Must you unlock your phone for the police?

What exactly is being asked?

Telling someone to open their phone could mean saying a code, performing an action on the screen or enabling biometric access. Sometimes permission for an investigation is also requested. Anyone who treats these questions as one package cannot properly assess what is required and what is recorded. Therefore, start by naming the actual action. A technical description can make the legal conversation clearer without drawing a legal conclusion itself.

Our editorial analysis is that understandability is an essential part of legal protection here. Someone who only nods yes under tension has not necessarily understood which data is then examined. Ask if there is an order, a request or a request for permission and let the lawyer assess the meaning. Please mention language problems or other circumstances that make understanding difficult. A suitable moment for confidential consultation is more important than a standard sentence taken from the internet that does not fit what is actually being asked.

Telling a code and distinguishing a physical action

The right to remain silent and the prohibition on unlawfully forcing someone to make a statement are important principles. However, they do not answer every question about research on objects or physical material. The legal assessment distinguishes between statements and material that exists independently of the will. What this means for a concrete action requires careful assessment. Calling an access code from memory is not simply the same as applying a finger to a sensor.

That distinction is not a license for every form of coercion. Legal authority, purpose, necessity, proportionality and method of implementation remain relevant. An article that simply states that the right to remain silent always precludes any cooperation oversimplifies the situation. An article that says that the police can demand any code does the same. Present the factual question to the lawyer and afterwards describe accurately what was asked, said and done. For the general procedural attitude, there is an in-depth discussion of the right to remain silent. (right to remain silent)

What the judgment about a fingerprint does and does not teach

The Supreme Court ruled on February 9, 2021 in ECLI:NL:HR:2021:202 on biometric unlocking of a smartphone with a fingerprint. This involved a concrete method of very limited physical coercion on a seized telephone. The assessment of that action cannot be replaced by just the general idea that one never has to cooperate against oneself. The judgment must be read in its factual and legal context. (ECLI:NL:HR:2021:202)

The editorial lesson is that the step from one permitted action to every conceivable unlocking method is too big. An order to tell a remembered code, the use of facial recognition and further physical coercion require their own assessment. Moreover, a statement about unlocking does not automatically concern the legality of a complete subsequent data investigation. Let the lawyer indicate exactly which legal rule applies to the method used and which circumstances are relevant to your situation.

An open phone is not an unlimited investigative mandate

The smartphone framework from 2025 is important for examining the data. The Supreme Court has adjusted its previous framework following European case law. In the case of research that results in more than a limited invasion of privacy, prior assessment by the examining magistrate is in principle required, with its own assessment for urgency. The technology used to gain access and the legal definition of the research should therefore be viewed side by side. (smartphone frame from 2025)

Ask what research purpose is mentioned and whether an authorization or other basis covers the intended scope. Is it a limited observation, a specific conversation or a broader reconstruction of communication and locations? The fact that the user opens one screen does not prove what further processing is allowed. The telephone guide in criminal seizure discusses this distinction in more detail. During the consultation, also take into account the date of the investigation and the applicable legal regulations. (Your phone confiscated: privacy, access and digital data)

Consent must have an understandable subject

When permission is requested, it is useful to clarify why. Just opening the device, viewing a concrete file, and examining a wide data copy have different scopes. Ask what action is proposed, what data categories and period are involved and how consent is recorded. The legal significance of a given consent must be assessed in conjunction with the applicable rules and the circumstances in which it was obtained.

Do not sign a description of which you do not understand the contents. Request an explanation and consult with the lawyer about the meaning. This is not an instruction to disobey a lawful order; the distinction between an order and a voluntary request for consent must be clear. Anyone who believes that a conversation has been misrepresented should note the specific difference and the available source. Discuss the route for addition or challenge without trying to make the original report disappear afterwards.

Owner, user and employer can be different people

An employee can use a work telephone that also contains private calls. A parent may own a device that is used by another. A shared account can contain messages from multiple people. None of those situations are fully explained by just the name on the receipt. Ownership, actual use and account access can each be significant for jurisdiction and privacy interests. Therefore, describe them separately.

An employer or family member cannot relinquish all interests in an investigation without assessment on behalf of everyone. Conversely, shared use does not automatically make a device inaccessible. Let the attorney know which individuals and accounts are involved and what protected communications may be found. Collect factual management information without unnecessarily distributing codes or recovery data. A limited administrator statement can be more useful than a general document where everyone seems to give permission to everyone.

Record actions instead of just conclusions

If someone says afterwards that he was forced, it must be made clear what is meant by that. Was there a verbal command, a threat of consequence, a held hand, or a request that was perceived as obligatory? Describe the words and actions to the extent that you reliably remember them. Indicate who was present and when confidential consultation was possible. A precise description helps the lawyer to choose the relevant test.

Also write down what you don't know. You do not have to determine for yourself which software was used later or which files were actually viewed. This may become apparent from documents or additional research. Keep your own observation, information from a police officer and suspicions separate. Save received documents. Do not share the story on social media with screenshots of potentially confidential documents. A public accusation can cloud rather than improve the necessary reconstruction and unnecessarily disseminates data from others.

Fictional example: a short question with a broad consequence

Suppose Alex is asked to open his device to show a received message. He thinks it's just about that one appointment. Later he hears that several months of messages have been investigated. This fictitious example does not prove that an authority has been exceeded: a separate authorization or other relevant basis may exist. It does show why the purpose understood by Alex is not the only document required for review.

The lawyer therefore first reconstructs what has been requested and recorded. He then investigates which actions were actually performed and on what basis. Alex provides his own memory and received documents, but does not fill in missing technical information with assumptions. If the scope of a consent and that of an authorization differ, those differences must be discussed specifically. The question of whether data may be used for evidence does not automatically follow from one sentence about opening the screen.

Discuss security without altering evidence

A criminal seizure or release demand can raise concerns about banking, work accounts and client data. Those concerns may be real. In fact, pass them on to the lawyer and the appropriate administrator. Ask what measures are necessary and legally permitted to prevent abuse. Do not delete data, remotely wipe a device, or change access for the purpose of influencing the investigation. A security goal and a disruption goal should not be mixed up.

If necessary, the lawyer can contact the right authority about a specific risk or a limited practical provision. Describe what exactly is threatening and why it cannot be resolved via a normal alternative route. A general fear that someone might see everything requires a different response than a demonstrable threat of an unauthorized payment. Do not put passwords in a general question card. An agreed secure channel is required for confidential data, even when the consultation is under time pressure.

Questions for the consultation about unlocking

The following questions help to define the actual situation. It is not an action script for every police contact. Use the answers to discuss with the lawyer which rule applies to which step. Stick to what you know and leave an unknown part blank. Especially for a technically complex subject, a simple, reliable chronology can be more valuable than a firm conclusion based on a general online explanation.

• What is being asked: say a code, operate a screen, use biometrics or give permission?
• Who asks the question, when and in what process position am I?
• What legal authority or voluntary consent is referred to?
• What data research is intended and what authorization or demarcation is known?
• Could I understand the question and discuss it confidentially with a lawyer?
• Which actions, words and documents can I describe from my own observation?
• Which specific privacy, confidentiality or security interests must be reported?