Section 39 of the Cybercrime Code Act 2016 opens Division 3 — Powers of Investigation. It is the lawful counterpart of the offence in section 7.
Section 39
Where, on application by a member of the Police Force or the Public Prosecutor, the Court is satisfied upon sworn evidence that there are sufficient grounds to suspect that data or communication is reasonably required for the purposes of an investigation or proceeding, the Court shall —
(a) order an ICT Service Provider whose service is available in the country to collect or record through application of technical or other means, to permit or assist a member of the Police Force with the collection or recording of data or communication associated with specified communications transmitted by means of an electronic system or device; or
(b) authorise a member of the Police Force to collect or record that data through application of technical or other means.
Four safeguards
| Safeguard | Effect |
|---|---|
| Court order required | No police-issued interception. Compare the s 36 notice, which police may issue themselves |
| Sworn evidence | The grounds must be on oath — shared with s 40 and s 41, but not with ss 35, 37 or 38 |
| Sufficient grounds to suspect | The Court must be satisfied, not merely informed |
| “Specified communications” | The order must identify what is to be collected — it is not a general warrant |
Section 39 says that where the Court is satisfied, it “shall” make an order under (a) or (b) — where section 40 and section 38 say “may”.
Read literally, that removes the Court’s residual discretion once satisfaction is reached, leaving only the choice between paragraph (a) and paragraph (b).
The discretion that remains is in the antecedent question — whether the Court is satisfied upon sworn evidence that there are sufficient grounds. That is where the protection lies, and it is a real one.
Provider-assisted or police-conducted
The order is directed to an ICT service provider whose service is available in the country. The provider collects or records, or permits or assists police to do so.
The territorial words matter. The provider need not be incorporated or based in Papua New Guinea; it is enough that its service is available in the country. That reaches offshore platforms and messaging services used domestically — though enforcing an order against an entity with no local presence raises practical questions that Part VI is intended to address.
For a provider, non-compliance is serious: section 44(1)(d) makes failure to comply with a court order requiring assistance a crime carrying 25 years, or K1,000,000 for a body corporate.
Alternatively the Court may authorise a member of the Police Force to collect or record the data through application of technical or other means.
Where that requires software or hardware to be installed on a suspect’s system, section 41 applies with its own, stricter, requirements — including a six-month maximum duration, a record-keeping obligation, and a power of revocation.
The line between section 39 and section 7
Section 7 makes illegal interception a crime carrying 15 years, rising to 25 where state or sensitive data is involved. Its opening words are “without lawful excuse or justification, or in excess of a lawful excuse or justification”.
A section 39 order is the lawful excuse. Interception within its terms is lawful; interception beyond its terms is in excess of a lawful excuse, and squarely within section 7.
That applies to police and to providers alike. A provider that collects more than the order specifies, or that continues after it expires, is not protected by it.
The privacy dimension
Section 1(2) acknowledges that the Act restricts the right to privacy under section 49 of the Constitution, and section 49 protects the privacy of communications in terms. Interception is the most direct interference with it that the Act permits.
The Act contains no notification requirement — a person whose communications were intercepted is not told, either at the time or afterwards. Nor is there any independent oversight mechanism. The protection is the court order itself, and the discipline of the sworn evidence supporting it. See privacy protections in PNG cybercrime law.
Note too section 45: where an order stipulates confidentiality, a provider that discloses its existence commits a crime carrying 25 years.
Sources
- Cybercrime Code Act 2016 — ss 1, 2, 7, 35–41, 44, 45, 46, 47
- Constitution — ss 38, 49
Before relying on anything here, read the current text of the Cybercrime Code Act 2016 and check for later amendments. If a decision matters to you, get advice — start with the Office of the Public Solicitor, or find a firm in the law firms directory.