Irish Supreme Court ruling provides clarity over password access for criminal investigations

The court upheld a High Court ruling that a legal requirement for a suspect to hand over passwords to devices which were seized through a District Court warrant does not constitute a breach of their constitutional right to silence or against self-incrimination.

However, the judge, Mr Justice Peter Charleton, did rule that only pre-existing data on a device seized under warrant can be used, and that compelling a password from a suspect could not be used as evidence in itself.

Sarah Twohig, a white collar crime expert with Pinsent Masons in Dublin, said: “The decision of the Supreme Court is significant, as it sets clear legal parameters for provision of access to electronic devices to Gardaí on foot of a warrant when investigating serious crimes.

“It is important to note that the contents of an electronic device do not benefit from the privilege against self-incrimination and can be relied on in a trial. This is because the contents of the electronic device already exist independently of the suspect and are outside the sphere of any legal compulsion.

“However, where the password to an electronic device is given, the password itself may be self-incriminating and cannot be relied on by the prosecution at trial.”

It comes following a major investigation by the Garda’s economic crime bureau into significant white-collar theft from banks and financial institutions in 2006 and 2007, which resulted in Yavor Poptoshev having two smartphones and a computer seized under a District Court ordered search warrant in January 2024.

During the search, Poptoshev was told by the to provide passcodes for the devices in accordance with section 48 of the Criminal Justice (Theft and Fraud Offences) Act 2001, and after refusing to do so was arrested under section 49. Section 48 allows a Garda acting under the authority of a warrant to operate any computer at a place which is being searched, and to require any person at that place, who has lawful access to the information on any of those computers, to furnish any password necessary to operate it.

However, Poptoshev applied to the High Court challenging the provisions of the 2001 Act on the basis that they constituted a disproportionate interference with the privilege against self-incrimination. The privilege against self-incrimination is protected under both the Constitution of Ireland (Constitution) and the European Convention on Human Rights (ECHR).

The High Court ruled that the privilege against self-incrimination was not engaged to begin with as the three devices existed independently of the will of Poptoshev. The High Court also did not consider that the powers under the 2001 Act infringed the Constitution, nor did it consider that they amounted to a disproportionate interference with the applicant’s asserted right to the privilege against self-incrimination.

Poptoshev was granted leave to appeal the High Court’s decision directly to the Supreme Court, on the grounds that exceptional circumstances had been established.

The Supreme Court ruled that the provisions of the 2001 Act requiring a suspect from whom a device has been lawfully seized under warrant to provide a password did not infringe the Constitution or the ECHR. It considered that the provisions were a targeted response to the need to carry out a digital search as well as a physical one. It was mindful of the safeguard afforded by the fact that a suspect’s computer can only be seized where there has been an application to a judge for a warrant based on sworn information, where that information must establish reasonable grounds to suspect that evidence in relation to a serious offence is to be found at a particular premises.

However, the Supreme Court did depart from the High Court’s reasoning in its ruling, finding that the disclosure by a suspect of a password to a lawfully seized computer did in fact engage the right to silence. The Supreme Court ruled that the disclosure of the password itself cannot be used against the suspect as proof that they use or own the device in question – only the contents the device reveals can be used. As such, where legally compelled by the 2001 Act, the giving of the password by a suspect cannot be used in any criminal prosecution of the suspect for the underlying offence for which the computer was seized.

The Supreme Court upheld the decision of the High Court and dismissed the appeal.