What was the problem?
A suspect had been arrested in an investigation of a phishing gang. His smartphone had also been seized. During questioning, he was asked to disclose the access code for the phone but he refused to do so. The Public Prosecutor then ordered the suspect to cooperate in unlocking the phone (pursuant to Section 61a of the Code of Criminal Procedure). When he continued to refuse, he was handcuffed and his right thumb was pressed on the phone to unlock it.

What arguments were advanced?
The suspect’s lawyer argued that the files found on a smartphone that had been unlocked in this way should be excluded from the evidence. According to the lawyer, a number of important legal principles had been infringed, and the suspect’s fundamental rights had been violated without there being any legal authority to do so. The right of a suspect to a fair trial (Article 6 of the European Convention for the Protection of Human Rights and Fundamental Freedoms (the “ECHR”)) was violated, more specifically the principle of “nemo tenetur”. Also, the right for respect for the suspect’s privacy and personal life was infringed.

What did the Court decide?
The Court concluded from the legislation and the “Smartphone Ruling” that the police were in fact permitted to gain access to the smartphone so as to extract the data it contained for the purpose of their investigation. The police can also hack a smartphone’s access code for the same purpose.

The Court found the situation to be rather more complicated if a suspect’s cooperation is required for doing so. The suspect can be compelled to cooperate, provided that does not conflict with the nemo tenetur principle and that the requirements of proportionality and subsidiarity are met.

Given the particular situation concerned, the Court ruled that the police were permitted to press the suspect’s thumb on the smartphone. However, forcing him to disclose the access code would not be permitted.

The Court also found that pressing his thumb on the phone while he was handcuffed met the requirements of proportionality and subsidiarity. That was, on the one hand, because the technology of the smartphone was still so new that the Netherlands Forensic Institute (NFI) would be unable to hack it so as to access the data. On the other hand, it was permissible given the nature and seriousness of the suspicions and the legitimate expectation on the part of the police that the phone would contain relevant data.

How should all this be interpreted?
The nemo tenetur principle is one of the most fundamental rights that a suspect has, meaning that he is not required to incriminate himself. He does not therefore have to provide evidence against himself and has the right to remain silent, and therefore he cannot be forced to make a statement against himself in criminal proceedings. All this falls within the (European) right to a fair trial (Article 6 ECHR).

There is already a large body of case law regarding this matter by the European Court of Human Rights (“ECtHR”). From this case law follows that a suspect is indeed required to (passively) undergo and tolerate investigative measures. Material that exists independently of the will of the suspect may be obtained by means of compulsion, for example blood or urine samples. Material that does is dependent on the will of the accused, such as a statement, that its obtained by means of compulsion cannot be used as regards the imposition of a penalty.

The Noord-Holland District Court found that if a suspect has his thumb pressed on a smartphone by means of compulsion that should be seen as his tolerating an investigative measure that does not require any active cooperation. This does not amount to a violation of the principle of nemo tenetur. On the other hand, disclosing the smartphone access code would involve something that is indeed will-dependent and that must not, therefore, be obtained by means of compulsion.

Why is this relevant in legal practice?
The Dutch Parliament refused to pass a bill that would oblige suspects to disclose the password for their smartphone because of the conflict with the nemo tenetur principle (decryption order to suspect in Computer Crime Bill III). Suspects cannot therefore be obliged to disclose the access code for their smartphone.

If the ruling by Noord-Holland District Court is upheld, it will mean that access to a suspect’s smartphone can in fact be obtained by means of physical unlocking under compulsion. After all, a lot of people have opted for the convenience of unlocking their smartphone by means of fingerprint recognition. Moreover, this Court has approved the police handcuffing the suspect for that purpose, whereas the Official Instructions for the Police prescribe that handcuffs may only be used if there is a safety risk or the risk of the suspect escaping.

There has already been quite a bit of discussion in literature as to whether the situation outlined above conflicts with the nemo tenetur principle, with authors arriving at differing conclusions. Courts in other countries have also ruled differently regarding this issue. Given the effect that unlocking a smartphone can have because of the enormous amount of potential evidence that the phone may contain, the Dutch Supreme Court’s ruling in this case is awaited with a great deal of interest.

If the Supreme Court concurs with the Noord-Holland District Court, then only password-protected smartphones will be protected against enforced unlocking.