Part VII of the Cybercrime Code Act 2016 contains three sections: section 48 on summary trial, and sections 49 and 50 on subordinate legislation.
Section 49 — rules
Rules of any form of subordinate enactment necessary for the regulating of practice and procedure during an investigation or before a Court may be made prescribing all matters that are necessary or convenient to be prescribed for carrying out and giving effect to this Act, and in particular, for prescribing rules in relation to the provisions under Part IV.
The closing words single out Part IV — the search, preservation, investigation and evidence provisions.
That emphasis is understandable. Part IV creates powers of considerable reach but says little about how they are to be exercised: the form of a warrant or notice, the handling of seized devices, the storage and destruction of forensic material, the standards for imaging, and the records to be kept are all left open.
Note that section 49 does not name a rule-making authority. It says rules “may be made” without saying by whom, in contrast with section 50, which names the Head of State acting on advice.
Section 50 — regulations
The Head of State, acting on advice, may make regulations, not inconsistent with this Act, prescribing all matters that by this Act are required or permitted to be prescribed, or that are necessary or convenient to be prescribed for carrying out or giving effect to this Act.
| s 49 — rules | s 50 — regulations | |
|---|---|---|
| Made by | Not specified | Head of State, acting on advice |
| Subject matter | Practice and procedure in investigations and before a court | Anything necessary or convenient for giving effect to the Act |
| Particular focus | Part IV | Matters the Act requires or permits to be prescribed |
| Express limit | — | Not inconsistent with the Act |
The gaps these powers could fill
Reading Part IV and the penalty provisions together, several matters are left without machinery:
- ICT prohibition orders. The Act provides no procedure for making them partial, monitoring compliance, dealing with breach, or applying to vary or discharge.
- Return of seized property. Section 32(4) provides for detention and destruction but not return.
- Forms. No prescribed form for a preservation notice, though section 36(1) requires it to be in writing and to specify the data.
- Forensic standards. Section 41(5) requires a record of the technical means used and any modifications, but prescribes no standard for imaging or handling.
- Destruction of material obtained under section 41 where no charge follows.
- A point of contact for international requests.
- Provider procedures — how orders under section 35 and section 39 are to be served, acknowledged and answered.
Each is a matter of practice and procedure within section 49, or necessary or convenient within section 50.
What subordinate legislation cannot do
1. Not inconsistent with the Act. Section 50 says so expressly, and the same principle applies to rules under section 49. Regulations cannot enlarge an offence, raise a penalty, or extend a power beyond what the Act confers.
2. Not a substitute for amendment. The interpretive difficulties in the Act — the breadth of “otherwise unacceptable” in section 23(4), the absence of defences in section 31, the reach of the hyperlink provider category — are questions of construction for the courts, or matters for Parliament. Regulations cannot resolve them.
3. Subject to the Constitution. Subordinate legislation that restricted a qualified right beyond what the Act itself authorises would face the requirements of section 38 of the Constitution, which the Act addresses in section 1(2).
Until rules are made
Where no rules or regulations exist, the position is governed by the Act itself, by section 3(1) — which applies the Criminal Code Act (Chapter 262) provisions on criminal practice and procedure, jurisdiction and punishments — and by the general law, including the Search Act (Chapter 341) and the Evidence Act (Chapter 48), both of which Part IV expressly preserves.
The Search Act (Chapter 341) and the Evidence Act (Chapter 48) are not currently available on PacLII, so no links are given here.
Practitioners should check whether rules or regulations have been made before relying on the Act alone, particularly on questions of procedure under Part IV.
Sources
- Cybercrime Code Act 2016 — ss 1, 3, 32–43, 48, 49, 50
- Constitution — s 38; Criminal Code Act (Chapter 262)
- Search Act (Chapter 341); Evidence Act (Chapter 48)
Before relying on anything here, read the current text of the Cybercrime Code Act 2016 and check for later amendments. If a decision matters to you, get advice — start with the Office of the Public Solicitor, or find a firm in the law firms directory.