Hong Kong moves to compel password disclosure for digital devices

The measures form part of a wider tightening of the national security framework introduced by Beijing in 2020 following pro-democracy protests. The latest provisions were enacted without full parliamentary scrutiny, underscoring the shifting balance of power within the territory’s governance.

Broad scope raises concerns

The new obligations extend beyond suspects. Anyone with access to a device or knowledge of its credentials, including IT administrators, business associates and family members, may be compelled to assist authorities. The law also overrides professional confidentiality in certain circumstances, potentially affecting lawyers, doctors and other professions bound by strict privacy rules.

Legal analysts have highlighted the vague requirement for ‘reasonable and necessary assistance’, warning that its interpretation rests largely with enforcement authorities. This, they argue, creates significant scope for discretionary and potentially arbitrary application.

Shift towards executive power

Human rights groups and legal experts have criticised the absence of prior judicial oversight, noting that access orders can be issued directly by law enforcement agencies. Critics say this represents a further shift of power towards the executive, weakening procedural safeguards such as the right to privacy and due process.

The definition of national security in Hong Kong has long been broad, encompassing offences such as subversion, collusion with foreign forces and certain forms of political expression. Observers warn that the expanded powers could bring a wide range of digital communications, including private exchanges, within reach of investigators.

Part of a longer trend

The changes are widely seen as part of a broader trend since 2020, when the original national security law came into force. That legislation has been used in numerous cases against activists, journalists and opposition figures. A further security law adopted in 2024 expanded enforcement powers and aligned Hong Kong more closely with mainland China’s legal system.

While comparable powers to access encrypted data exist in countries such as the United Kingdom and Australia, they are typically subject to judicial oversight and narrower legal constraints. Analysts say the key difference in Hong Kong lies in both the scope of the powers and the weakening of independent checks.

Growing concerns over digital privacy

Smartphones and personal devices often contain extensive personal and professional information, from private communications to commercially sensitive data. The ability of authorities to demand access without prior judicial approval raises significant concerns about digital privacy and data protection.

The latest measures add to the growing debate over Hong Kong’s evolving legal and political landscape, and the extent to which its once distinct system is converging with that of mainland China.