the law firms directory.