CFI upholds SFC’s investigative powers on seizure of digital devices

In today’s digital age, electronic devices like smartphones, tablets and notebook computers are widely used in everyone’s daily life. Inevitably, these devices store information and records of one’s work as well as private life. In a recent case Cheung Ka Ho Cyril v Securities and Futures Commission (“SFC”) [2020] HKCFI 270, the Court upholds the SFC’s decisions to seize and retain digital devices owned by persons under investigation and to compel disclosure of passwords, as lawful and constitutional.

In this case, 5 individuals under SFC investigation (the “Applicants”) applied to the Court of First Instance for judicial review challenging the lawfulness and constitutionality of:

1. the SFC’s decisions (and the corresponding search warrants issued by magistrates) to seize and retain the Applicants’ digital devices; and
2. the SFC’s decisions to issue s.183 notice requiring the Applicants to disclose passwords to their email accounts or digital devices.

These judicial review applications were all dismissed by the Court.

Summary of Facts

These judicial review proceedings arose out of the SFC’s ongoing investigations on suspected breaches of the Securities and Futures Ordinance (Cap. 571; “SFO”) related to:

1. Aeso Holdings Ltd (listed on the Growth Enterprise Market Board of the Stock Exchange of Hong Kong) and its listing in 2017, following disputes between two camps of shareholders of Aeso in which both complained that the other side had committed serious misconduct; and
2. Bond placements by Skyfame Realty (Holdings) Ltd and China Agri-Products Exchange Ltd (both listed on the Main Board).

The Court’s Decision

The Court held that the following actions taken by the SFC were all lawful and constitutional:-

Seizures of digital devices

It was held that the words “record” or “document” under s.179(1) and 183(1)(a) of the SFO – the empowering statutory provisions of the seizures in question – are not confined to records or documents in paper or traditional forms, but are sufficiently wide to cover the digital devices seized by the SFC in the present case. In reaching his decision on this issue, the Honourable Mr. Justice Anderson Chow commented that it would be “wholly out of touch with reality” to read the above SFO provisions as excluding digital devices from the scope of the provisions.

On the issue of constitutionality, the Judge established from the outset that the right to privacy guaranteed under Article 30 of the Basic Law and Article 14 of the Bill of Rights is not absolute. In upholding the constitutionality of the seizures, the Judge found that the 4-step proportionality test established in Hysan Development Co Ltd v Town Planning Board (2016) 19 HKCFAR 372 (i.e. (i) “legitimate aim”, (ii) “rational connection”, (iii) “no more than reasonably necessary” and (iv) “fair balance”) was satisfied in the present case.

The main contentions in this case were on steps (iii) and (iv):-

• “No more than reasonably necessary” – it was held that the seizures in question were no more than necessary, since the SFC’s officers did not seize each and every digital devices belonging to the Applicants; instead, the officers had no practical alternatives but to seize the devices which upon preliminary examination appeared to contain relevant materials to the investigations.
• “fair balance” – the Court was satisfied by the SFC’s assurance that it is amenable to using keyword searches to identify the relevant materials contained in the Applicants’ digital devices – a practice designed to minimize the chances of irrelevant or personal information being viewed by the SFC’s officers. The seizures therefore did not result in any unacceptably harsh burden on the Applicants.

Retention of the digital devices

As the seizures of the digital devices were held to be rightful, the Honourable Mr. Justice Chow accordingly allowed the SFC’s continued retention of the digital devices seized.

Requests for passwords to email accounts or digital devices

The Court upheld the SFC’s power under s.183(1) in requiring the Applicants to provide passwords to their email accounts and digital devices, even though the accounts and devices would also likely contain other personal or private materials. The Court upheld the constitutionality of these requests, particularly due to the practical and reasonable safeguards offered by the SFC to protect the privacy of the Applicants.

Practical Implications

Given the prevalence of digital devices and the massive flow of digital financial information nowadays, this ruling does not really come as a surprise. Since the SFC is entrusted with the responsibility of protecting and maintaining the integrity of the financial markets in Hong Kong, the Court sees the SFC’s power to seize, retain and access digital devices as a necessary corollary to its investigative function in today’s digital world.

In light of this decision, clients dealing with potential or ongoing SFC investigations should pay attention to the following:-

1. Seek immediate legal advice in the event of a “dawn raid” by the SFC;
2. Consider using different digital devices to separately store information on one’s work, financial transactions and private life: The SFC does not have power to seize digital device which contains no information relevant to its investigations. Therefore, by using a device solely for storing private information which have no bearing on any SFC-related issues, one can ensure that minimal personal information would become viewable to the SFC’s officers;
3. Consider using new devices or accounts after the seizure to prevent any post-seizure information from being accidentally viewable by the SFC;
4. Refrain from using the same password combination for any other digital devices or accounts to minimize the risk of any unintended or unauthorized access by the investigation authorities in the future.

For details of our Securities & Regulatory practice, please click here