Can the Police Make You Unlock Your Phone or Hand Over Your Passcode?

The short version

There is no single answer to this question. What decides it is which investigation the police are conducting.

• ⚠ The power is not in a chapter Ordinance but in a Legal Notice. Reading only the chapter Ordinances, one could conclude that Hong Kong has no police power expressly requiring a passcode.
• *Investigations into offences endangering national security: there is such a power, and it uses the word password. L.N. 27 of 2026 (the 2026 Implementation Rules for Amending the Implementation Rules for Article 43 of the Law of the People's Republic of China on Safeguarding National Security in the Hong Kong Special Administrative Region) came into operation on 23 March 2026 and inserted a new section 4 into Schedule 1: a police officer acting under Schedule 1 s.2(2) or s.3(1) may require a specified person to provide any necessary password or other decryption method, or any other reasonable and necessary information or assistance. A specified person is not limited to the suspect — it reaches anyone reasonably believed to own, possess, control, be authorized to access, be using or have used the equipment, or to know the password or method. ⚠ The two routes are not the same: s.2(2) is a magistrate's warrant; s.3(1) needs no warrant — a police officer not below the rank of Assistant Commissioner of Police* who is satisfied of three conditions (reasonable ground to suspect specified evidence in a certain place; reasonable ground to believe it necessary for one of the three matters in s.3(2); and that for any reason a warrant is not reasonably practicable) may act, or authorize another officer to act. The whole of both sections is set out in section 4 below.
• Not complying is an offence. Schedule 1 s.5(1): on conviction on indictment, a fine of $100,000 and one year. Section 5(2) says in terms that a tendency to incriminate oneself is not an excuse; s.5(3) gives back a reasonable excuse defence. Providing materially false or misleading information is a separate offence — s.6, $500,000 and three years.
• The same instrument also writes in a protection. Schedule 1 s.7: the officer must inform or remind the person first; and if the person claims, before providing, that doing so might tend to incriminate them, the requirement and the password, method or information provided are not admissible in evidence against that person in criminal proceedings. ⚠ But s.7(4) is equally express: that limitation does not apply to material obtained by virtue of the requirement. What is protected is the password, not what the password opens.
• Ordinary criminal investigations: no chapter Ordinance confers a police power naming a password. That statement is about the chapter Ordinances only; the Legal Notice above is a separate matter.
• The Police Force Ordinance (Cap. 232) itself confers no power to require anyone to answer a question, to give assistance, or to produce anything but proof of identity. The only thing it requires a person to produce is proof of identity (s.54(1)(a) and s.54(2)(a)); its requirements to furnish information, in s.67, are directed at banks.
• Taking the phone and looking inside it are two different things. Section 50(6) allows seizure on arrest whether or not the device is unlocked; whether the contents may be examined is governed by the conditions the Court of Appeal set out at ¶218 on 2 April 2020.
• The Court of Appeal said in 2020 that the police could not then compel an arrested person to provide a password — but one of those sentences is common ground and the other an observation made in the course of reasoning, neither is a determination reached after argument, and both describe the law as it stood in 2020. Since 23 March 2026 the position in a national-security investigation is different.

The following questions are not settled: whether the requirement to produce material in a form in which it is visible and legible reaches an encrypted device; whether unlocking a device is a statement for the purposes of the ordinary use-immunity provisions; and whether other decryption method in Schedule 1 s.4(2) reaches unlocking by fingerprint or face.

1 · What a street stop actually requires you to hand over

There are two stop powers, not one; their search limbs are of different width, and their triggers are of different height.

s.54(1) — acting in a suspicious manner. Police Force Ordinance (Cap. 232) s.54(1):

Read what limb (c)(i) actually authorises. It is a search "for anything that may present a danger to the police officer" — a safety search on the subsection's own words. The contents of a phone are not a danger to anyone.

s.54(2) — reasonable suspicion of an offence. The next subsection is a separate power:

The mechanism only appears when the two are read together. Subsection (2)'s search limb is much wider — "anything that is likely to be of value … to the investigation" rather than anything dangerous — but its trigger is correspondingly higher: (1) needs a person who "acts in a suspicious manner"; (2) needs a person "whom he reasonably suspects of having committed or of being about to commit or of intending to commit any offence". The wider search is bought with the higher trigger.

The one thing that must be produced in the street is a document. Immigration Ordinance (Cap. 115) s.17C(2):

And the consequence of not producing it, together with its defence, is in the same section. s.17C(3):

s.17C(4) adds a further statutory reasonable excuse where, at the date of the alleged offence, all proof of identity the defendant held had been lost or destroyed and either he had reported it to a police officer at a police station (or, for an identity card, to a registration officer) or he had had no opportunity to report it.

And Cap. 232 requires nothing else. The only thing it requires a person to produce is proof of his identity, at s.54(1)(a) and s.54(2)(a); its requirements to furnish information, in s.67, are directed at a bank or deposit-taking company; and all but one of the places the Ordinance uses require are administrative.

That silence is not an oversight, because the same Ordinance knows exactly how to compel. Section 67 is an elaborate machine for extracting information from banks: notice in writing, a power to extend time, deemed service by registered post, an offence for the institution (level 6 on indictment), a separate offence for a director or manager who consents or connives (level 5 plus one year), and a third for anyone who wilfully causes or procures the failure — with s.67(7) reserving the power to an officer not below the rank of assistant commissioner. Sections 59 to 59H do the same work for fingerprints and body samples, with their authorization, consent and magistrate's-approval requirements. So this Ordinance compels what is on a person's body and what is in an institution's records, and nothing that is in a person's memory.

That inference has a limit: it shows what the drafters did in this Ordinance. It does not show that anyone considered and rejected a passcode power.

*⚠ There is no such thing as the stop-and-search power.* In his answer of 30 October 2013 the Secretary for Security named, besides Cap. 232 s.54 and Cap. 115 s.17C, the Public Order Ordinance, the Dangerous Drugs Ordinance, the Weapons Ordinance and the Firearms and Ammunition Ordinance as further sources of stop-and-search power.

2 · Seizing a phone and searching what is inside it are two different things

A phone can be taken whether or not it is unlocked. Whether its contents can be examined is a separate question, and the answer changed on 2 April 2020.

Seizure. Cap. 232 s.50(6):

*A phone is an article or chattel within that subsection, and seizure does not depend on the device being unlocked. The subsection carries its own proviso: "nothing in this subsection shall be construed in diminution of the powers of search conferred by any particular warrant."*

The warrant route. Section 50(7) empowers a magistrate, on the oath of any person, to issue a warrant for documents, articles or chattels likely to be of value to an investigation.

And the Court of Appeal has held that this reaches a phone — it did not simply assume it. All counsel treated it as common ground that a magistrate has that power, and at ¶162 the court said why it would not simply take that at face value:

At ¶163:

It reached that by treating the digital contents as a "place" and the electronic data as "documents" within the section (¶¶164-165), and concluded at ¶166:

*Read that for what it is: a holding about a warrant to search a phone, not about anyone being made to unlock one.* The judgment records the opposite common ground on that, at ¶35, quoted in the next section.

Searching the contents — the holding of 2 April 2020. In Sham Wing Kan v Commissioner of Police [2020] HKCA 186 the Court of Appeal held, at ¶218:

The disposition. At ¶220:

Read that precisely: it is a compatibility holding about searching, not a constitutional limit on compelling.

⚠ The trap here is a date. On 15 November 2017 the Government described the Court of First Instance judgment of 27 October 2017: police officers may seize mobile phones under s.50(6), "but may examine the content of these mobile phones without obtaining a warrant only in exigent circumstances." That exigent-circumstances test stood from 27 October 2017 to 2 April 2020 — about 29 months. The Court of Appeal replaced it with the ¶218 conditions.

As for arrest itself: arrest changes what may be searched. It does not change whether a passcode can be compelled. ¶218 is about searching; the three sentences in the next section are about passcodes.

3 · What the Court of Appeal actually said — three sentences, three statuses

The same conclusion appears three times in the judgment, and the three carry different legal weight. The difference is the difference between an authority and an assumption.

The first sentence — ¶35. This is what was not in dispute between the parties, and what leading counsel for the Commissioner accepted:

Two things narrow it, and both are in the sentence itself. First, it is about a magistrate's power — and the person stopping someone in the street is not a magistrate. Second, its status is common ground and a concession by counsel, not a determination reached after argument.

The second sentence — ¶122, written by the Court in its own voice.

This sentence is stronger than the first, for three reasons. First, it is the Court's own observation — we would point out — not counsel's concession. Second, it is about the police's power, not a magistrate's. Third, *the Court's own formulation of the modality, whether alpha-numerical or biometric, appears only here. But the Court decided nothing about whether a fingerprint or a face is different from a passcode. The words appear inside an explanation of why disabling a screen lock was impractical, and the Court put both modalities in one parenthesis while making that point. That is the Court describing a device, not the Court ruling on compelled unlocking. And since 2026 the same question returns in another form: the provision in section 4 speaks of a password, or other decryption method, and whether other decryption method reaches a fingerprint or a face is not settled.*

It is still not a determination. It is an observation made in the course of reasoning about the practicalities of screen locks, not a ruling on an issue argued before the Court.

The third sentence — ¶218, and this one is the holding. It is quoted in section 2 above. It is about warrantless searches, not about passcodes.

So the central proposition of this topic appears twice in the judgment, in two different statuses, and never as a determination of an issue argued before the Court. The point was not contested — and not contested is different from decided.

⚠ These three sentences carry a date. ¶35 and ¶122 describe the law as it stood on 2 April 2020. Since 23 March 2026 the law is different for investigations into offences endangering national security — the instrument in section 4 names the password requirement, the offence and the penalty in terms. A 2020 observation that no such power then existed cannot displace a provision that came into operation in 2026. ¶218 is about the conditions for searching a phone's contents after arrest — a proposition about searching, not about compelled disclosure of a password.

⚠ Appeal history: On the public record, the appeal history of this decision is CACV 270/2017 with no further appeal listed, and the Department of Justice's National Security Law annotations, with the law stated as at 23 March 2026, continue to cite the decision.

4 · National security investigations: an express police power over passwords

*Since 23 March 2026 there has been an enacted provision that expressly allows a police officer to require a specified person to provide a password or other decryption method. It is not in any chapter of the Laws of Hong Kong. It is in a Legal Notice — which is why a search of the chapter Ordinances alone does not find it.*

What the instrument is. Its full name is the 2026 Implementation Rules for Amending the Implementation Rules for Article 43 of the Law of the People's Republic of China on Safeguarding National Security in the Hong Kong Special Administrative Region, L.N. 27 of 2026. The power it was made under is printed at the head of the text:

Its commencement is fixed by rule 1 itself. It does not rest on a power to appoint a day:

And the instrument states which text is authentic. Rule 10:

So every English passage quoted in this section is, on the instrument's own terms, a translation for reference only.

*First: a piece of electronic equipment can be a place for the purposes of Schedule 1.* The instrument repeals Schedule 1 section 2(3) and substitutes:

*The subsection splits itself into two limbs — if the place is not electronic equipment and if the place is electronic equipment.* Those are the provision's own words. Against electronic equipment the powers are to inspect, examine, search, seize and transfer anything in the equipment or accessible by means of it, and to seize, remove and detain the equipment itself.

Second: the warrant limb is in section 2(2). The instrument repeals everything after "necessary to" in section 2(2) and substitutes:

Third, and this is the centre of the topic: the new section 4.

Taken point by point.

• *Section 4(1)(b) uses the word decrypt in terms.* The power over electronic equipment includes decrypting any material stored in, or accessible by means of, the equipment.
• *Section 4(2)(a) uses the word password in terms.* A police officer may require a specified person to provide any password, or other decryption method, that is necessary.
• Section 4(2)(b) is a second limb: any other reasonable and necessary information or assistance.
• *The specified person in section 4(3) is not limited to the suspect. Besides the person under investigation, it reaches anyone the officer reasonably believes owns, possesses or controls the equipment, is authorized to access it, is using or has used it, or knows of the password or decryption method. A person who has never been suspected of any offence can be a specified person.*
• ⚠ The opening words of section 4(2) decide when the power exists at all. They are "The police officer mentioned in section 2(2) or 3(1) of this Schedule". This is therefore not a free-standing street power; it is a requirement that travels with a search authority already established under section 2(2) or section 3(1).
• ⚠ But section 2(2) and section 3(1) are not the same gate. Section 2(2) is the magistrate's warrant. Section 3(1) is the route that needs no warrant, and the amending instrument touches it in two places only — "the power" becomes "one or more of the powers", and the English text of section 3(1)(a) is reworded. Both routes can carry the section 4(2) password requirement — so not every gate is a judicial act.

Third, part two, and this is the part that matters most: section 3 — the route that needs no magistrate's warrant.

This section was not created by the amending instrument. It has been in Schedule 1 since 2020. What follows is the consolidated Schedule 1 as at 23 March 2026:

Taken point by point.

• This route has to be opened by a police officer not below the rank of Assistant Commissioner of Police. The words are "a police officer not below the rank of Assistant Commissioner of Police" — not any police officer. The powers may then be exercised by that officer, or by "another police officer authorized by the police officer".
• *The three conditions are cumulative; the provision joins them with and.* (a) reasonable ground for suspecting that there is in a certain place any specified evidence; (b) reasonable ground for believing that the evidence is necessary for one of the matters in subsection (2); and (c) that for any reason it would not be reasonably practicable to obtain a warrant.
• *Subsection (2) confines necessary to three things*: investigation of an offence endangering national security; procurement and preservation of evidence of such an offence; and protection of the safety of any persons.
• The powers this route opens are the same set as the warrant route opens — the section 2(3) set, which includes the electronic-equipment limb in section 2(3)(b)(i), and sections 4(1) and 4(2) above hang on section 2(3)(b)(i). So the password requirement can arise without a magistrate's warrant.
• *⚠ That is still not the same as any officer in the street can demand your passcode.* What the provision requires is that an officer of Assistant Commissioner rank or above be satisfied of the three conditions, and the password requirement itself still travels with a search authority already established under section 2(2) or section 3(1).

Fourth: not complying is an offence, and the same section removes two excuses. The new section 5:

Four things to notice. First, the offence is triable on indictment only, and carries a fine of $100,000 and one year. Second, section 5(2) says in terms that a tendency to incriminate is not an excuse, and neither is a duty of secrecy or any other restriction on disclosure. Third, section 5(3) gives back a reasonable excuse defence. Fourth, section 5(4) sets out how that defence is established: the defendant adduces sufficient evidence to raise the issue, and the prosecution must then disprove it beyond reasonable doubt.

Fifth: answering falsely is a separate offence. The new section 6:

A fine of $500,000 and three years — five times the fine and three times the sentence attached to the section 5 offence.

*⚠ These two amounts are not levels of fine, and they do not work like the amounts in section 6. Sections 5 and 6 state cash sums, not levels under Schedule 8 to Cap. 221, so the Cap. 221 s.113B(3) power to amend those levels has nothing to do with them. They can still be changed, and the power to change them is printed at the head of the very instrument that contains them*: it was made by the Chief Executive in conjunction with the Committee for Safeguarding National Security under the third paragraph of Article 43, and what it did was amend the previous instrument of the same kind.

Sixth: the instrument writes in a protection of its own. The new section 7:

Read subsection by subsection.

• Section 7(1) is a duty on the police officer: before the requirement bites, the officer must ensure the specified person has first been informed or reminded of the effect of subsection (2).
• Section 7(2)'s protection has a condition of sequence. The person must claim the tendency to incriminate before providing — the words are "before so providing the password, decryption method or information". A claim made afterwards does not meet the wording.
• What is protected: the requirement itself, and the password, decryption method or information provided, are not admissible in evidence against that person in criminal proceedings in a court of law.
• Section 7(3) names two classes of proceedings the protection does not reach: proceedings for an offence under section 5(1) or section 6 of the Schedule, and proceedings under Part V of the Crimes Ordinance (Cap. 200).
• ⚠ Section 7(4) is the most important subsection in the section: the limitation in subsection (2) does not apply to any material obtained by virtue of the requirement. What is protected is the password. It is not what the password opens.

Seventh: Schedule 1 gains a Part 2 about legal professional privilege. The new Part 2 (sections 8 to 19) creates a procedure for an LPP claim in the Court of First Instance of the High Court: the claim is made by originating summons supported by affidavit, the respondent is the Commissioner of Police, and copies are served on the respondent and the Secretary for Justice; sealing, unsealing, copying, a list of disputed material and a determination by the Court follow. Section 14(2) puts a duty on the claimant — the respondent may require the claimant to provide any necessary password or other decryption method, or other reasonable and necessary information or assistance.

Eighth: the same instrument also amends Schedule 7. A new section 2A creates, for requirements imposed by the Secretary for Justice under Schedule 7 section 2(5) to answer questions or furnish information, a use limitation of the same shape as section 7 above — but with one exception section 7 does not have. Under section 2A(4), if the person later gives evidence in any proceedings that is inconsistent with the answer or information, the answer or information may be used to impeach that person's credibility. The instrument also amends Schedules 2, 3, 4 and 5.

⚠ Matters still to be decided or governed elsewhere:

• No court has yet construed Schedule 1 sections 4 to 7 — including whether other decryption method reaches unlocking by fingerprint or face, what reasonable and necessary information or assistance covers, and what amounts to a reasonable excuse under section 5(3).
• Schedule 4 section 9 and Schedule 6 are separate regimes. Schedule 4 section 9 is a magistrate's warrant directed at a service provider, for an identification record or decryption assistance in respect of an electronic message; Schedule 6 is interception and covert surveillance. Neither is a demand made to the holder of the phone.

5 · The ordinary production regimes: what they compel

*The provision in section 4 operates only inside an investigation into an offence endangering national security. This section is about ordinary criminal investigation — and on that side there is no police power that names a password. What there is, is a family of production orders requiring information to be produced in a form in which it is visible and legible.*

*The provisions below expressly compel production of information or material, in a form a human eye can read. Whether they reach a locked phone is not settled.*

<table> <caption>Ordinary-investigation regimes that can compel production of machine-held information, and the gate each one carries. The Schedule 1 national-security power described in section 4 is not in this table. Sources: Interpretation and General Clauses Ordinance (Cap. 1), version in force 31 July 2026; Drug Trafficking (Recovery of Proceeds) Ordinance (Cap. 405), 19 September 2019; Organized and Serious Crimes Ordinance (Cap. 455), 19 September 2025; United Nations (Anti-Terrorism Measures) Ordinance (Cap. 575), 20 June 2019; Interception of Communications and Surveillance Ordinance (Cap. 589), 10 December 2020.</caption> <thead><tr><th>Regime</th><th>Who applies</th><th>To whom</th><th>Refusing is</th></tr></thead> <tbody> <tr><td>Cap. 455 s.3 (organized crime — requirement to furnish information or produce material)</td><td><strong>the Secretary for Justice alone</strong></td><td>Court of First Instance, <strong>ex parte</strong></td><td>an offence — level 6 and 1 year (s.3(13))</td></tr> <tr><td>Cap. 455 s.4 (organized crime — order to make material available)</td><td>the Secretary for Justice <strong>or an authorized officer</strong></td><td>Court of First Instance, <strong>ex parte</strong></td><td>an offence — level 6 and 1 year (s.4(13))</td></tr> <tr><td>Cap. 405 s.20 (drug trafficking proceeds — order to make material available)</td><td><strong>an authorized officer</strong></td><td><strong>a court</strong></td><td>not an offence; the court may issue a search warrant (s.21(2)(a))</td></tr> <tr><td>Cap. 575 s.12A (terrorism — requirement to furnish information or produce material)</td><td><strong>the Secretary for Justice alone</strong></td><td>the Court, defined as the Court of First Instance, <strong>ex parte</strong></td><td>an offence — level 6 and 1 year (s.14(7E))</td></tr> <tr><td>Cap. 589 s.29(5) (interception and covert surveillance — assistance requirement)</td><td>— (a term <strong>inside</strong> a prescribed authorization)</td><td>a judge's authorization, an executive authorization or an emergency authorization; s.29(5) <strong>excludes</strong> the executive one</td><td><strong>nothing — no sanction is prescribed</strong></td></tr> <tr><td>Cap. 1 s.84 (journalistic material — production order)</td><td>a person on whom a power to enter, search or seize is or may be conferred</td><td>a judge of the Court of First Instance or District Court, <strong>inter partes</strong></td><td>an offence — level 6 and 1 year (s.84(5))</td></tr> </tbody> </table>

Cap. 455: two sections, two different applicants. s.4(1):

But s.3(1) is not the same.

So a s.4 application may be made by an authorized officer; a s.3 application may be made only by the Secretary for Justice. And Cap. 455 s.2 defines authorized officer:

**Any police officer is the first limb. That is how a police officer gets inside this regime.**

Cap. 405: the only regime in the table an officer opens on his own application. s.20(1):

Its own s.2 definition is to the same effect — the English text is word for word the same as Cap. 455's, while the two Chinese authentic texts differ in their third limb:

And Cap. 405 does one thing none of the other four does: it describes the material by the machine it lives in, and then defines the machine. s.20(7):

s.20(8):

Every limb of that definition — automatic processing, automatic recording or storage, causing recording on other equipment, retrieval — is true of a phone on the face of the words. So the regime whose language comes closest to an ordinary person's device is the drug-trafficking one, and it is one of the two where not complying creates no statutory offence.

Cap. 575: again, the Secretary for Justice alone. s.12A(1):

*And the Court is defined*:

*Cap. 575's authorized officer definition is not identical to the other two — it has four limbs, and it opens a police officer rather than any police officer:*

Cap. 589: this is the gate that needs a qualification. s.29(5):

*And prescribed authorization is defined:*

Section 29(5) excludes only the executive authorization. It does not exclude the emergency authorization — and an emergency authorization is not issued by a judge. s.21(1):

But three limits sit around it, all of them in the text. s.22(1):

Section 22(2) provides that an emergency authorization may not be renewed. s.23(1):

In one sentence: an emergency authorization is issued inside the department by its head, lasts at most 48 hours, cannot be renewed, and must be taken to a panel judge for confirmation within 48 hours — and s.23(3) requires the immediate destruction of any information obtained if no application for confirmation is made within that period.

As to whether the police are inside this regime at all, Schedule 1 answers it:

Cap. 1 s.84: the only inter partes gate of the six, and the narrowest in subject matter. s.84(1):

s.84(4):

Two things separate this gate from the other five. First, the application is inter partes — the person asked to produce the material has an opportunity to be heard. Second, it reaches journalistic material only. Section 88(1) deals with material held in a computer:

A reader who is not a journalist is not in this regime at all.

And after each gate come limits, which are usually in the next subsection. Cap. 455 s.4(3) and Cap. 405 s.20(3) both set the order's period at 7 days unless the court thinks a longer or shorter period appropriate. Cap. 455 s.4(11)(a) and Cap. 405 s.20(9)(a) both provide that the order confers no right to items subject to legal privilege; Cap. 455 s.3(9) does the same, except that a lawyer may be required to give his client's name and address. Cap. 455 s.4(7) gives any person subject to the order the right to apply to discharge or vary it. And Cap. 405 carries one limit none of the others has — s.20(2A) provides that an order aimed at material the person has not yet come into possession of expires three months after the day it is made, or sooner if the order so specifies.

This site's reading: every regime in the table above is gated on a court order, a judge's authorization or a magistrate's warrant, and not one of them is exercisable by a police officer on a street stop.

⚠ That sentence is about the table, not about Hong Kong law, and the difference matters. The password requirement in Schedule 1 section 4(2), set out in section 4 above, attaches to section 2(2) — the magistrate's warrant — and to section 3(1), which needs no warrant: an officer not below the rank of Assistant Commissioner of Police who is satisfied of the three conditions set out in full in section 4 above may authorize it. So it cannot be said that every gate is a judicial act: on the national-security side, one of the gates is not.

*⚠ The word every stops at the table above, and it does not describe Hong Kong law as a whole. The visible and legible formula appears in other Ordinances too, and at least seven of them confer a power to require production of device-held information with no warrant, no court order and no judge at all. The clearest is the Import and Export Ordinance (Cap. 60) s.20(1), which opens "Without prejudice to the powers conferred by section 21, any member of the Customs and Excise Service and any authorized officer may, for the purposes of this Ordinance—", confers at (b) "stop, board and search any vessel, aircraft or vehicle"*, and then at (da):

No warrant, no court order, no judge, and no opportunity for anyone to be heard first. Refusing is an offence: s.26(1) makes guilty of an offence any person who "fails to comply with any requirement, direction or demand given or made by a member of the Customs and Excise Service or an authorized officer in the exercise or performance of any such power or duty", carrying a fine at level 3 and 6 months (the fine scale and its amounts are in section 6, together with the Cap. 221 s.113B(3) power to change them). The Protection of Non-Government Certificates of Origin Ordinance (Cap. 324) s.10, the Weapons of Mass Destruction (Control of Provision of Services) Ordinance (Cap. 526) s.5 and the Chemical Weapons (Convention) Ordinance (Cap. 578) s.14 are the same drafting machine (Cap. 324 ss.10(2) and (2A) reserve domestic premises to a magistrate's warrant; nothing else is reserved); and the Competition Ordinance (Cap. 619) s.41, Cap. 626 s.21 and Cap. 634 s.73 impose the same requirement by written notice from a Commission or an investigator, again with no judicial gate.

⚠ And within those seven there is a distinction that is easy to miss. It cannot be said that not one of those seven is a police power, and Caps 324, 526 and 578 cannot be grouped together as the same Customs family. Cap. 60 and Cap. 324 are indeed Customs-only — Cap. 60 s.2 defines authorized officer as "a person authorized by the Commissioner under section 4"; a police officer is not the holder of any power under Cap. 60, and Cap. 324 s.2 likewise defines an authorized officer as an officer of the Customs and Excise Department. Cap. 526 and Cap. 578 are not.

Weapons of Mass Destruction (Control of Provision of Services) Ordinance (Cap. 526) s.3:

Chemical Weapons (Convention) Ordinance (Cap. 578) s.3:

*Both name any police officer of the rank of inspector or above in terms. So the powers in Cap. 526 s.5 and Cap. 578 s.14 to require computer-held information to be produced in visible and legible form can be exercised by a police officer holding the Commissioner's written authorization; Cap. 578 s.3(c) additionally names officers of the Explosive Ordnance Disposal Bureau. And Cap. 526 s.11(1)(b) makes non-compliance with such a requirement an offence:*

These are narrow, permit-based specialist regimes, not a general power over anybody's phone. And whether visible and legible reaches an encrypted device is, here too, not settled.

6 · What not complying costs, provision by provision

There is no single answer to what not complying costs. Each provision writes its own consequence, and they differ sharply.

*⚠ No single sentence covers these penalties — failing to comply with the production orders below carries level 6 plus one year would be inaccurate. Level 6 plus one year applies to Cap. 455 ss.3(13) and 4(13), Cap. 575 s.14(7E) and Cap. 1 s.84(5) — and to none of the others. And the national-security provision in section 4 is different again: its penalties are cash sums, not levels.*

Shape one — an offence. Cap. 455 s.4(13):

Cap. 455 s.3(13):

Cap. 575 s.14(7E):

Cap. 1 s.84(5):

Shape two — no prescribed sanction at all. Cap. 589 creates no offence of failing to comply with an assistance requirement and prescribes no sanction for it.

Cap. 405 s.20 — the section creates no non-compliance offence of its own, and the consequence is in the next section. The neighbouring chapter's identical machinery does create an express offence, at Cap. 455 s.4(13). What happens instead is in the next section, s.21(2):

⚠ Note. Cap. 405 ss.20 and 21 create no statutory non-compliance offence, and that s.21(2)(a) makes non-compliance a ground on which the court may issue a search warrant. That is not the same as saying that disobeying the order has no consequence at all — an order under s.20 remains an order of a court, and contempt of court is a matter of the general law and of court procedure. Whether contempt applies depends on the case.

The consequences do not track the gravity of the investigation. The interception and covert-surveillance regime attaches no stated sanction at all; the drug-trafficking regime creates no statutory offence either, and produces a search warrant instead; organised crime, terrorism and journalistic material each attach level 6 plus one year. And the heaviest consequence is not in that table at all: under the national-security provision in section 4, not complying is an offence triable on indictment only, carrying $100,000 and one year, and providing materially false or misleading information carries $500,000 and three years.

And what a level is worth lives in another Ordinance, next to a power to change it. Criminal Procedure Ordinance (Cap. 221) s.113B:

Schedule 8:

So level 6 is $100,000 and level 2 is $5,000. But read s.113B(3): those amounts can be moved. The Chief Executive in Council may by regulation amend the amounts in Schedule 8 to reflect his opinion of the effect of inflation.

⚠ Adverse inference. Whether any adverse inference may be drawn from refusing to unlock a device is not settled.

7 · Being unable to refuse on the ground of self-incrimination, and what you say not being usable against you, are two different rules

They sit in adjacent subsections of one Ordinance, they point in opposite directions, and they are often conflated. And the three Ordinances are not drafted alike.

Cap. 455 removes the excuse twice. s.4(12):

s.3(11):

But the same Ordinance gives protection back in only one place. s.3(12):

That is a use immunity: the statement must still be made, but once made it may not be used against the maker in criminal proceedings, save in the two stated situations.

*Note the boundary the subsection draws for itself: s.3(12) is written over this section — that is, s.3.*

And Cap. 575 is drafted differently. s.12A(9):

That subsection removes the secrecy excuse and says nothing about self-incrimination. And s.12A(10)'s use immunity is narrower than Cap. 455 s.3(12) — it has no credibility-impeachment limb:

Cap. 405 s.20 has neither limb: it neither removes the self-incrimination excuse nor supplies any immunity.

In other words, these regimes are one drafting family, copied from chapter to chapter with variations. They are not one rule — a rule read in one Ordinance cannot be carried across to another.

And the national-security provision in section 4 is a third drafting pattern, unlike either of these. Schedule 1 s.5(2) removes both excuses — a tendency to incriminate, and secrecy — which is close to Cap. 455 ss.3(11) and 4(12). But on the protective side, Schedule 1 s.7 is far more detailed than Cap. 455 s.3(12), and it points in a different direction: it adds a duty on the officer to inform or remind first (s.7(1)), a condition of sequence — the claim must be made before providing (s.7(2)(c)) — and it states the outer edge of the protection in terms: by s.7(4) the limitation does not apply to material obtained by virtue of the requirement. Neither Cap. 455 s.3(12) nor Cap. 575 s.12A(10) contains any such sentence.

⚠ And this section raises one further question. The immunities in Cap. 455 s.3(12) and Cap. 575 s.12A(10) operate on a statement. Whether a passcode spoken aloud, typed, or supplied by placing a finger on a sensor is a statement for that purpose — is not settled. But note what it does not touch: section 4. Schedule 1 s.4(2) is not drafted around a statement at all — it names any password, or other decryption method, so the provision itself identifies the thing to be handed over and that problem of construction does not arise on that side.

8 · How Hong Kong legislation writes "password" and "phone" — not in the reader's words

Hong Kong legislation does not draft this concept in the words a reader would use, although it does use the word password.

English legislation does not use words such as passcode or encryption key. Hong Kong expresses the concept as visible and legible, otherwise than in legible form and data equipment; the Chinese texts write it as 可以看到及可以閱讀 and 數據設備.

And the Chinese text does not use the reader's word either. The statute book writes 流動電話 and 手提電話, not 手機 or 智能電話.

But the word password does appear in Hong Kong legislation. 密碼 appears in a number of Chinese chapters and password in English ones. They are not all the thing on your phone: the Chinese word also covers cryptography — for example Cap. 60G (cipher equipment on the strategic-commodities control list) and Cap. 553 (the Electronic Transactions Ordinance's public key, 公開密碼匙).

The two chapters most relevant here are Cap. 486 — one occurrence, inside the definition of access, which "includes— (a) access that is subject to a pre-condition (including the use of a password)", a definition and not a power — and the Unsolicited Electronic Messages Ordinance (Cap. 593), which does contain an express power to require a password. Section 36(1) lets the Communications Authority, where satisfied that there are reasonable grounds for believing a person holds "information (including but not limited to passwords) or a document" relevant to its investigation, serve a written notice requiring it; s.36(3) then lets a magistrate order compliance on the Authority's application; and s.36(8) makes it an offence, without reasonable excuse, to fail to comply with the order, carrying a fine at level 5 and imprisonment for 2 years. Section 40(2)(b) is a second limb, exercisable in a search — "require to be given or produced to the Authority or authorized officer any information (including but not limited to passwords)" — gated on the magistrate's search warrant under s.41(1), with the offence at s.42(1)(b).

Why is Cap. 593 not one of the regimes in section 5? Because it is not a police power — it is held by the Communications Authority and its authorized officers, and section 5 sets out the regimes a police officer can travel through.

Why is it drafted that way? Because this is a form-of-record concept, not a secrecy concept. The formula was written to reach material that exists but cannot be read off its medium — microfilm, tape, computer print-out. Encryption is caught, if at all, only because encrypted text is also unreadable.

*⚠ Whether the requirement to produce material in a form in which it is visible and legible reaches an encrypted device is not settled.*

9 · Which compulsory-production powers are not the police's — and which can be

Several compulsory-production powers — one of them an express power to decrypt — do not belong to the police. And two specialist Ordinances expressly allow a police officer to be authorized to exercise them. This section puts both sides on the page.

The power is in the Personal Data (Privacy) Ordinance (Cap. 486) s.66G, and its normal form is a magistrate's warrant. s.66G(1):

And the powers the warrant carries include an express power to decrypt. *(It is not the only express power to decrypt in the statute book: Schedule 1 section 4(1)(b), set out in section 4, uses the word decrypt in terms and has been in operation since 23 March 2026.)* s.66G(3):

Section 66G(8) is genuinely warrantless:

But read its closing words. What s.66G(8) authorises is one thing — to access the device. The rest of s.66G(3) — seize and detain, decrypt, search, reproduce in visible and legible form, reduce to writing, copy and take away — stays behind the warrant.

And the assistance duty travels with the warrant, not with the warrantless limb. s.66G(6):

*It opens When powers are exercised under the warrant. But specified person* is not a loose phrase: the same section defines it at subsection (11), and s.66G(6) cannot be read without it.

*So for an electronic device the assistance duty in s.66G(6) falls on "a person in possession or control of the device" — the phone's holder. The subsection does not use the word passcode, and it does not in terms require anyone to speak, to type or to place a finger anywhere; but the facilities and assistance it requires are for the purposes of powers that include s.66G(3)(c), "to decrypt any material stored in the device"*. Whether that duty reaches a passcode is not settled.

Two further subsections. s.66G(9):

That preserves common-law powers over a device for a person who has made an arrest — so s.66G takes nothing away from what section 2 describes.

*And s.66I creates an offence that runs across any power exercised under s.66G.* s.66I(1):

s.66I(2) sets that offence at a fine at level 3 and 6 months, and s.66I(3) puts the burden of establishing a lawful excuse on the person while providing that it is taken to be established where there is sufficient evidence to raise the issue and the prosecution does not disprove it beyond reasonable doubt. Whether declining to unlock could amount to obstructing, hindering or resisting is arguable; the point is not settled.

And, decisively, it is not a police power. Cap. 486 s.2:

The holder is the Privacy Commissioner for Personal Data, or the Commissioner's own staff employed or engaged under s.9(1). A police officer appears only inside a parenthesis in s.66G(1): the warrant may authorise the Commissioner or a prescribed officer "together with any person (whether or not a police officer) who may be necessary to assist the Commissioner or the prescribed officer so authorized", to exercise the powers referred to in s.66G(2) or (3). And the whole section applies only to the offences it lists.

⚠ The complete picture has four sides: (i) Cap. 486 s.66G — an express power to decrypt, held by the Privacy Commissioner for Personal Data, not by the police; (ii) Cap. 593 ss.36 and 40(2)(b) — an express power naming passwords, held by the Communications Authority, not by the police (section 8); (iii) Cap. 526 s.3 and Cap. 578 s.3 — which expressly let the Commissioner of Customs and Excise authorize in writing any police officer of the rank of inspector or above to exercise those Ordinances' authorized-officer powers, including the requirement to produce computer-held information in visible and legible form (section 5); and (iv) Schedule 1 s.4(2), in section 4 — which names both the password and the police officer in terms, inside investigations of offences endangering national security.

So the edge of section 5's set is here. *What s.66G(8) authorises without a warrant is one thing — to access the device — and that limb requires nobody to speak, to type or to place a finger anywhere. But s.66G(6) is not confined to the device: its duty falls on the person in possession or control of it, and the powers it supports include decryption. So: the power exists; its warrantless limb reaches only as far as accessing the device; its warrant limb puts a duty of facilities and assistance on the device's holder, with no mention of a passcode in the text; and throughout, the power belongs to the privacy regulator and not to the police.*

10 · The rule in England and Wales is not the Hong Kong rule

England and Wales has an express compelled-disclosure regime and failing to comply with it is a criminal offence. Hong Kong has one too, but of a different shape: it operates only inside an investigation into an offence endangering national security.

Part III of the Regulation of Investigatory Powers Act 2000 is headed "Part III Investigation of electronic data protected by encryption etc. — Power to require disclosure — Notices requiring disclosure.", and s.49 within it is a notice requiring disclosure. The Act's long title names among its purposes "the acquisition of the means by which electronic data protected by encryption or passwords may be decrypted or accessed;". And s.53(1):

In Hong Kong, outside a national-security investigation, no chapter Ordinance confers a corresponding power on a police officer.

⚠ The easiest way to get this comparison wrong is to state it as two sides. England and Wales has a refusal offence while Hong Kong has no corresponding instrument held by a police officer is not correct, because the provision in section 4 has been in operation since 23 March 2026.

The accurate comparison has three sides, not two.

• England and Wales: Part III of the Regulation of Investigatory Powers Act 2000, a general disclosure-notice regime not confined to national security, with the offence at s.53(1).
• Hong Kong, investigations into offences endangering national security: the password requirement in Schedule 1 s.4(2), the offence in s.5(1) (indictment only, $100,000 and one year), the false-information offence in s.6 ($500,000 and three years), and the use limitation in s.7. The power names police officers in terms, but it travels with a search authority under Schedule 1 s.2(2) or s.3(1); it is not a free-standing demand that can be made in the street. ⚠ Note, though, that the s.3(1) route needs no magistrate's warrant — see section 4.
• Hong Kong, every other criminal investigation: no chapter Ordinance confers a corresponding power on a police officer naming a password. One further express power naming passwords belongs to the Communications Authority (Cap. 593 ss.36 and 40(2)(b), section 8); its difference from a s.49 notice is where the gate sits — a Cap. 593 s.36 notice must first be turned into a magistrate's order under s.36(3) before the s.36(8) offence attaches to it.

11 · Is the law about to change? It already did

It already changed, in the first half of 2026. On 23 March 2026 L.N. 27 of 2026 came into operation, creating an express requirement to provide a password or other decryption method in investigations into offences endangering national security, together with the offences, the defence and the use limitation — all of which are set out in section 4. What the rest of this section is about is the prospect of change on the ordinary criminal side, and there the answer as at January 2026 was that no such recommendation had been made.

The Court of Appeal decided the case on 2 April 2020.

*Fourteen months later the Security Bureau formally closed the follow-up to the Law Reform Commission's Arrest report of November 1992. Its June 2021 entry records that the Bureau, with its law enforcement agencies, had thoroughly considered the recommendations, that most endorsed recommendations were already implemented, and that it had "concluded that all necessary actions have been completed and no further legislative amendments are required."*

And the Law Reform Commission's January 2026 report on cyber-dependent crimes recommends no compelled-decryption or compelled-passcode power. Where it mentions passwords, it deals with hacking or misuse-of-device offences or consultation responses — none is a power to require a password.

But the Government's response of the same month says the report is only the first part. It records that the report "represents the first part of the study on cybercrime", that the Sub-Committee is concurrently researching other aspects including cyber-enabled crimes, evidentiary and enforcement issues, and that the Government will study the contents "aiming to formulate more comprehensive legislation".

So: on the ordinary criminal side, no such recommendation had been made as at January 2026; on the national-security side, the law changed on 23 March 2026. Further legislation remains possible. Two developments to watch: the publication of the Sub-Committee's next report, and any further amendment of the Implementation Rules for Article 43 — or the first decision construing Schedule 1 sections 4 to 7.

12 · Official figures

There is no official figure for how often this happens. The Government stated in writing that the law enforcement agencies do not maintain it.

16 December 2015 — the Government declined to answer this class of question. Its reply reads: "The Court is now handling a judicial review case which is related to the Police's exercise of the powers conferred by the above provision." It goes on: "Since the judicial review case has already entered legal proceedings, it is not appropriate for the Government to comment on the matters raised by the question at this stage." That judicial review is the very case that later produced ¶122.

15 November 2017 — a Member of the Legislative Council put the practice directly, stating that it had been reported that the Police seized arrested persons' electronic devices "and even demanded them, in a coercive manner, to provide passcodes or finger prints for unlocking those devices". This is a Member's statement, not the Government's; the answer neither adopted nor denied it.

The same day — the answer: "The law enforcement agencies do not maintain the figures sought in the question."

The Police General Orders published to the public do not deal with requiring passcodes or unlocking electronic devices. *Chapter 44 is the chapter titled Search of Persons, Premises and Vehicles, and its only password content regulates a terminal operator's own login credentials:*

⚠ But the published chapters are only part of the Police General Orders, and Chapter 44's own text cross-refers to a Force Procedures Manual that is not published.

⚠ The only published figure of scale counts stop actions, not phones. On 30 October 2013 the Government stated that from 2008 to 2012 the police conducted an annual average of around 2 170 000 stop and question and stop and search actions, that more than 22 500 offences were detected each year on average by way of such actions, and that those offences accounted for a yearly average of 24.8% of the total number of offences detected. Those are stop actions. They are not device seizures and not passcode demands — the answer of November 2017 states that figures about phones are not maintained.