The recent High Court decision of Cheung Ka Ho Cyril v Securities and Futures Commission and another [2020] HKCFI 270 confirmed the powers of the Securities and Futures Commission (SFC) to (i) seize digital devices such as smart phones and tablets in the course of executing a search warrant, and (ii) demand passwords to the seized digital devices and email accounts.
This is an important decision given the vast amount of communications that are conducted, and data that is held, electronically through smart phones, tablets and other digital devices. The decision confirmed that electronic devices are "records or documents" and subject to search warrants pursuant to section 191 of the Securities and Futures Ordinance (SFO). In addition, the decision confirmed that the SFC is empowered by section 183 of the SFO to require the recipients of section 183 notices to provide means of access to the electronic devices, including login names and passwords. The Court was not inhibited from drawing this conclusion despite the absence of express statutory provision within the SFO.
Cheung v SFC is the decision for the combined hearing of five judicial review applications of a number of search warrants obtained by the SFC as part of its investigations into a suspected breach of the SFO concerning listing and bond placements. In the course of execution of the searches, the SFC seized the applicants' digital devices including smart phones with SIM cards, tablets, notebooks, and custom-built computers. In one case the SFC seized eight mobile phones from one applicant. The SFC also issued section 183 notices to require the applicants to provide the login names and/or passwords to the digital devices as well as their email accounts.
The court considered the following questions. The answers to these questions were all "no":
- whether the decisions of the SFC to seize various digital devices belonging to the applicants in the course of execution of the search warrants and thereafter to retain them were ultra vires of the SFO or the search warrants, unlawful and/or unconstitutional;
- whether the decisions of the SFC to issue section 183 notices requiring the applicants to provide to the SFC the passwords to their email accounts or digital devices were ultra vires of the SFO or the search warrants, unlawful and/or unconstitutional; and
- whether the search warrants were unlawful and invalid for want of specificity.
Seizure of digital devices
Section 191 SFO empowers a magistrate to issue a warrant to search and seize any "records or documents" related to a suspected offence under the SFO. The court was of the view that the words "records or documents" are given a very wide meaning under the SFO, and are not confined to records or documents in paper or other traditional forms. In order to effectively discharge its investigative functions, it is essential that the SFC has the power to seize and retain digital devices containing relevant evidence.
The applicants argued that the immense storage capacity of a mobile phone and the fact that a mobile phone may contain a huge amount of personal and private information meant that any statutory provision which purportedly authorises a mobile phone to be seized would constitute a very significant intrusion on privacy, and thus the provision must be construed narrowly. To this argument the court decided that the right to privacy is not absolute, and that the right to privacy may lawfully be restricted provided that the proportionality test is satisfied. The court was of the view that in the factual circumstances of the five cases considered the proportionality test was satisfied.
Section 183 notices demanding login names and passwords
The court also considered that the SFC is empowered, under section183(1) of the SFO, to have required the applicants to provide means of access to email accounts and digital devices which contain, or are likely to contain, information relevant to the SFC's investigations, including by demanding the login names and passwords to the devices and email accounts. The court considered that in order to effectively discharge the SFC's investigative functions, it is essential that the SFC has access to the seized devices.
As a way to put in place fair protection of the applicants' rights to privacy, the SFC stated that it was amenable to using keyword searches to identify relevant materials contained in or accessible through the digital devices, and/or viewing the contents together with the applicants in order to minimise the chance of their personal or other irrelevant information being viewed by SFC officers, and that any dispute on relevance could be brought to the court for challenge. The court took this proposed arrangement into account in considering that a fair balance of protection of the rights to privacy has been achieved.
The specificity of search warrants
The applicants also challenged the search warrants for want of specificity. The court was of the view that what needs to be set out in a search warrant is determined by reference to the terms of the empowering statute, namely section 191(1) SFO. The court considered that there is nothing in section 191(1) of the SFO which requires a warrant issued under that section to state the relevant offence or misconduct in respect of which the warrant was applied for and granted.
Further, the court did not consider that further particulars of the offences or misconduct are required to be set out in the warrant because at the investigative stage precise information may not be known, and it may be impracticable to be specific about the offences or misconduct, and also because of statutory secrecy considerations.
SFC's arrangement to deal with assertion of Legal Professional Privilege
In the case of an applicant asserting legal professional privilege (LPP) over contents of the digital devices, the SFC had suggested that the relevant emails and attachments could be printed out and kept under seal pending resolution of the LPP claim. The SFC's proposal was rejected by the applicant. In the circumstances, the SFC seized the digital devices belonging to the applicants. The court was of the view that the SFC had no reasonable or practicable alternative but to seize the digital devices in such circumstances.
Conclusion
The Court's unqualified rejection of the applicants' challenge demonstrates its clear support of the need to ensure that the SFC's investigative powers are not hindered by modern forms of communication and data sources. While of no surprise in itself, those subject to investigation now have clear guidance that personal electronic devices are within scope of the SFC's powers, and full access must be given to the SFC upon demand. Concerns as regards invasion of privacy may be best handled by liaising with SFC on the ground as to an appropriate way forward rather than relying on the court to intervene.
Originally published on March 2020
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
