Can the police search your phone?

Your phone holds more about you than your house does. Every message, every photograph, your location history, your banking, your medical appointments and everybody you know.

South African law took a long time to treat that as a distinct problem. The Cybercrimes Act 19 of 2020 now provides a specific framework, and the practical consequence is that there are two questions rather than one, with different answers.

Two separate questions

Can they take the phone? This is seizure, and it is governed by the Criminal Procedure Act 51 of 1977. Police may seize an article that is concerned in, or is on reasonable grounds believed to be concerned in, the commission of an offence. That is usually done under a search warrant, and there are defined circumstances in which it may be done without one, including where the person consents, or where the official believes on reasonable grounds that a warrant would be issued and that delay would defeat the object of the search.

Can they read what is on it? This is access to data, and here the Cybercrimes Act applies. The default is that a police official may access a computer system or a computer data storage medium, which includes a phone, in accordance with a warrant.

That distinction matters because the two things happen at different times and often with different lawfulness. A phone can be lawfully seized at an arrest and then unlawfully searched a week later at a station.

The warrant, and the exceptions

The Cybercrimes Act provides for warrants authorising search for, access to and seizure of articles, meaning data, computer programs, computer data storage media and computer systems.

There are two principal routes around it, and both are narrower than they sound.

Consent. Access without a warrant is permitted with the consent of a person who has lawful authority to consent. This is the exception that operates most often in practice, because it is the one police ask for, and because people say yes.

Urgency. Access without a warrant is permitted where the official believes on reasonable grounds that a warrant would be issued if applied for, and that delay in obtaining the warrant would defeat the object of the search. This is not a general convenience provision. It has to be justified on the facts, and it is the basis most vulnerable to challenge afterwards.

Where a warrant is executed, the official must hand to any person whose rights are affected a copy of the warrant and of the written application on which it was issued. Ask for both. Read them. Note what they authorise, because a warrant for one thing does not authorise another.

Do not consent

This is the single most consequential decision in the whole interaction, and it is usually made in three seconds at the side of a road.

If you consent, you have supplied the legal basis yourself. There is then nothing to argue about later, no warrant to scrutinise, no urgency to test, and no exclusion application to bring. Consent converts a contested question into a closed one.

Saying no is not obstruction and it is not an offence. The words are simple and should be said once, politely:

"I do not consent to a search of my phone. On what authority are you taking it?"

Then stop. Our guide on police searching your house without a warrant makes the same point about premises, and for the same reason: consent removes a protection you would otherwise have had.

Refusing does not mean the phone stays with you. It may still be seized. What it means is that the lawfulness of what follows remains a live question.

The passcode question

Here the honest answer is that South African law has not settled it.

Section 35(3)(j) of the Constitution gives an accused the right not to be compelled to give self-incriminating evidence. Whether compelling a person to disclose a passcode falls within that protection, or whether a passcode is closer to a key than to a statement, has been litigated in other jurisdictions and reached different answers in different places. There is no clear South African authority resolving it.

What the Cybercrimes Act does show is that the legislature had the problem in mind. Its definition of a "password, access code or similar data or device" expressly includes a secret code or PIN, an image, a security token, an access card, any device, and biometric data. So fingerprint and facial recognition are within the statutory concept of an access mechanism, not outside it.

Two practical observations follow.

Biometrics are weaker protection than a passcode, whatever the ultimate legal answer, because a finger can be placed on a sensor with very little cooperation and a six-digit number cannot be extracted from your head. If this matters to you, the setting to change is the one that turns biometric unlocking off, not the one that changes your PIN.

Do not guess at the law at the roadside. If you are asked for a passcode, say that you want to speak to a lawyer before answering, and say nothing else. That is a position you can hold whatever the courts eventually decide, and it is the same answer our guide on warning statements gives about questioning generally.

What a roadblock does not authorise

A traffic stop or a roadblock is not a licence to search a phone.

A roadblock authorises what a roadblock authorises: your documents, the vehicle, and the specific powers that attach to it. An officer who asks to look through your phone at a roadblock is asking for consent, and you may decline.

The same applies to being stopped in the street. An arrest carries certain powers; a conversation does not.

Your records are also held by other people

Something people overlook entirely while worrying about the handset.

A great deal of what is on your phone also exists with your network operator or a service provider: call records, cell tower data, subscriber information. Those can be obtained from the provider directly through the procedures the law provides for, including subpoenas for records, and the interception of communications is governed by its own legislation with its own authorisation requirements.

The practical point is that you will generally not know this has happened. Protecting the handset is not the same as protecting the information.

If the search was unlawful

An unlawful search is not a magic exit from a prosecution, but it is a real argument.

Section 35(5) of the Constitution provides that evidence obtained in a manner that violates any right in the Bill of Rights must be excluded if its admission would render the trial unfair or would otherwise be detrimental to the administration of justice.

It is not automatic exclusion. The court weighs the nature of the violation, whether it was deliberate, and the effect of admitting the evidence. A deliberate warrantless search of a phone, where a warrant could easily have been obtained, is the kind of violation courts take seriously.

What makes the argument available is a record, and the record is yours to make:

Note the officer's name, rank and station, and the date and time.

Note exactly what was taken, and ask for a receipt or an inventory.

Note whether you were shown a warrant, and whether you were given a copy of it and of the application.

Note whether you were asked for consent, what you said, and whether it was recorded.

Write it down the same day, while you still remember the sequence.

Getting the phone back

A seized phone is held as an exhibit, and the Criminal Procedure Act provides for how seized articles are dealt with and disposed of.

Ask for the case number and the name of the investigating officer. Ask when the device is expected to be released. Where it is being held longer than the investigation requires, an application can be made for its return, and the fact that your business, your banking and your contacts are on it is relevant to that.

Practically: do not expect it quickly, and do not rely on it being the only copy of anything. Back up now rather than after.

Worked example

This example is illustrative. A man is stopped after a complaint about a fight outside a bar. An officer asks to see his phone to check whether he filmed anything. He hands it over and unlocks it, because he has nothing to hide and wants the matter finished.

The officer reads his messages, finds an exchange from two months earlier about an entirely unrelated matter, and the investigation turns in that direction.

He consented, and to a search of the device rather than to a search for a specific video. There is no warrant to examine, no urgency to test, and very little to argue about afterwards.

The alternative version takes about fifteen seconds. He says he does not consent to a search of his phone, and asks on what authority it is being taken. The phone is seized anyway. He notes the officer's name and station, the time, and the fact that he was shown no warrant and was asked for consent and refused it. He writes it down that evening.

If the data is later accessed without a warrant, and without a defensible basis for urgency, he has an argument under section 35(5) that his messages should be excluded. In the first version he has none, and the only difference between the two is one sentence said at the right moment.