THE 2026 AMENDMENTS
On 23 March 2026, amendments to the Implementation Rules for Article 43 of the Hong Kong National Security Law came into operation. They introduced an express power for police, when exercising a lawfully authorised search of electronic equipment in a national-security investigation, to require a specified person to provide a password, decryption method or other reasonably necessary assistance.
WHEN THE POWER APPLIES
Not a general power to demand passwords at random
The power forms part of the special investigative framework for offences endangering national security. According to the Government’s explanation of the amended Schedule 1:
- Police must ordinarily have reasonable grounds to suspect that the electronic equipment may contain evidence of a national-security offence.
- A warrant and a magistrate’s authorisation are ordinarily required before the equipment may be searched. The rules also preserve an urgent exception where there is no reasonable time to obtain a warrant.
- A password or decryption requirement may be made only after police are legally authorised to exercise the search power over the equipment.
- The requirement may be directed to a “specified person”, including a person under investigation, or a person who owns, possesses or controls the equipment and is capable of providing the necessary access or assistance.
The Government has therefore stated that the amendments do not create a power for officers to stop ordinary members of the public in the street and demand access to their phones without the underlying legal conditions being met.
OFFENCES AND PENALTIES
Non-compliance, false information and reasonable excuse
A person who, without reasonable excuse, fails to comply with a lawful decryption requirement may be fined up to HK$100,000 and imprisoned for up to 12 months. A person who knowingly or recklessly provides false or misleading information may be fined up to HK$500,000 and imprisoned for up to three years.
Whether a person has a reasonable excuse is assessed from the circumstances of the particular case. The Secretary for Security gave the example that genuinely forgetting the password to a device last used years earlier might be reasonable, while claiming not to remember immediately after using the device may not be.
The rules are confined to national-security investigations and should not be treated as a blanket statement of police powers in ordinary criminal cases. Anyone receiving a password or decryption requirement should obtain legal advice promptly about the authority relied upon, the scope of the requirement and the available response. See also our article Can the Police Look at Your Phone?.