The short answer is no – you do not automatically have to give the police your phone PIN simply because an officer asks for it. However, the situation is different if the police serve a formal notice under Section 49 of the Regulation of Investigatory Powers Act 2000 (RIPA). If such a notice is lawfully issued, failing to comply within the specified timeframe without lawful excuse can itself amount to a criminal offence.
The Difference Between a Request and a Legal Requirement
It is not uncommon for investigating officers to ask for the PIN or password to a phone or other digital device whilst a person is in custody following an arrest. In some cases, they may even provide an official typed document requesting the PIN number and warning about potential prosecution. Although this can sound alarming, at this stage it is often effectively a request and does not automatically create a legal obligation to disclose the password.
The position only changes if investigators have obtained formal approval from a judge and serve a notice under Section 49 of the Regulation of Investigatory Powers Act 2000 (RIPA). Legal advice is therefore crucial in understanding the document you have been given and the implications of the request.
Common Investigative Scenarios
In many investigations, the potential evidence stored on a mobile phone or other digital device forms a central part of the prosecution case. For example, in indecent images of children allegations or sexual communication with a child investigations, police may initially receive a referral from an online platform or service provider. The information available to investigators may be limited to an IP address or other basic digital evidence, making the examination of digital devices essential.
Mobile phone communications are also frequently central in allegations such as rape, where messages, photographs or other communications between individuals may form part of the evidence examined during an investigation.
Digital communications can also become relevant in cases involving alleged harassment or malicious communications, where messages sent through apps, text messages or social media platforms are said to form part of the alleged offending behaviour.
What Is a Section 49 RIPA Notice?
A Section 49 notice is a formal legal document requiring a person to provide access to protected information by disclosing a password or encryption key. Before such a notice can be issued, investigators must obtain authorisation through the statutory process set out in the legislation, which includes judicial approval by a judge or district judge. This means the power cannot simply be used informally by an officer during an investigation.
The notice must normally be given in writing and will specify the protected information or device involved, the authority under which the notice is issued, and the timeframe within which the information must be provided. Because the legal consequences can be serious, anyone served with such a notice should seek legal advice as soon as possible.
Can the Police Obtain a RIPA Notice in Every Case?
No. A Section 49 notice can only be issued where investigators believe on reasonable grounds that the person has possession of the relevant password or encryption key and that requiring disclosure is necessary and proportionate for the purposes of the investigation.
Can a Section 49 Notice Be Challenged?
In some circumstances it may be possible to challenge the lawfulness of a notice, for example if the statutory requirements have not been met or if the person served with the notice does not possess the relevant key or password. Legal advice should always be obtained before responding.
What Happens if Someone Does Not Provide the PIN?
If a valid Section 49 notice has been served and a person fails to provide the information without lawful excuse, they may be prosecuted for a separate criminal offence.
Where a person knows the password or encryption key but refuses to disclose it, the offence carries a maximum sentence of two years’ imprisonment, or five years’ imprisonment in cases involving national security or indecent images of children. The decision about whether to disclose the PIN can therefore sometimes involve fine judgments about the seriousness of the material on the device and the likelihood of the matter being prosecuted.
Are there any defences?
A person may have a defence if they genuinely do not possess the key or PIN required by the notice. The legislation provides that a person will be treated as not being in possession of the key if: “sufficient evidence of that fact is adduced to raise an issue with respect to it and the contrary is not proved beyond a reasonable doubt”.
In practical terms, this means that if a person raises credible evidence that they do not know the password or encryption key, the prosecution must prove beyond reasonable doubt that they did in fact possess it.
How We Can Help
Decisions about whether to disclose passwords or provide access to digital devices can have significant legal consequences. If the police have asked for a PIN, password or encryption key, it is sensible to obtain legal advice before responding.
We regularly advise individuals in situations where police are seeking access to phones, computers and other digital devices. We can help clarify whether the request has any legal effect, whether a formal Section 49 notice has been served, and advise you on the best course of action for your situation.
If you would like to discuss any aspect of your case, please contact us through our contact page here. Alternatively you can phone 0333 240 7373, or email us at [email protected]. Reeds Solicitors is an award winning and leading top-tier criminal defence firm.