We live in a world in which smartphones can track our steps and location, sense light, temperature, and our voice. If cell phone privacy even exists, does a law requiring us to provide access to our cell phones cross the line?

The Customs and Excise Act 2018 (the Act) came into force on 1 October 2018. Its purpose, like its predecessor, is to increase New Zealand's border security. It not only allows customs officers at airports to undertake initial and full searches of data in electronic devices including cell phones, iPads, Android tablets, hard drives, laptops, and digital cameras; it also permits a customs officer to require you to provide access to your electronic device.

The repealed Customs and Excise Act 1996

Under the repealed Customs and Excise Act 1996[1], though not expressly stated, the content of electronic devices was within the scope of a customs officer's general goods examination power. However, a person was not legally obligated to provide a password or encryption key to access a device. This meant that Customs had no way of uncovering evidence of criminal offending without a warrant, even when it was obvious that a device contained evidence.

In respect of other legislation, the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 empowers Customs to require a person to provide access to an electronic device in relation to the movement of money in breach of that Act. The Search and Surveillance Act also imposes this obligation on owners of devices where a search is performed under that Act. However, searches under that Act usually take place only if criminal offending is suspected.

Customs' search powers

Initial search

Under the Act, a customs officer can carry out an initial search of the data in your cell phone, but only if he or she has reasonable cause to suspect that:[2]

1. You, being in possession of the device, have been, is, or is about to be involved in the commission of relevant offending;
2. An importer or exporter of the device (other than you) has been, is, or is about to be involved in the commission of relevant offending; or
3. An unaccompanied device has been, is, or is about to be used in the commission of relevant offending and the importer or exporter cannot be reasonably identified or located.
4. Relevant offending means the importation or exportation of any prohibited goods, an offence under the Act, or the unlawful importation or exportation of any goods. What amounts to "reasonable cause to suspect" however, is not defined in the Act. It is suggested that it is a lower threshold than "reasonable cause to believe", as is required for a full search.

What is an initial search?

A customs officer may access, search, review, or evaluate your data either manually or by using a technology aid that has completed a privacy impact assessment in consultation with the Privacy Commissioner. The following limitations apply to an initial search:[3]

1. Any temporary files created by a technology aid must be immediately deleted when the search is complete (unless the device is detained for a full search, as discussed below). Customs officers do not keep data or passwords.
2. The search must not damage the device or damage or interfere with the operation of the device.
3. Transmitting functions on the device must be disabled (in flight mode), wherever possible, before the search of data in the device. This is to disable access to data not contained in the device.
4. If the person in possession of the device is in a Customs-controlled area (or an unaccompanied device is in a Customs-controlled area), the device must not be removed from that area.
5. The search must take no longer than reasonably necessary.
6. The device must be returned to the person entitled to its possession at the conclusion of the search (unless the device is detained for a full search).

Full search

A full search of your data may be undertaken if a customs officer has reasonable cause to believe that evidential material relating to relevant offending is in the device.[4] The following rules apply to a full search:[5]

1. The device may be accessed and searched using any technology aids.
2. The device or data may be copied, reviewed, or evaluated (including by means of previewing, cloning, or other forensic methods).
3. The device may be removed or detained for the time reasonably necessary to conduct the search.
4. The search must not damage the device or damage or interfere with the operation of the device.
5. Any transmitting functions on the device must be disabled, wherever possible, before the search of data in the device.
6. The device must be returned to the person entitled to its possession at the conclusion of the search (unless evidence of relevant offending is found).

Under Regulation 76A of the Customs and Excise Regulations 1996, a device may be retained by Customs for up to 20 working days.

Providing access

The key concern is that whether an initial or full search is undertaken, a customs officer has the power to require you to provide access information and other information or assistance that is reasonable and necessary to allow him or her to access the device.[6]

If you have no reasonable excuse for failing to provide access, you commit an offence under the Act and are liable for a fine of up to $5,000.[7] What is a 'reasonable excuse' for not providing access will likely be dependent on the circumstances. The main point to remember is that a customs officer must have:

• Reasonable cause to suspect that you have been, are, or are about to be involved in the commission of relevant offending (initial search)
• Reasonable cause to believe that your phone contains evidence relating to relevant offending (full search)

If it is not clear why a customs officer wants to search your phone, ask why. If he or she suspects 'relevant offending', ask why. There is no harm in seeking further information.

It is too soon to assess the effects of Customs' new power to request access to electronic devices. The next New Zealand Customs Service Annual Report will likely provide some interesting insight.

In the meantime, we can be comforted by the fact that Customs does not regularly search electronic devices. In 2017, only 550 electronic devices were examined. Considering the 14 million passengers travelling to and from New Zealand each year, this figure is not substantial.

[1] The new Customs and Excise Act 2018 takes the place of the old Customs and Excise Act 1996.

[2] Customs and Excise Act 2018, s 228(2).

[3] Section 228(5).

[4] Section 228(2).

[5] Section 228(5).

[6] Ss 228(2)(c), (d) and 228(6).

[7] S 228(8).