Cybercrime (Jersey) Law 2019

Cybercrime (Jersey) Law 2019 Arrangement Article 1 Amendment of Computer Misuse (Jersey) Law 1995 . 3 2 Amendment of Criminal Justice (International Co-operation) (Jersey) Law 2001 5 3 Amendment of Police Procedures and Criminal Evidence (Jersey) Law 2003 . 7 4 Amendment of Regulation of Investigatory Powers (Jersey) Law 2005 . 9 5 Citation and commencement 23 SCHEDULE 24 Schedule 2A inserted 24 Cybercrime (Jersey) Law 2019 A LAW to amend various Laws to give further effect to the Council of Europe Convention on Cybercrime (Budapest, 2001), to amend the Regulation of Investigatory Powers (Jersey) Law 2005 to provide for the investigation of electronic data protected by encryption and for connected purposes. Adopted by the States 29th January 2019 Sanctioned by Order of Her Majesty in Council 10th April 2019 Registered by the Royal Court 26th April 2019 THE STATES , subject to the sanction of Her Most Excellent Majesty in Council, have adopted the following Law – 1 Amendment of Computer Misuse (Jersey) Law 1995 (1) The Computer Misuse (Jersey) Law 1995 [1] is amended as follows. (2) In Article 1 – (a) paragraph (7) shall be deleted; (b) for paragraph (8) there shall be substituted the following paragraph – “(8) An act done in relation to a computer is unauthorized if the person doing the act (or causing it to be done) – (a) is not a person with responsibility for the computer who is entitled to determine whether the act may be done; and (b) does not have consent to the act from any such person, and in this paragraph ‘act’ includes a series of acts.”; (c) after paragraph (9) there shall be inserted the following paragraph – “(10) The States may by Regulations amend any definition in this Article.”. (3) In Article 2 – (a) at the end of paragraph (1)(a) there shall be added the words “, or to enable any such access to be secured”; (b) in paragraph (1)(b) after the word “secure” there shall be inserted the words “, or to enable to be secured,”; (c) in paragraph (3) for the words from “not exceeding” to the end of the paragraph there shall be substituted the words “of 2 years and to a fine”. (4) For Article 5 there shall be substituted the following Articles – “5 Unauthorized acts with intent to impair, or with recklessness as to impairing, operation of computer (1) A person is guilty of an offence if – (a) he or she does any unauthorized act in relation to a computer; (b) at the time when the act is done he or she knows that it is unauthorized; and (c) paragraph (2) applies. (2) This paragraph applies if the person intends by doing the act to do any of the following, or is reckless as to whether the act will do any of the following – (a) impair the operation of any computer; (b) prevent or hinder access to any program or data held in any computer; (c) impair the operation of any such program or the reliability of any such data; or (d) enable any of the things mentioned in sub-paragraphs (a) to (c) to be done. (3) The intention or the recklessness referred to in paragraph (2) need not relate to – (a) any particular computer; (b) any particular program or data; or (c) a program or data of any particular kind. (4) In this Article – (a) a reference to doing an act includes a reference to causing an act to be done; (b) ‘act’ includes a series of acts; (c) a reference to impairing, preventing or hindering something includes a reference to doing so temporarily. (5) A person guilty of an offence under this Article is liable to imprisonment for a term of 10 years and to a fine. 5A Making, supplying or obtaining articles for use in offence under Article 2 or 5 (1) A person is guilty of an offence if he or she makes, adapts, supplies or offers to supply any article intending it to be used to commit, or to assist in the commission of, an offence under Article 2 or Article 5. (2) A person is guilty of an offence if he or she supplies or offers to supply any article believing that it is likely to be used to commit, or to assist in the commission of, an offence under Article 2 or Article 5. (3) A person is guilty of an offence if he or she obtains any article with a view to its being supplied for use to commit, or to assist in the commission of, an offence under Article 2 or Article 5. (4) A person guilty of an offence under this Article is liable to imprisonment for a term of 2 years and to a fine. (5) In this Article ‘article’ includes any program or data held in electronic form.”. 2 Amendment of Criminal Justice (International Co-operation) (Jersey) Law 2001 After Article 5B of the Criminal Justice (International Co-operation) (Jersey) Law 2001 [2] there shall be inserted the following Articles – “5C Order to preserve data pending request for assistance (1) Where an authority in a country or territory outside Jersey intends to submit a request for assistance under Article 5(1), that authority may request the Attorney General to apply to the court for an order (a ‘preservation order’) for the expeditious preservation of data stored by means of a computer system. (2) The request to the Attorney General must specify – (a) the authority seeking preservation; (b) the offence that is the subject of a criminal investigation or proceedings together with a brief summary of the relevant facts; (c) the data that is to be preserved and its relationship to the offence; (d) any available information identifying the person in possession of the data or the computer system on which it is stored; (e) the reason why the preservation is necessary; and (f) that the authority intends to submit a request for assistance under Article 5(1) for assistance in obtaining the data. (3) On receiving the application by or on behalf of the Attorney General under this Article the court may, where it considers it in the interests of justice to do so, make an order for the data to be preserved pending a request being made under Article 5(1) or for such time as the court thinks fit. (4) An application for a preservation order may be made ex parte to the Bailiff in chambers. (5) A preservation order must provide for notice to be given to any person named within it. (6) A person named within a preservation order who by any act or omission causes the damage, deletion, alteration, suppression or removal of any data preserved by the order is guilty of an offence and liable to imprisonment for a term of 5 years and to a fine. (7) A person named within a preservation order may apply to the Bailiff in chambers for the order to be revoked or varied and the Bailiff must either rule upon the application or refer it to the Royal Court. 5D Offence of unauthorized disclosure of preservation order (1) Where an order is made under Article 5C(3) a person must not disclose – (a) the existence and contents of the order; (b) the details of the making of the order and of any variation of it; (c) the existence and contents of any requirement to provide assistance with giving effect to the order; (d) the steps taken in pursuance of the order or of any such requirement; and (e) any part of the data preserved by the order. (2) A person who contravenes paragraph (1) is guilty of an offence and liable to imprisonment for a term of 5 years and to a fine. (3) In proceedings against any person for an offence under this Article in respect of any disclosure, it is a defence for the accused to show that the accused could not reasonably have been expected, after first becoming aware of any of the matters mentioned in paragraph (1), to take steps to prevent the disclosure. (4) In proceedings against any person for an offence under this Article in respect of any disclosure, it is a defence for the accused to show that – (a) the disclosure was made by or to a professional legal adviser in connection with the giving, by the adviser to any client of the adviser, of advice about the effect of any provision of this Law; and (b) the person to whom or, as the case may be, by whom it was made was the client or a representative of the client. (5) In proceedings against any person for an offence under this Article in respect of any disclosure, it is a defence for the accused to show that the disclosure was made by a professional legal adviser – (a) in contemplation of, or in connection with, any legal proceedings; and (b) for the purposes of those proceedings. (6) Neither paragraph (4) nor paragraph (5) applies in the case of a disclosure made with a view to furthering any criminal purpose.”. 3 Amendment of Police Procedures and Criminal Evidence (Jersey) Law 2003 (1) The Police Procedures and Criminal Evidence (Jersey) Law 2003 [3] is amended as follows. (2) For Article 16(1) there shall be substituted the following paragraphs – “(1) A police officer may obtain access to material to which this Article applies for the purposes of a criminal investigation by making an application under Schedule 2 and in accordance with that Schedule. (1A) This Article applies to – (a) excluded material; (b) special procedure material; and (c) material stored on a computer or stored on a device that is remotely accessible via the internet and accessible by the person who stored it but not to users of the internet generally.”. (3) After Article 70 there shall be inserted the following Articles – “70A Order to preserve data pending criminal investigation (1) The court may make an order, referred to in this Law as a ‘preservation order’, on an application made by or on behalf of the Attorney General where it considers it is in the interests of justice to do so. (2) A preservation order is an order providing that certain data specified in the application be preserved pending criminal investigation or for such time as the court thinks fit. (3) An application for a preservation order may be made ex parte to the Bailiff in chambers. (4) The court must not make a preservation order unless it is satisfied that there are reasonable grounds for believing – (a) that a serious offence has been committed; and (b) the data specified in the application includes evidence that relates to that offence or to some other offence that is connected with, or similar to, that offence . (5) A preservation order must provide for notice to be given to any person named within it. (6) A person named within a preservation order who by any act or omission causes the damage, deletion, alteration, suppression or removal of any data preserved by the order is guilty of an offence and liable to imprisonment for a term of 5 years and to a fine. (7) A person named within a preservation order may apply to the Bailiff in chambers for the order to be revoked or varied and the Bailiff must rule upon the application or refer it to the Royal Court. 70B Offence of unauthorized disclosure of preservation order (1) Where an order is made under Article 70A(1) a person must not disclose – (a) the existence and contents of the order; (b) the details of the making of the order and of any variation of it; (c) the existence and contents of any requirement to provide assistance with giving effect to the order; (d) the steps taken in pursuance of the order or of any such requirement; and (e) any part of the data preserved by the order. (2) A person who contravenes paragraph (1) is guilty of an offence and liable to imprisonment for a term of 5 years and to a fine. (3) In proceedings against any person for an offence under this Article in respect of any disclosure, it is a defence for the accused to show that the accused could not reasonably have been expected, after first becoming aware of any of the matters mentioned in paragraph (1), to take steps to prevent the disclosure. (4) In proceedings against any person for an offence under this Article in respect of any disclosure, it is a defence for the accused to show that – (a) the disclosure was made by or to a professional legal adviser in connection with the giving, by the adviser to any client of the adviser, of advice about the effect of any provision of this Law; and (b) the person to whom or, as the case may be, by whom it was made was the client or a representative of the client. (5) In proceedings against any person for an offence under this Article in respect of any disclosure, it is a defence for the accused to show that the disclosure was made by a professional legal adviser – (a) in contemplation of, or in connection with, any legal proceedings; and (b) for the purposes of those proceedings. (6) Neither paragraph (4) nor paragraph (5) applies in the case of a disclosure made with a view to furthering any criminal purpose.”. (4) In Schedule 2 – (a) for the heading “SPECIAL PROCEDURE” there shall be substituted the heading “ACCESS TO CERTAIN MATERIAL”; (b) in paragraph 2(1)(a)(ii) for the words “which consists” to the end there shall be substituted the words “to which Article 16 applies that is in the possession or control of a person, or on premises, specified in the application”; (c) in paragraph 3 after the word “possession” there shall be inserted the words “or control”; (d) in paragraph 11 for the words “enter and search the premises” there shall be substituted the words “search for the material and enter any premises necessary for the purposes of the search”; (e) in paragraph 13(a) for the words “the premises” there shall be substituted the words “any premises”. 4 Amendment of Regulation of Investigatory Powers (Jersey) Law 2005 (1) The Regulation of Investigatory Powers (Jersey) Law 2005 [4] is amended as follows. (2) After Article 27 there shall be inserted the following Article – “27A Offence of unauthorized disclosure by postal or telecommunications operator (1) Where a notice is given to a postal or telecommunications operator under Article 26(4) it shall be the duty of that operator to keep secret the matters mentioned in paragraph (2). (2) The matters to be kept secret are – (a) the existence and contents of the notice given under Article 26(4); (b) the details of the issue of the notice and of any renewal or modification of it; (c) the existence and contents of any requirement to provide assistance with giving effect to the notice; (d) the steps taken in pursuance of the notice or of any such requirement; and (e) everything in the intercepted material, together with any related communications data. (3) A person who makes a disclosure to another person of anything that he or she is required to keep secret under this Article is guilty of an offence and liable to imprisonment for a term of 5 years and to a fine. (4) In proceedings against any person for an offence under this Article in respect of any disclosure, it is a defence for the accused to show that the accused could not reasonably have been expected, after being given the notice or (as the case may be) first becoming aware of the matter disclosed, to take steps to prevent the disclosure. (5) In proceedings against any person for an offence under this Article in respect of any disclosure, it is a defence for the accused to show that – (a) the disclosure was made by or to a professional legal adviser in connection with the giving, by the adviser to any client of the adviser, of advice about the effect of provisions of this Chapter; and (b) the person to whom or, as the case may be, by whom it was made was the client or a representative of the client. (6) In proceedings against any person for an offence under this Article in respect of any disclosure, it is a defence for the accused to show that the disclosure was made by a professional legal adviser – (a) in contemplation of, or in connection with, any legal proceedings; and (b) for the purposes of those proceedings. (7) Neither paragraph (5) nor paragraph (6) applies in the case of a disclosure made with a view to furthering any criminal purpose. (8) In proceedings against any person for an offence under this Article in respect of any disclosure, it is a defence for the accused to show that the disclosure was confined to a disclosure made to the Commissioner or authorized – (a) by the Commissioner; (b) by the terms of the notice; (c) by or on behalf of the person who gave the notice; or (d) by or on behalf of a person who – (i) is in lawful possession of the protected information (within the meaning of Article 42A(1)) to which the notice relates, and (ii) came into possession of that information.”. (3) After Part 3 there shall be inserted the following Part – “PART 3A INVESTIGATION OF ELECTRONIC DATA PROTECTED BY ENCRYPTION ETC. 42A Interpretation of Part 3A (1) In this Part – ‘electronic signature’ means anything in electronic form that is – (a) incorporated into, or otherwise logically associated with, any electronic communication or other electronic data; (b) generated by the signatory or other source of the communication or data; and (c) used for the purpose of facilitating, by means of a link between the signatory or other source and the communication or data, the establishment of the authenticity of the communication or data, the establishment of its integrity, or both; ‘key’, in relation to any electronic data, means any key, code, password, algorithm, biometric identification or other data the use of which (with or without other keys) – (a) allows access to the electronic data; or (b) facilitates the putting of the data into an intelligible form; ‘protected information’ means any electronic data that, without the key to the data – (a) cannot, or cannot readily, be accessed; or (b) cannot, or cannot readily, be put into an intelligible form; ‘Article 42B notice’ means a notice under Article 42B; ‘warrant’ includes any authorization, notice or other instrument (however described) conferring a power of the same description as may, in other cases, be conferred by a warrant. (2) References in this Part to a person’s having information (including a key to protected information) in that person’s possession include references – (a) to its being in the possession of another person who is under that person’s control so far as that information is concerned; (b) to that person’s having an immediate right of access to it, or an immediate right to have it transmitted or otherwise supplied to him or her; and (c) to its being, or being contained in, anything which that person or another person under that person’s control is entitled, in exercise of any statutory power and without otherwise taking possession of it, to detain, inspect or search. (3) References in this Part to being in, or being put into, intelligible form include references to being in the condition in which the thing in question was before an encryption or similar process was applied to it or, as the case may be, to being restored to that condition. (4) In this Article – (a) references to the authenticity of any communication or data are references to any one or more of the following – (i) whether the communication or data comes from a particular person or other source, (ii) whether it is accurately timed and dated, (iii) whether it is intended to have legal effect; and (b) references to the integrity of any communication or data are references to whether there has been any tampering with or other modification of the communication or data. 42B Power to require disclosure of protected information or key (1) This Article applies where any protected information – (a) has come into the possession of any person by means of the exercise of a statutory power to seize, detain, inspect, search or otherwise to interfere with documents or other property, or is likely to do so; (b) has come into the possession of any person by means of the exercise of any statutory power to intercept communications, or is likely to do so; (c) has come into the possession of any person by means of the exercise of any power conferred by an authorization under Article 26(3) or under Part 3, or as a result of the giving of a notice under Article 26(4), or is likely to do so; (d) has come into the possession of any person as a result of having been provided or disclosed in pursuance of any statutory duty (whether or not one arising as a result of a request for information), or is likely to do so; or (e) has, by any other lawful means not involving the exercise of statutory powers, come into the possession of any of the intelligence services, the Force or the Agent of the Impôts or is likely so to come into the possession of any of them. (2) If any person with the appropriate permission under Schedule 2A believes, on reasonable grounds – (a) that a key to the protected information is in the possession of any person; (b) that the imposition of a disclosure requirement in respect of the protected information is – (i) necessary on grounds falling within paragraph (3), or (ii) necessary for the purpose of securing the effective exercise or proper performance by any public authority of any statutory power or statutory duty; (c) that the imposition of such a requirement is proportionate to what is sought to be achieved by its imposition; and (d) that it is not reasonably practicable for the person with the appropriate permission to obtain possession of the protected information in an intelligible form without the giving of a notice under this Article, the person with that permission may, by notice to the person whom he or she believes to have possession of the key, impose a disclosure requirement in respect of the protected information. (3) A disclosure requirement in respect of any protected information is necessary on grounds falling within this paragraph if it is necessary – (a) in the interests of national security; (b) for the purpose of preventing or detecting crime; or (c) in the interests of the economic well-being of Jersey. (4) A notice under this Article imposing a disclosure requirement in respect of any protected information – (a) must be given in writing or (if not in writing) must be given in a manner that produces a record of its having been given; (b) must describe the protected information to which the notice relates; (c) must specify the matters falling within paragraph (2)(b)(i) or (ii) by reference to which the notice is given; (d) must specify the office, rank or position held by the person giving it; (e) must specify the office, rank or position of the person who, for the purposes of Schedule 2A, granted permission for the giving of the notice or (if the person giving the notice was entitled to give it without another person’s permission) must set out the circumstances in which that entitlement arose; (f) must specify the time by which the notice is to be complied with; and (g) must set out the disclosure that is required by the notice and the form and manner in which it is to be made, and the time specified for the purposes of sub-paragraph (f) must allow a period for compliance which is reasonable in all the circumstances. (5) Where it appears to a person with the appropriate permission – (a) that more than one person is in possession of the key to any protected information; (b) that any of those persons is in possession of that key in that person’s capacity as an officer or employee of any body corporate; and (c) that another of those persons is the body corporate itself or another officer or employee of the body corporate, a notice under this Article may not be given, by reference to a person’s possession of the key, to any officer or employee of the body corporate unless that person is a senior officer of the body corporate or it appears to the person giving the notice that there is no senior officer of the body corporate and (in the case of an employee) no more senior employee of the body corporate to whom it is reasonably practicable to give the notice. (6) Where it appears to a person with the appropriate permission – (a) that more than one person is in possession of the key to any protected information; (b) that any of those persons is in possession of that key in that person’s capacity as an employee of a firm; and (c) that another of those persons is the firm itself or a partner of the firm, a notice under this Article may not be given, by reference to a person’s possession of the key, to any employee of the firm unless it appears to the person giving the notice that there is neither a partner of the firm nor a more senior employee of the firm to whom it is reasonably practicable to give the notice. (7) Paragraphs (5) and (6) do not apply to the extent that there are special circumstances of the case that mean that the purposes for which the notice is given would be defeated, in whole or in part, if the notice were given to the person to whom it would otherwise be required to be given by those paragraphs. (8) A notice under this Article may not require the making of any disclosure to any person other than – (a) the person giving the notice; or (b) such other person as may be specified in or otherwise identified by, or in accordance with, the provisions of the notice. (9) A notice under this Article may not require the disclosure of any key that – (a) is intended to be used for the purpose only of generating electronic signatures; and (b) has not in fact been used for any other purpose. (10) In this Article ‘senior officer’, in relation to a body corporate, means a director, manager, secretary or other similar officer of the body corporate; and for this purpose ‘director’, in relation to a body corporate whose affairs are managed by its members, means a member of the body corporate. 42C Effect of notice imposing disclosure requirement (1) Subject to the following provisions of this Article, the effect of an Article 42B notice imposing a disclosure requirement in respect of any protected information on a person who is in possession at a relevant time of both the protected information and a means of obtaining access to the information and of disclosing it in an intelligible form is that the person – (a) is entitled to use any key in his or her possession to obtain access to the information or to put it into an intelligible form; and (b) is required, in accordance with that notice, to make a disclosure of the information in an intelligible form. (2) A person subject to a requirement to make disclosure under paragraph (1)(b) is taken to have complied with that requirement if – (a) the person makes instead a disclosure of any key to the protected information that is in his or her possession; and (b) that disclosure is made, in accordance with the notice imposing the requirement, to the person to whom, and by the time by which, he or she was required to provide the information in that form. (3) Where a disclosure requirement in respect of any protected information is imposed on any person by an Article 42B notice and – (a) that person is not in possession of the information; (b) that person is incapable, without the use of a key that is not in his or her possession, of obtaining access to the information and of disclosing it in an intelligible form; or (c) the notice states, in pursuance of a direction under Article 42D, that it can be complied with only by the disclosure of a key to the information, the effect of imposing that disclosure requirement on that person is to require the person, in accordance with the notice imposing the requirement, to make a disclosure of any key to the protected information that is in his or her possession at a relevant time. (4) Paragraphs (5) to (7) apply where a person (‘the person given notice’) – (a) is entitled or obliged to disclose a key to protected information for the purpose of complying with any disclosure requirement imposed by an Article 42B notice; and (b) is in possession of more than one key to that information. (5) It is not necessary, for the purpose of complying with the requirement, for the person given notice to make a disclosure of any keys in addition to those the disclosure of which is, alone, sufficient to enable the person to whom they are disclosed to obtain access to the information and to put it into an intelligible form. (6) Where – (a) paragraph (5) allows the person given notice to comply with a requirement without disclosing all of the keys in that person’s possession; and (b) there are different keys, or combinations of keys, in the possession of that person the disclosure of which would, under that paragraph, constitute compliance, the person given notice may select which of the keys, or combination of keys, to disclose for the purpose of complying with that requirement in accordance with that paragraph. (7) Subject to paragraphs (5) and (6), the person given notice is not to be taken to have complied with the disclosure requirement by the disclosure of a key unless that person has disclosed every key to the protected information that is in his or her possession at a relevant time. (8) Where, in a case in which a disclosure requirement in respect of any protected information is imposed on any person by an Article 42B notice – (a) that person has been in possession of the key to that information but is no longer in possession of it; (b) if that person had continued to be in possession of the key, he or she would have been required by virtue of the giving of the notice to disclose it; and (c) that person is in possession, at a relevant time, of information to which paragraph (9) applies, the effect of imposing the disclosure requirement on that person is to require that person, in accordance with the notice, to disclose all such information to which paragraph (9) applies as is in that person’s possession and as that person may be required, in accordance with the notice, to disclose by the person to whom he or she would have been required to disclose the key. (9) This paragraph applies to any information that would facilitate the obtaining or discovery of the key or the putting of the protected information into an intelligible form. (10) In this Article ‘relevant time’, in relation to a disclosure requirement imposed by an Article 42B notice, means the time of the giving of the notice or any subsequent time before the time by which the requirement falls to be complied with. 42D Cases in which key required (1) An Article 42B notice must not contain a statement for the purposes of Article 42C(3)(c) unless – (a) the person who, for the purposes of Schedule 2A, granted the permission for the giving of the notice; or (b) any person whose permission for the giving of such a notice in relation to that information would constitute the appropriate permission for the purposes of that Schedule, has given a direction that the requirement can be complied with only by the disclosure of the key itself. (2) A direction for the purposes of paragraph (1) by the Force or the States of Jersey Customs and Immigration Service must be given only by or with the permission of the Chief Officer or the Agent of the Impôts, as the case may be, expressly in relation to the direction in question. (3) A person must not give a direction for the purposes of paragraph (1) unless the person believes – (a) that there are special circumstances that mean that the purposes for which it was believed necessary to impose the requirement in question would be defeated, in whole or in part, if the direction were not given; and (b) that the giving of the direction is proportionate to what is sought to be achieved by prohibiting any compliance with the requirement in question otherwise than by the disclosure of the key itself. (4) The matters to be taken into account in considering whether the requirement of paragraph (3)(b) is satisfied in the case of any direction include – (a) the extent and nature of any protected information, in addition to the protected information in respect of which the disclosure requirement is imposed, to which the key is also a key; and (b) any adverse effect that the giving of the direction might have on a business carried on by the person on whom the disclosure requirement is imposed. (5) Where a direction for the purposes of paragraph (1) is given by or with the permission of the Chief Officer or the Agent of the Impôts, the person giving the direction must notify the Commissioner that the direction has been given. (6) A notification under paragraph (5) – (a) must be given no later than 7 days after the day of the giving of the direction to which it relates; and (b) may be given either in writing or by being transmitted to the Commissioner by electronic means. 42E Contribution to costs of disclosure (1) The States may ensure that such arrangements as they think appropriate are in place to require or authorize, in such cases as they think fit, the making of appropriate contributions towards the costs incurred by persons to whom Article 42B notices are given in complying with such notices. (2) Contributions made under this Article must be paid out of the annual income of the States. 42F Offence: failure to comply with a notice (1) It is an offence for a person to whom an Article 42B notice has been given knowingly to fail to make the disclosure required by the giving of the notice and in accordance with the notice. (2) In proceedings against any person for an offence under this Article, if it is shown that the accused was in possession of a key to any protected information at any time before the time of the giving of the Article 42B notice, the accused is taken for the purposes of those proceedings to have continued to be in possession of that key at all subsequent times, unless it is shown that the key was not in the accused’s possession after the giving of the notice and before the time by which the accused was required to disclose it. (3) For the purposes of this Article a person is taken to have shown that he or she was not in possession of a key to protected information at a particular time if – (a) sufficient evidence of that fact is adduced to raise an issue with respect to it; and (b) the contrary is not proved beyond a reasonable doubt. (4) In proceedings against any person for an offence under this Article it shall be a defence for the accused to show – (a) that it was not reasonably practicable for the accused to make the disclosure required by virtue of the giving of the Article 42B notice by the time by which the accused was required, in accordance with that notice, to make it; but (b) that the accused did make that disclosure as soon after that time as it was reasonably practicable for the accused to do so. (5) A person guilty of an offence under this Article is liable to imprisonment for a term of 5 years and to a fine. 42G Offence: tipping-off (1) This Article applies where an Article 42B notice contains a provision requiring – (a) the person to whom the notice is given; and (b) every other person who becomes aware of it or of its contents, to keep secret the giving of the notice, its contents and the things done in pursuance of it. (2) A requirement to keep anything secret must not be included in an Article 42B notice except where – (a) it is included with the consent of the person who, for the purposes of Schedule 2A, granted the permission for the giving of the notice; or (b) the person who gives the notice is also a person whose permission for the giving of such a notice in relation to the information in question would constitute appropriate permission for the purposes of that Schedule. (3) An Article 42B notice must not contain a requirement to keep anything secret except where the protected information to which it relates – (a) has come into the possession of the Force, the States of Jersey Customs and Immigration Service or any of the intelligence services; or (b) is likely to come into the possession of any of the bodies mentioned in sub-paragraph (a), by means which it is reasonable, in order to maintain the effectiveness of any investigation or operation or of investigatory techniques generally, or in the interests of the safety or well-being of any person, to keep secret from a particular person. (4) A person who makes a disclosure to any other person of anything that he or she is required by an Article 42B notice to keep secret is guilty of an offence and liable to imprisonment for a term of 5 years and to a fine. (5) In proceedings against any person for an offence under this Article in respect of any disclosure, it is a defence for the accused to show that – (a) the disclosure was effected entirely by the operation of software designed to indicate when a key to protected information has ceased to be secure; and (b) the accused could not reasonably have been expected to take steps, after being given the notice or (as the case may be) becoming aware of it or of its contents, to prevent the disclosure. (6) In proceedings against any person for an offence under this Article in respect of any disclosure, it is a defence for the accused to show that – (a) the disclosure was made by or to a professional legal adviser in connection with the giving, by the adviser to any client of the adviser’s, of advice about the effect of provisions of this Part; and (b) the person to whom or, as the case may be, by whom it was made was the client or a representative of the client. (7) In proceedings against any person for an offence under this Article in respect of any disclosure, it is a defence for the accused to show that the disclosure was made by a professional legal adviser – (a) in contemplation of, or in connection with, any legal proceedings; and (b) for the purposes of those proceedings. (8) Neither paragraph (6) nor paragraph (7) applies in the case of a disclosure made with a view to furthering any criminal purpose. (9) In proceedings against any person for an offence under this Article in respect of any disclosure, it is a defence for the accused to show that the disclosure was confined to a disclosure made to the Commissioner or authorized – (a) by the Commissioner; (b) by the terms of the notice; (c) by or on behalf of the person who gave the notice; or (d) by or on behalf of a person who – (i) is in lawful possession of the protected information to which the notice relates, and (ii) came into possession of that information as mentioned in Article 42B(1). (10) In proceedings for an offence under this Article against a person other than the person to whom the notice was given, it is a defence for the accused to show that the accused neither knew nor had reasonable grounds for suspecting that the notice contained a requirement to keep secret what was disclosed. 42H General duties of specified authorities (1) This Article applies to – (a) the Attorney General; (b) any administration of the States or a Minister; (c) the Chief Officer of the Force or the Agent of the Impôts; (d) every other person whose officers or employees include persons with duties that involve the giving of Article 42B notices. (2) Each of the persons to whom this Article applies must ensure that such arrangements are in place, in relation to persons under his or her control who by virtue of this Part obtain possession of keys to protected information, as that person considers necessary for securing – (a) that a key disclosed in pursuance of an Article 42B notice is used for obtaining access to, or putting into an intelligible form, only protected information in relation to which the power to give such a notice was exercised or could have been exercised if the key had not already been disclosed; (b) that the uses to which a key so disclosed is put are reasonable having regard both to the uses to which the person using the key is entitled to put any protected information to which it relates and to the other circumstances of the case; (c) that, having regard to those matters, the use and any retention of the key are proportionate to what is sought to be achieved by its use or retention; (d) that the requirements of paragraph (3) are satisfied in relation to any key disclosed in pursuance of an Article 42B notice; (e) that, for the purpose of ensuring that those requirements are satisfied, any key so disclosed is stored, for so long as it is retained, in a secure manner; (f) that all records of a key so disclosed (if not destroyed earlier) are destroyed as soon as the key is no longer needed for the purpose of enabling protected information to be put into an intelligible form. (3) The requirements of this paragraph are satisfied in relation to any key disclosed in pursuance of an Article 42B notice if – (a) the number of persons to whom the key is disclosed or otherwise made available; and (b) the number of copies made of the key, are each limited to the minimum that is necessary for the purpose of enabling protected information to be put into an intelligible form. (4) Subject to paragraph (5), where any relevant person incurs any loss or damage in consequence of – (a) any breach by a person to whom this Article applies of the duty imposed on that person by paragraph (2); or (b) any contravention by any person whatever of arrangements made under that paragraph in relation to persons under the control of a person to whom this Article applies, the breach or contravention is actionable against the person to whom this Article applies at the suit or instance of the relevant person. (5) A person is a relevant person for the purposes of paragraph (4) if that person – (a) has made a disclosure in pursuance of an Article 42B notice; or (b) is a person whose protected information or key has been disclosed in pursuance of such a notice, and loss or damage shall be taken into account for the purposes of that paragraph to the extent only that it relates to the disclosure of particular protected information or a particular key which, in the case of a person falling within sub-paragraph (b), must be that person’s information or key. (6) For the purposes of paragraph (5) – (a) information belongs to a person if that person has any right that would be infringed by an unauthorized disclosure of the information; and (b) a key belongs to a person – (i) if it is a key to information that belongs to that person, or (ii) if that person has any right that would be infringed by an unauthorized disclosure of the key. (7) In any proceedings brought by virtue of paragraph (4), the court must have regard to any opinion with respect to the matters to which the proceedings relate that is or has been given by the Commissioner.”. (4) In Article 43(2) after sub-paragraph (d) there shall be added the following sub-paragraphs – “(e) the exercise and performance, by any person other than the Bailiff, of the powers and duties conferred or imposed, otherwise than with the permission of the Bailiff, by or under Part 3A; (f) the adequacy of the arrangements by virtue of which the duties imposed by Article 42H are sought to be discharged in relation to persons whose conduct is under review under sub-paragraph (b).”. (5) In Article 44 – (a) in paragraph (1), the word “and” following sub-paragraph (m) shall be deleted and after sub-paragraph (m) there shall be inserted the following sub-paragraph – “(ma) every person to whom a notice under Article 42B has been given in relation to any information obtained under Part 2; and”; (b) in paragraph (1)(n) for the words “(j) or (l)” there shall be substituted the words “(j), (l) or (ma)”; (c) in paragraph (3) for the words “duty imposed by Article 19 has” there shall be substituted the words “duties imposed by Articles 19 and 42H have”. (6) In Article 46 – (a) in paragraph (4) the word “or” following sub-paragraph (b) shall be deleted and after sub-paragraph (b) there shall be inserted the following sub-paragraph – “(ba) they are proceedings brought by virtue of Article 42H(4); or”; (b) in paragraph (6) after sub-paragraph (e) there shall be added the following sub-paragraph – “(f) the giving of a notice under Article 42B or any disclosure or use of a key to protected information.”; (c) in paragraph (9) after sub-paragraph (c) there shall be inserted the following sub-paragraphs – “(ca) a permission for the purposes of Schedule 2A; (cb) a notice under Article 42B;”; (d) after paragraph (10) there shall be added the following paragraph – “(11) In this Article – (a) references to a key and to protected information shall be construed in accordance with Article 42A(1); (b) references to the disclosure or use of a key to protected information taking place in relation to a person are references to such a disclosure or use taking place in a case in which that person has had possession of the key or of the protected information; and (c) references to the disclosure of a key to protected information include references to the making of any disclosure in an intelligible form (within the meaning of Article 42A(3)) of protected information by a person who is or has been in possession of the key to that information, and the reference in sub-paragraph (b) to a person’s having possession of a key or of protected information shall be construed in accordance with Article 42A(2).”. (7) In Article 49(7) – (a) after sub-paragraph (o) the word “and” shall be deleted and there shall be inserted the following sub-paragraph – “(oa) every person to whom a notice under Article 42B has been given; and”; (b) in sub-paragraph (p) for the words “paragraph (h), (i) or (k)” there shall be substituted the words “sub-paragraph (h), (i), (k) or (oa)”. (8) In Article 51(2)(a) for the words “Parts 2 and 3” there shall be substituted the words “Parts 2, 3 and 3A”. (9) In Article 56(1) after the words “under this Law” there shall be inserted the words “, other than an offence under any provision of Part 3A,”. (10) After Schedule 2 there shall be inserted the Schedule set out in the Schedule to this Law. 5 Citation and commencement This Law may be cited as the Cybercrime (Jersey) Law 2019 and shall come into force 7 days after its registration. l.-m. hart Deputy Greffier of the States SCHEDULE (Article 4(10)) Schedule 2A inserted “SCHEDULE 2A (Articles 42B(2), 42D(1)(a), 42G(2)(a), 46(9)(ca)) PERSONS HAVING THE APPROPRIATE PERMISSION 1 Interpretation In this Schedule – (a) ‘authorization to interfere with property’ means an authorization given under Article 101 of the Police Procedures and Criminal Evidence (Jersey) Law 2003 [5] ; (b) words and phrases defined in Part 3A shall have the same respective meanings. 2 General rule for appropriate permission (1) Subject to the following provisions of this Schedule, a person has the appropriate permission in relation to any protected information if, and only if, written permission for the giving of Article 42B notices in relation to that information has been granted by the Bailiff or a Jurat. (2) Nothing in paragraphs 3 and 4 providing for the manner in which a person may be granted the appropriate permission in relation to any protected information without a grant under this paragraph shall be construed as requiring any further permission to be obtained in a case in which permission has been granted under this paragraph. 3 Data obtained under warrant or under authorization of Attorney General (1) This paragraph applies in the case of protected information falling within Article 42B(1)(a), (b) or (c) where the statutory power in question is one exercised, or to be exercised, in accordance with – (a) a warrant issued by the Bailiff or a Jurat; or (b) an interception warrant or authorization to interfere with property issued by the Attorney General. (2) Subject to sub-paragraphs (3) to (5) and paragraph 5(1), a person has the appropriate permission in relation to that protected information (without any grant of permission under paragraph 2) if – (a) the warrant or, as the case may be, the authorization contained the relevant authority’s permission for the giving of Article 42B notices in relation to protected information to be obtained under the warrant or authorization;

or (b) since the issue of the warrant or authorization, written permission has been granted by the relevant authority for the giving of such notices in relation to protected information obtained under the warrant or authorization. (3) Only a person who – (a) was entitled to exercise the power conferred by the warrant; or (b) is of the description of persons on whom the power conferred by the warrant was, or could have been, conferred, is capable of having the appropriate permission in relation to protected information obtained, or to be obtained, under a warrant issued by the Bailiff or a Jurat. (4) Only persons holding office in any administration of the States or who are employed by the States’ Employment Board established by Article 4(1) of the Employment of States of Jersey Employees (Jersey) Law 2005 [6] , or police officers in the Force are capable of having the appropriate permission in relation to protected information obtained, or to be obtained, under a warrant issued by the Attorney General. (5) Only the Force and the States of Jersey Customs and Immigration Service are capable of having the appropriate permission in relation to protected information obtained, or to be obtained, under an authorization to interfere with property issued by the Attorney General. (6) In this paragraph ‘relevant authority’ – (a) in relation to a warrant issued by the Bailiff or a Jurat, means any person holding any judicial office that would have entitled that person to issue the warrant; and (b) in relation to any warrant or an authorization to interfere with property issued by the Attorney General, means the Attorney General. (7) Protected information that comes into a person's possession by means of the exercise of any statutory power which – (a) is exercisable without a warrant; but (b) is so exercisable in the course of, or in connection with, the exercise of another statutory power for which a warrant is required, is not to be taken, by reason only of the warrant required for the exercise of the power mentioned in clause (b), to be information in the case of which this paragraph applies. 4 Data obtained under any enactment without a warrant or an authorization issued by the Attorney General (1) This paragraph applies – (a) in the case of protected information falling within Article 42B(1)(a), (b) or (c) that is not information in the case of which paragraph 3 applies; and (b) in the case of protected information falling within Article 42B(1)(d) that is not information also falling within Article 42B(1)(a), (b) or (c). (2) Subject to paragraph 5, where – (a) the power conferred by the enactment was exercised, or is likely to be exercised, by the Force or the States of Jersey Customs and Immigration Service; or (b) the information was provided or disclosed, or is likely to be provided or disclosed, to either of those bodies; or (c) the information is in the possession of, or is likely to come into the possession of, either of those bodies, the bodies have the appropriate permission in relation to the protected information, without any grant of permission under paragraph 2. (3) In any other case a person does not have the appropriate permission by virtue of a grant of permission under paragraph 2 unless that person is a person falling within sub-paragraph (4). (4) A person falls within this sub-paragraph if, as the case may be – (a) he or she is the person who exercised the power conferred by an enactment or is of the description of persons who would have been entitled to exercise it; (b) he or she is the person to whom the protected information was provided or disclosed, or is of a description of person the provision or disclosure of the information to whom would have discharged the statutory duty; or (c) he or she is a person who is likely to be a person falling within clause (a) or (b) when the power is exercised or the protected information provided or disclosed. 5 General requirements relating to the appropriate permission (1) A person does not have the appropriate permission in relation to any protected information unless the person is either – (a) a person who has the protected information in his or her possession or is likely to obtain possession of it; or (b) a person who is authorized (apart from this Law) to act on behalf of such a person. (2) Subject to sub-paragraph (3), an officer of the Force does not by virtue of paragraph 3 or 4 have the appropriate permission in relation to any protected information unless – (a) he or she is of or above the rank of inspector; or (b) permission to give an Article 42B notice in relation to that information has been granted by a person holding the rank of inspector, or any higher rank. (3) In the case of protected information that has come into the possession of the Force by means of the exercise of powers conferred by Article 40 of the Terrorism (Jersey) Law 2002 [7] , the permission required by sub-paragraph (2) shall not be granted by any person below the rank mentioned in paragraph (4) of that Article. 6 Duration of permission (1) A permission granted by any person under any provision of this Schedule does not entitle any person to give an Article 42B notice at any time after the permission has ceased to have effect. (2) Such a permission, once granted, continues to have effect (despite the cancellation, expiry or other discharge of any warrant or authorization in which it is contained or to which it relates) until such time (if any) as it – (a) expires in accordance with any limitation on its duration that was contained in its terms; or (b) is withdrawn by the person who granted it or by a person holding any office or other position that would have entitled that person to grant it. 7 Formalities for permissions granted by the Attorney General Where any provision of this Schedule requires a warrant or an authorization to be issued by the Attorney General, the Attorney General may authorize any other person to issue the warrant or authorization on his or her behalf.”. [1] chapter 08.080 [2] chapter 08.300 [3] chapter 23.750 [4] chapter 08.830 [5] chapter 23.750 [6] chapter 16.325 [7] chapter 17.860