The Cybercrime Code Act 2016 is a short Act — 50 sections and two Schedules — that reaches a very long way.
How the Act is built
| Part | Sections | What it does |
|---|---|---|
| I — Preliminary | 1–2 | The constitutional declaration, and the definitions |
| II — Jurisdiction | 3–5 | Application of the Criminal Code, effect of changes in law, age of criminal culpability |
| III — Offences and penalties | 6–31 | Four Divisions: integrity of data and systems (ss 6–11); computer related offences (ss 12–16); content related offences (ss 17–26); other offences (ss 27–31) |
| IV — Procedure | 32–43 | Search and seizure, preservation of evidence, powers of investigation, evidence and admissibility |
| V — ICT service providers | 44–45 | Criminal liability and confidentiality of investigations |
| VI — International co-operation | 46–47 | Mutual assistance and extradition |
| VII — Miscellaneous | 48–50 | Indictable offences triable summarily, rules and regulations |
| Schedule 1 | — | Description of ICT service providers |
| Schedule 2 | — | The twelve indictable offences a District Court may try summarily |
The 26 offences
s 6 unauthorised access or hacking; s 7 illegal interception; s 8 data interference; s 9 system interference; s 10 data espionage; s 11 illegally remaining.
s 12 electronic fraud; s 13 electronic forgery; s 14 electronic gambling or lottery by a child; s 15 identity theft; s 16 illegal devices.
s 17 pornography; s 18 child pornography; s 19 child online grooming; s 20 animal pornography; s 21 defamatory publication; s 22 cyber bullying; s 23 cyber harassment; s 24 cyber extortion; s 25 unlawful disclosure; s 26 spam.
s 27 cyber attack; s 28 online copyright infringement; s 29 online trademark infringement; s 30 patent and industrial designs infringement; s 31 unlawful advertising.
The pattern every offence follows
“Intentionally and without lawful excuse or justification, or in excess of a lawful excuse or justification” — and in many sections, “or recklessly”. This formula opens almost every offence, and is examined in its own article. Note the third limb: acting in excess of a lawful excuse is as culpable as having none.
“Uses an electronic system or device” — the connecting element in the content and other offences. The offence is committed by using technology to do something that is already, or is here made, wrongful.
Penalties split between a natural person and a body corporate — the corporate fine is typically four to ten times the individual fine, rising to K1,000,000 for the most serious offences. See corporate liability.
And several offences add a distinctive penalty: prohibition from accessing and using ICTs or electronic systems or devices for the term of imprisonment plus two years.
Section 3 — the relationship with the Criminal Code
(1) Unless stated to the contrary, the provisions of the Criminal Code Act (Chapter 262) relating to (a) criminal practice and procedure; (b) jurisdiction, including sections 12, 13 and 14; and (c) punishments, including sections 18 and 19, apply to this Act.
(2) The provisions of this Act are in addition to and not in derogation of the Criminal Code or any other criminal law, and where there are any inconsistencies, the provisions of this Act shall apply.
So the Cybercrime Code Act does not stand alone. It borrows the Criminal Code’s machinery for procedure, jurisdiction and punishment — and, on the point of inconsistency, overrides it.
Who needs to know about it
- Anyone who uses social media. Section 21, section 22 and section 23 reach ordinary posting, commenting and messaging — and section 23(4) reaches profanity, obscenity and vulgar language in a post whether or not directed at anyone in particular.
- Businesses. Corporate fines run to K1,000,000, and a company can be liable through its employees. See business obligations.
- ICT service providers. Part V creates offences carrying up to 25 years or K1,000,000 — including for monitoring users without lawful excuse.
- Anyone holding data. Part IV allows police to search, seize devices, require assistance, obtain production and preservation orders, intercept communications and install remote forensic tools.
- Parents and schools. The Act contains extensive child protection provisions — and children themselves can be offenders from the age of 10.
Sources
- Cybercrime Code Act 2016 — ss 1–50; Schedules 1 and 2
- Criminal Code Act (Chapter 262)
Before relying on anything here, read the current text of the Cybercrime Code Act 2016 and check for later amendments. If a decision matters to you, get advice — start with the Office of the Public Solicitor, or find a firm in the law firms directory.