April 01, 2020

Hong Kong Court Confirms SFC's Power to Seize Digital Devices and Require Provision of Passwords

Share

Introduction

In recent judicial review applications commenced by five individuals (Applicants) (Cheung Ka Ho Cyril v Securities and Futures Commission and Another [2020] HKCFI 270), the Court of First Instance confirmed for the first time that the Securities & Futures Commission (SFC) has the power to (a) seize digital devices such as mobile phones, computers and tablets when executing search warrants and retain them subsequently; and (b) issue notices pursuant to section 183 of the Securities and Futures Ordinance (SFO) to require provision of login names and passwords to email accounts and digital devices. 

Background

The judicial review applications arose from the SFC's investigations concerning Aeso Holdings Ltd and its listing in January 2017; and bond placements by Skyfame Realty (Holdings) Ltd and China Agri-Products Exchange Ltd in 2014 to 2017. In a joint operation on 5 July 2018, during the execution of search warrants, the SFC seized the Applicants' mobile phones, computers and a tablet. On the same day,  it issued notices under section 183 of the SFO requiring the Applicants to produce emails in a specified email account and also provide the login names and passwords to email accounts and the digital devices (Section 183 Notices). 

The Applicants applied to the Court to challenge the search warrants and the SFC's decisions to seize and retain digital devices and to issue the Section 183 Notices.

The Applicants' Arguments

The Applicants argued that digital devices were not “records” or “documents” which might be required to be produced under Part VIII of the SFO (which provides for the SFC's power to conduct investigations) and any provision authorising the Commission  to require production of digital devices without a search warrant would be unconstitutional. They also argued the SFC did not have reasonable cause to believe the digital devices may be required to be produced pursuant to Part VIII of the SFO, as required by the terms of the search warrants, and therefore the seizure of the digital devices was unauthorised. The Applicants went on to  contend that the seizure of the digital devices disproportionately interfered with the Applicants' right to privacy. 

As for the Section 183 Notices, the Applicants complained that they were required to produce vast amount of materials which were irrelevant to the SFC's investigations, causing a disproportionate restriction of the right to privacy. They also argued that the SFC had no power to access the email accounts or the mobile devices. 

Finally, the Applicants argued that the search warrants lacked specificity and therefore they were unlawful or invalid.

Challenge to Seizure and Retention of Digital Devices

The Honourable Mr Justice Chow, who heard the judicial review applications, rejected all of the Applicant s’ arguments. On the issue of seizure and retention of digital devices,  the judge held that “records” and “documents” are given very wide meanings in the SFO, and having regard to the way or manner in which information and data are nowadays being created, transmitted, kept and stored by digital devices in all aspects of activities, "it would… be wholly out of touch with reality" to read the relevant provisions of the SFO as excluding digital devices. He also said that in order for the SFC to effectively discharge its investigative functions, it is essential that the SFC has the power to seize and retain digital devices containing evidence. 

As for the argument that the SFC did not have reasonable cause to believe the digital devices might be required to be produced, in view of the interpretation of the words "records" and "documents" as well as taking into account the facts and circumstances of the case, the judge was satisfied that the SFC had reasonable cause to believe the digital devices contained, or were likely to contain information relevant to the SFC's investigations.

On the argument that the seizure of the digital devices disproportionately interfered with the right to privacy, the judge held that the right to privacy is not absolute. Applying the proportionality test laid down in Hysan Development Co Ltd v Town Planning Board, the judge took the view that (a) the seizures of the digital devices were rationally connected to the pursuit of the SFC’s investigations; (b) during the search operation, the SFC’s officers would, where possible, first carry out a preliminary examination of the digital devices using keyword searches to check for relevant materials. Thus, the interference with the Applicants’ privacy occasioned by the seizure of the digital devices was no more than reasonably necessary in the circumstances; and (c) there was a fair balance of the competing interests in this case as the SFC was amenable to using keyword searches to identify relevant materials contained in or accessible through the digital devices and/or viewing the contents together with the Applicants so as to minimise the chance of the SFC’s officers viewing  their personal but irrelevant information. Accordingly, the Judge was of the view that the interference with the Applicants’ right to privacy resulting from the SFC’s seizure of the digital devices satisfied the proportionality test. Hence, it was lawful and constitutional.

In relation to the challenge to the SFC’s decision to retain the digital devices, having regard to (a) the SFC’s investigations were ongoing; (b) the SFC had not fully reviewed the materials contained in or accessible in the digital devices; and (c) the digital devices contain/may contain relevant information or materials which would be required for future proceedings, the Judge held that the Applicants could not complain about  the continued retention of the digital devices when the seizure was lawful in the first place.

Challenge to Notices Requiring Disclosure of Passwords etc.

As for the challenge to the Section 183 Notices, the judge referred to several case authorities deciding that where a warrant authorises the seizure of a particular document, the officer empowered by the warrant is lawfully entitled to seize the whole file containing the document or the whole computer hard disk, without having to separate the individual sheets or computer files. The judge also considered the practical reality that information, documents and records are nowadays mostly kept in digital or electronic form and stored in email accounts and digital devices. Such email accounts and digital devices are often password-protected and almost inevitably contain large amounts of personal or private but irrelevant materials. 

The judge also applied the proportionality test referred to above to the SFC's decision to issue the Section 183 Notices requiring the Applicants to provide means of access to email accounts or digital devices.  As the SFC was amenable to judicial oversight should there be any dispute on the issue of relevance and the safeguards to protect against disclosure of personal but irrelevant information referred to above, the judge considered the proportionality test was satisfied and rejected the challenges to the Section 183 Notices.

Challenge on Lack of Specificity in Search Warrants

Finally, on the challenge that the search warrants lacked specificity, the judge held that a warrant may be issued under section 191(1) of the SFO if the magistrate is satisfied there are reasonable grounds to suspect there is, or likely to be records or documents on specified premises which may be required to be produced under Part VIII of the SFO. The provision in section 191(1) of the SFO does not require a warrant to state the relevant offence or misconduct. The Judge also considered that the practice of stating broadly defined classes or categories of documents in search warrants is not unlawful or unconstitutional. 

Implications

In this day and age a significant amount of information is stored digitally. Such information and documents may also be stored in computer servers located overseas, e.g. emails and documents saved in cloud storage. The confirmation of the Court of First Instance that the SFC has the power to obtain digital devices and login information (subject to safeguards to limit the possibility of disclosure of personal but irrelevant information) will greatly assist the SFC in gathering information that is relevant to its investigations. It may also provide a possible short-cut to the SFC in obtaining evidence which is saved in locked devices or in computer servers located overseas.

Finally, while the Judge did not address whether the SFC may require production of digital devices pursuant to notices issued under Part VIII, SFO without a search warrant, in light of this case, one could  argue that the SFC does have such power. It will be interesting to see if in future the SFC relies on its power under sections 179 and 183, SFO to require production of digital devices without having to apply for a search warrant.

Stay Up To Date With Our Insights

See how we use a multidisciplinary, integrated approach to meet our clients' needs.
Subscribe