Password protected – Supreme Court clarifies boundaries of privilege against self-incrimination where access to digital devices is compelled

Speedread 

In this article, we analyse a recent Supreme Court decision[1] which clarified the extent to which evidence that a person provided a password or digital key (for example, a fingerprint or facial recognition) to a seized electronic device under compulsion, and any evidence subsequently obtained from the relevant device via any such password or digital key, can be used against them in a subsequent prosecution. In short:

1. The Supreme Court upheld the constitutionality of the provision at issue, i.e., s. 49 of the Criminal Justice (Theft and Fraud Offences) Act 2001, which makes it an offence to fail to provide a password to a lawfully seized device in response to a request made by the Gardaí under s.48.
2. Importantly, however, the Supreme Court also clarified that the compelled provision of a password or digital key does trigger the privilege against self-incrimination and cannot be used against an individual in any prosecution against them to prove that they own, control or operated the device
3. However, while the compelled act of providing the password or digital key cannot be used, that does not render inadmissible any of the relevant incriminating material found on the device. This can still be relied upon by the prosecution, provided reference is not made to the compelled assistance used in accessing it. This is because “what exists already does not infringe the right against self-incrimination”.

The decision recalibrates the balance between investigative powers and fair trial rights in the digital context. It seeks to protect individuals from being forced to provide evidence of control or ownership of a device, while preserving the prosecution’s ability to rely on lawfully obtained digital material notwithstanding the compelled provision of access to same. 

Background

These proceedings arose following an investigation by the Garda National Economic Crime Bureau of Mr Poptoshev (the Applicant) for various suspected criminal offences, including revenue offences, company law offences, and offences of making a gain or causing a loss by deception.

In January 2024, the Gardaí obtained a search warrant under s. 48(2) of the Criminal Justice (Theft and Fraud Offences) Act 2001(the 2001 Act) to search the Applicant’s residence. During the search, the Gardaí seized two smartphones and a laptop. When asked by the Gardaí to provide passwords to enable them to access the devices, the Applicant refused, leading to his arrest and three charges for failing to comply with a lawful requirement to provide passwords contrary to s. 49 of the 2001 Act.

The Applicant subsequently brought a judicial review application, seeking a prohibition order in relation to the charges and declaratory relief that the following provisions were invalid and violated his constitutional rights:

• s. 48(5)(b)(i) which confers on the Gardaí, acting under the authority of the search warrant, the power to require a person to provide the password to any ‘computer’ to which he has lawful access at the place which is subject to the search warrant
• s. 49(1)(c) which creates the offence of failing to comply with this requirement
• s. 49(2) which provides the Gardaí with the power of arrest in such circumstances

More specifically, the Applicant contended that the requirement to provide the passwords to the seized devices, along with the offence created for a failure to comply, interfered in a disproportionate manner with the privilege against self-incrimination.

Decision of the High Court and Grounds of Appeal to the Supreme Court 

The High Court held that the privilege against self-incrimination did not extend to passwords for electronic devices which were seized under compulsory powers exercised in the investigation of criminal offences. Rather, it held that such passwords existed “independent of the will” of the accused, or suspect, once created. While the contents of the devices may be incriminating, the password or ‘key’ was neutral. For a more detailed overview of the High Court decision, see our previous article here. 

The Applicant subsequently sought leave to appeal the High Court’s decision directly to the Supreme Court. Leave was granted owing to the general public importance of the issues raised being:

1. whether compelling a person to provide a password or digital key engages the right against self-incrimination, specifically where no direct verbal admission is made; and
2. whether providing such access constitutes an admission in law.

Decision of the Supreme Court

In a detailed judgment, the Supreme Court upheld the lawfulness of s. 49 of the 2001 Act. However, the basis for this decision differed from that of the High Court in a number of key respects.

1. Compelled passcodes engage the privilege against self-incrimination

Unlike the High Court, the Supreme Court held that s. 49 of the 2001 Act did engage the privilege against self-incrimination by compelling a suspect to disclose a password or digital key for a seized electronic device albeit in a limited way. This was because the disclosure of the password or digital key could be potentially incriminating if used as evidence establishing ownership, possession or use of the device by the suspect in a subsequent criminal prosecution for the serious offences under investigation.  

Hence, compelling a suspect to provide a password or digital key could potentially compel them to offer an element of proof against themselves. Therefore, any necessary evidence to establish ownership, possession or use of the device must, instead, come from other sources. Such sources may include any evidence which is contained within the computer or electronic device itself as this information is pre-existing and does not infringe the right against self-incrimination. 

2. Necessary, proportionate and under judicial supervision

The Supreme Court took a pragmatic view that in order for investigations into serious crime to be effective, searches must be possible of both the physical and digital space. In order to tackle serious crime, material stored on a digital device must be capable of being seized on foot of a warrant with judicial supervision and based on reasonable suspicion established to the satisfaction of a court. Furthermore, where it is seized it must be capable of use at any subsequent trial, albeit without any reference to the suspect enabling its use:

““Where a prosecution is brought on the underlying offence, the data on the computer may be capable of being accessed and used in two circumstances. The first is analogous to the authorities seizing and taking away a large locked safe. There, mechanical means may force the safe open. With a computer, expert hacking may overcome the lack of cooperation of the suspect. Otherwise, a code may be found in a notebook or someone to whom it was revealed may assist the authorities.

Where, secondly, the suspect gives the passcode or operates the device by biometric data, what is in the computer may also potentially be offered in testimony; whether potentially incriminating or possibly exonerating. What cannot be used is the statement or action of the accused whereby the computer is opened [2]”. 

 3. Other relevant legislative provisions

Interestingly, the Supreme Court listed a number of legislative provisions which provide for separate criminal offences for refusal to enable a digital search in investigations relating to serious crime. It noted that these provisions showed an awareness on the part of the Oireachtas (the Irish legislature) of the risk of investigations being rendered futile where passwords to digital devices are refused. The Court found that while s. 49 constituted an abridgement of the right to silence, it was limited to serious crimes, targeted in nature and “necessary for the rational pursuit of traditional police powers in the digital age”.

Central to the Supreme Court’s finding that the limitation of the privilege against self-incrimination was justified, was the fact that a search is a judicially mandated exercise. Search warrants in Ireland are subject to judicial oversight and require that a judge be satisfied by way of the sworn evidence of adequate suspicion justifying the intrusion into the private sphere (and the specific need for intrusion into the private “digital sphere” must be specifically addressed in such evidence).

4. Smartphones and computers

The Supreme Court also addressed the definition of “computer” in the 2001 Act and whether it could be said to encompass digital devices more broadly. It found that terms in legislation necessarily evolve and, indeed, must do so, in order to ensure their longevity. 

Consistent with the High Court’s findings, the Supreme Court was also satisfied that the term “computer” in the 2001 Act included laptops, larger devices, tablets and mobile phones. It also pointed out that no authority existed that a mobile phone was not a computer.

Key takeaways:

• While this decision primarily provides clarity on the lawfulness of s. 49 of the 2001 Act, it is also relevant to the legality of other similar provisions in Irish criminal statutes which provide for the compulsion of passwords for lawfully seized devices on pain of prosecution in context of the investigation of serious crimes. In light of this judgment, such legislation likely qualifies as a limited, targeted and proportionate curtailment of the privilege against self-incrimination necessary to enable effective police investigative powers in the digital age.
• An important caveat is that any evidence of a password obtained under compulsion of prosecution under s. 49 or similar provisions cannot itself be used against the person providing it. In practical terms, this means that no reference can be to an accused, enabling use of the computer in a prosecution against them. However, this is a limited application of the privilege against self-incrimination as the Supreme Court was clear in clarifying that information or evidence found on a lawfully seized digital device can be used in any prosecution of the underlying offence for which the device was seized.
• The Court took a pragmatic view of the meaning of “computer” in the 2001 Act.  It recognised the importance of terms in legislation evolving with time to ensure that the law continues to remain relevant and effective. In light of this judgment, it will be difficult to make any reasonable argument in future cases that a mobile phone or smart phone is not a computer. 

For further information in relation to this topic, please contact Mairead O’Brien, Partner, Katie O’Connor, Partner, Rachel Kemp, Senior Practice Development Lawyer, or any member of ALG's White Collar Crime team.

[1]Yavor Poptoshev v Director of Public Prosecution & Ors [2025] IESC 47

[2] Paragraph 86

Date published: 14 January 2026