Printable rights card

You must — refusing is a criminal offence

• Once a section 49 RIPA notice has been given to you, comply with it: a person to whom a section 49 notice has been given is guilty of an offence if he knowingly fails, in accordance with the notice, to make the disclosure required.

  Source: Regulation of Investigatory Powers Act 2000, s.53(1) (legislation.gov.uk, checked 2026-09-08)

• If you are questioned under Schedule 7 (paragraph 2 or 3), give the examining officer any information in your possession which the officer requests.

  Source: Terrorism Act 2000, Sch.7 para 5(a) (legislation.gov.uk, checked 2026-09-08)

• The Schedule 7 Code of Practice says the person must provide access to any electronic device to allow for a search to be undertaken, including where access requires them to unlock it through application of their thumb or finger, or any other form of access control.

  Source: Schedule 7 (Terrorism Act 2000) Code of Practice (Oct 2025), para 61 (assets.publishing.service.gov.uk, checked 2026-09-08)

• A person commits an offence if he wilfully fails to comply with a duty imposed under or by virtue of Schedule 7, wilfully contravenes a prohibition imposed under or by virtue of that Schedule, or wilfully obstructs, or seeks to frustrate, a search or examination under or by virtue of that Schedule.

  Source: Terrorism Act 2000, Sch.7 para 18(1) (legislation.gov.uk, checked 2026-10-04)

• A person guilty of an offence under paragraph 18 of Schedule 7 is liable on summary conviction to imprisonment for a term not exceeding three months, a fine not exceeding level 4 on the standard scale, or both.

  Source: Terrorism Act 2000, Sch.7 para 18(2) (legislation.gov.uk, checked 2026-10-04)

• A person guilty of an offence under s.53 of RIPA is liable on conviction on indictment to imprisonment for a term not exceeding “the appropriate maximum term” or to a fine, or to both, where s.53(5A) defines “the appropriate maximum term” as five years in a national security case or a child indecency case and two years in any other case; on summary conviction the person is liable to imprisonment for a term not exceeding six months or to a fine not exceeding the statutory maximum, or to both.

  Source: Regulation of Investigatory Powers Act 2000, s.53(5) and (5A) (legislation.gov.uk, checked 2026-10-01)

You can refuse — no penalty

• Under s.39(3)(d) of the Police, Crime, Sentencing and Courts Act 2022, an authorised person must have given P notice in writing stating that P may refuse to provide the device or agree to the extraction of information from it; s.39(1) says a person (‘P’) is treated for the purposes of section 37 or 38 as having voluntarily provided an electronic device to an authorised person, and agreed to the extraction of information from the device by an authorised person, only if the requirements of this section have been met.

  Source: Police, Crime, Sentencing and Courts Act 2022, s.39(1) and (3) (legislation.gov.uk, checked 2026-10-02)

What officers may do, and limits on them

• Schedule 7 paragraph 11 applies to anything which is given to an examining officer in accordance with paragraph 5(d), is searched or found on a search under paragraph 8, or is examined under paragraph 9; an examining officer may detain the thing for the purpose of examination, for a period not exceeding seven days beginning with the day on which the detention commences; while he believes that it may be needed for use as evidence in criminal proceedings; or while he believes that it may be needed in connection with a decision by the Secretary of State whether to make a deportation order under the Immigration Act 1971.

  Source: Terrorism Act 2000, Sch.7 para 11(1) and (2) (legislation.gov.uk, checked 2026-10-01)

• PACE s.22(1) says that, subject to subsection (4), anything seized by a constable may be retained “so long as is necessary in all the circumstances” — the quoted provision states a necessity test, not a period of days.

  Source: Police and Criminal Evidence Act 1984, s.22(1) (legislation.gov.uk, checked 2026-10-02)

• PACE s.22(4) says nothing may be retained for either of the purposes mentioned in subsection (2)(a) if a photograph or copy would be sufficient for that purpose.

  Source: Police and Criminal Evidence Act 1984, s.22(4) (legislation.gov.uk, checked 2026-10-02)

• The Code of Practice on extraction of information from electronic devices says it only applies as regards the powers in Chapter 3 of Part 2 of the Act, and that information which is extracted and deemed not relevant must be deleted unless there is a lawful basis to retain it.

  Source: Extraction of Information from Electronic Devices: Code of Practice (Oct 2022), paras 1, 4 and 138 (assets.publishing.service.gov.uk, checked 2026-10-04)

• The same Code (para 4) says it “only applies as regards the powers in Chapter 3 of Part 2 of the Act” and that “If another power is being used as the basis for extracting information from an electronic device, the guidance/code for that power will apply.”

  Source: Extraction of Information from Electronic Devices: Code of Practice (Oct 2022), para 4 (assets.publishing.service.gov.uk, checked 2026-10-01)

• Under s.39(3)(e) of the Police, Crime, Sentencing and Courts Act 2022, the written notice must also state that the investigation or enquiry for the purposes of which the information is sought will not be brought to an end merely because P refuses to provide the device or agree to the extraction of information from it.

  Source: Police, Crime, Sentencing and Courts Act 2022, s.39(1) and (3) (legislation.gov.uk, checked 2026-10-02)

You must — refusing is a criminal offence

• If you are questioned under Schedule 7 (paragraph 2 or 3), give the examining officer any information in your possession which the officer requests.

  Source: Terrorism Act 2000, Sch.7 para 5(a) (legislation.gov.uk, checked 2026-09-08)

• The Schedule 7 Code of Practice says the person must provide access to any electronic device to allow for a search to be undertaken, including where access requires them to unlock it through application of their thumb or finger, or any other form of access control.

  Source: Schedule 7 (Terrorism Act 2000) Code of Practice (Oct 2025), para 61 (assets.publishing.service.gov.uk, checked 2026-09-08)

• A person commits an offence if he wilfully fails to comply with a duty imposed under or by virtue of Schedule 7, wilfully contravenes a prohibition imposed under or by virtue of that Schedule, or wilfully obstructs, or seeks to frustrate, a search or examination under or by virtue of that Schedule.

  Source: Terrorism Act 2000, Sch.7 para 18(1) (legislation.gov.uk, checked 2026-10-04)

• A person guilty of an offence under paragraph 18 of Schedule 7 is liable on summary conviction to imprisonment for a term not exceeding three months, a fine not exceeding level 4 on the standard scale, or both.

  Source: Terrorism Act 2000, Sch.7 para 18(2) (legislation.gov.uk, checked 2026-10-04)

• Once a section 49 RIPA notice has been given to you, comply with it: a person to whom a section 49 notice has been given is guilty of an offence if he knowingly fails, in accordance with the notice, to make the disclosure required.

  Source: Regulation of Investigatory Powers Act 2000, s.53(1) (legislation.gov.uk, checked 2026-09-08)

• A person guilty of an offence under s.53 of RIPA is liable on conviction on indictment to imprisonment for a term not exceeding “the appropriate maximum term” or to a fine, or to both, where s.53(5A) defines “the appropriate maximum term” as five years in a national security case or a child indecency case and two years in any other case; on summary conviction the person is liable to imprisonment for a term not exceeding six months or to a fine not exceeding the statutory maximum, or to both.

  Source: Regulation of Investigatory Powers Act 2000, s.53(5) and (5A) (legislation.gov.uk, checked 2026-10-01)

You can refuse — no penalty

• Under s.34(1) and (4) of the Criminal Justice (Scotland) Act 2016, where a person is in police custody in relation to an offence and has not been officially accused of committing the offence or an offence arising from the same circumstances as the offence, the person is under no obligation to answer any question, other than to give the person’s name, address, date of birth, place of birth (in such detail as a constable considers necessary or expedient for the purpose of establishing the person’s identity) and nationality.

  Source: Criminal Justice (Scotland) Act 2016, s.34(1) and (4) (legislation.gov.uk, checked 2026-10-01)

• Under s.39(3)(d) of the Police, Crime, Sentencing and Courts Act 2022, an authorised person must have given P notice in writing stating that P may refuse to provide the device or agree to the extraction of information from it; s.39(1) says a person (‘P’) is treated for the purposes of section 37 or 38 as having voluntarily provided an electronic device to an authorised person, and agreed to the extraction of information from the device by an authorised person, only if the requirements of this section have been met.

  Source: Police, Crime, Sentencing and Courts Act 2022, s.39(1) and (3) (legislation.gov.uk, checked 2026-10-02)

What officers may do, and limits on them

• The Schedule 7 Code of Practice says information requested by an examining officer under paragraph 5(a) may include passwords to electronic devices; the same paragraph says an examining officer may not, however, compel a person to disclose or confirm the identity of a source of journalistic information or disclose information subject to legal privilege.

  The second part is a rule for the examining officer. As quoted, it does not give the person a right to refuse any Schedule 7 duty.

  Source: Schedule 7 (Terrorism Act 2000) Code of Practice (Oct 2025), para 55 (assets.publishing.service.gov.uk, checked 2026-10-04)

• Section 47(1) of the Criminal Justice (Scotland) Act 2016 says that nothing in Part 1 affects any rule of law by virtue of which a constable may exercise a power of the type described in subsection (2) — a power exercised in relation to a person by reason of the person’s having been arrested and charged with an offence by a constable — and s.47(3) says powers of that type include the power to seize any item in the person’s possession.

  Source: Criminal Justice (Scotland) Act 2016, s.47(1), (2) and (3)(b) (legislation.gov.uk, checked 2026-10-01)

• Schedule 7 paragraph 11 applies to anything which is given to an examining officer in accordance with paragraph 5(d), is searched or found on a search under paragraph 8, or is examined under paragraph 9; an examining officer may detain the thing for the purpose of examination, for a period not exceeding seven days beginning with the day on which the detention commences; while he believes that it may be needed for use as evidence in criminal proceedings; or while he believes that it may be needed in connection with a decision by the Secretary of State whether to make a deportation order under the Immigration Act 1971.

  Source: Terrorism Act 2000, Sch.7 para 11(1) and (2) (legislation.gov.uk, checked 2026-10-01)

• Under s.39(3)(e) of the Police, Crime, Sentencing and Courts Act 2022, the written notice must also state that the investigation or enquiry for the purposes of which the information is sought will not be brought to an end merely because P refuses to provide the device or agree to the extraction of information from it.

  Source: Police, Crime, Sentencing and Courts Act 2022, s.39(1) and (3) (legislation.gov.uk, checked 2026-10-02)

You must — refusing is a criminal offence

• Section 3LA(5) of the Crimes Act 1914 (Cth) says a person commits an offence if the person is subject to an order under the section, is capable of complying with a requirement in the order, omits to do an act, and the omission contravenes the requirement; the penalty is imprisonment for 5 years or 300 penalty units, or both.

  Source: Crimes Act 1914 (Cth), s.3LA(5) — penalty tier one (Compilation No. 167, 27 Aug 2026) (legislation.gov.au, checked 2026-09-08)

• Section 3LA(6) of the Crimes Act 1914 (Cth) says a person commits an offence if the person is subject to an order under the section, is capable of complying with a requirement in the order, omits to do an act, and the omission contravenes the requirement, and the offence to which the relevant warrant relates is a serious offence or a serious terrorism offence; the penalty is imprisonment for 10 years or 600 penalty units, or both.

  Source: Crimes Act 1914 (Cth), s.3LA(6) — offence elements and penalty tier two (Compilation No. 167, 27 Aug 2026) (legislation.gov.au, checked 2026-10-02)

What officers may do, and limits on them

• Section 3LA(1) of the Crimes Act 1914 (Cth) says a constable may apply to a magistrate for an order requiring a specified person to provide any information or assistance that is reasonable and necessary to allow a constable to access data held in, or accessible from, a computer or data storage device that is on warrant premises; or is found in the course of an ordinary search of a person, or a frisk search of a person, authorised by a warrant under section 3E; or has been moved under subsection 3K(2) and is at a place for examination or processing; or has been seized under this Division.

  Source: Crimes Act 1914 (Cth), s.3LA(1) — order power (Compilation No. 167, 27 Aug 2026) (legislation.gov.au, checked 2026-10-01)

What the sources say

What a document, a report, an agency publication or a provision says, quoted as it is worded.

• In a written answer to a question on notice taken at Senate Additional Budget Estimates (AE22-050), the Australian Border Force said: “There is no legal compulsion for a traveller to provide a password/passcode or provide assistance to an electronic device at the border.”

  Source: Senate Standing Committee on Legal and Constitutional Affairs, Additional Budget Estimates, ABF written answer AE22-050 (document headed 14 Feb 2022) — no legal compulsion (aph.gov.au, checked 2026-09-08)

• The same answer said that if an individual refuses to comply with a request or provide a password for an examination of their electronic device, and an ABF officer considers there to be a risk to the border, the ABF officer is authorised to seize that device for further examination prior to being returned.

  Source: Senate Standing Committee on Legal and Constitutional Affairs, Additional Budget Estimates, ABF written answer AE22-050 (document headed 14 Feb 2022) — consequence of refusal (aph.gov.au, checked 2026-09-08)

What officers may do, and limits on them

• In Riley v. California the Supreme Court said its answer to the question of what police must do before searching a cell phone seized incident to an arrest is “accordingly simple—get a warrant.”

  Source: Riley v. California, 573 U.S. 373 (2014) (law.cornell.edu, checked 2026-09-08)

• Riley also says other case-specific exceptions may still justify a warrantless search of a particular phone, and that the exigent circumstances exception requires a court to examine whether an emergency justified a warrantless search in each particular case.

  Source: Riley v. California, 573 U.S. 373 (2014) (law.cornell.edu, checked 2026-09-08)

• The Fifth Amendment includes the words “nor shall be compelled in any criminal case to be a witness against himself.”

  Source: U.S. Constitution, Fifth Amendment (law.cornell.edu, checked 2026-09-08)

• In United States v. Payne, the Ninth Circuit held that the compelled use of Payne’s thumb to unlock his phone (which he had already identified for the officers) was not a testimonial act and that the Fifth Amendment does not apply — and said its opinion should not be read to extend to all instances where a biometric is used to unlock an electronic device.

  Source: United States v. Payne, 99 F.4th 495 (9th Cir. 2024) (cdn.ca9.uscourts.gov, checked 2026-10-01)

• In United States v. Brown, the D.C. Circuit held that, in compelling Schwartz to unlock his cellphone, law enforcement violated the Fifth Amendment; the record reveals that an FBI agent ordered Schwartz to open the cellphone, and Schwartz complied by placing his thumb on the cellphone.

  Source: United States v. Brown, No. 23-3074 (D.C. Cir. Jan. 17, 2025) (media.cadc.uscourts.gov, checked 2026-10-01)

• The Payne opinion says: “Officer Coddington forcibly grabbed Payne’s thumb and used it to unlock the phone via a built-in biometric unlocking feature.”

  Source: United States v. Payne, 99 F.4th 495 (9th Cir. 2024) (cdn.ca9.uscourts.gov, checked 2026-10-01)

• A footnote in Payne says that whether the officer forcibly used Payne’s thumb to unlock the phone or Payne “reluctantly unlocked the cell phone using his thumb print” was disputed before the district court, and that for the purposes of the appeal the government accepted the defendant’s version of the facts, “that defendant’s thumbprint was compelled.”

  Source: United States v. Payne, 99 F.4th 495 (9th Cir. 2024), n.2 (cdn.ca9.uscourts.gov, checked 2026-10-02)

• In United States v. Belmonte Cardozo, the Fourth Circuit said that under its precedent forensic searches of cell phones are nonroutine, and held that manual searches of cell phones at the border are routine and thus do not require individualized suspicion.

  Source: United States v. Belmonte Cardozo, No. 25-4239 (4th Cir. July 13, 2026) (ca4.uscourts.gov, checked 2026-09-08)

What the sources say

What a document, a report, an agency publication or a provision says, quoted as it is worded.

• CBP’s directive says: “Travelers are obligated to present electronic devices and the information contained therein in a condition that allows inspection of the device and its contents.”

  Source: CBP Directive No. 3340-049B §5.3.1 (eff. 1 Jan 2026) (cbp.gov, checked 2026-09-08)

• CBP’s directive says that if an officer is unable to complete an inspection of an electronic device because it is protected by a passcode or encryption, the officer may, in accordance with section 5.4, detain the device pending a determination as to its admissibility, exclusion, or other disposition.

  Source: CBP Directive No. 3340-049B §5.3.3 (eff. 1 Jan 2026) (cbp.gov, checked 2026-09-08)

• CBP’s directive says an officer may conduct a basic search of an electronic device with or without suspicion, “subject to the requirements and limitations provided herein and applicable law.”

  Source: CBP Directive No. 3340-049B §5.1.3 (eff. 1 Jan 2026) (cbp.gov, checked 2026-09-08)

• CBP’s directive says that following the completion of the border search, CBP will retain no copies of the information beyond twenty-one (21) calendar days following the conclusion of the border search unless retention is permissible or required consistent with sections 5.6.1, 5.6.2, or 5.6.3. Section 5.6.2 says that, without probable cause, CBP may retain only information from the border search of an electronic device relating to immigration, customs, and other enforcement matters if such retention is consistent with the applicable system of records notice and subject to the requirements and limitations provided in the directive and applicable law.

  Source: CBP Directive No. 3340-049B §§5.6.1, 5.6.2, 5.6.4 (eff. 1 Jan 2026) (cbp.gov, checked 2026-10-02)