The rule was added through amendments gazetted on Monday. Officials are expected to brief lawmakers, but the provisions are already drawing attention – especially among travellers carrying personal or work devices.
What the new password rule means for travellers
For travellers, the rule signals tighter scrutiny of digital devices in specific cases tied to national security.
Under the updated framework, Hong Kong police can require a person under investigation to provide passwords or technical help to access electronic devices. That includes phones, laptops, and other storage tools.
Non-compliance carries penalties – up to one year in prison, along with a fine.
Providing false information further increases the penalties. Authorities say that could result in a three-year prison sentence and a higher financial penalty.
The scope is not limited to the device owner. Anyone believed to have knowledge of the password – including past users or those with access – may also be required to assist.
Additional powers for authorities
The amendments go beyond device access. Customs officials now have expanded authority in national security cases. That includes freezing or confiscating assets linked to suspected offences.
There is also a change in how ‘foreign agents’ are handled. The maximum penalty for failing to comply with information requests has been increased to one year in jail.
A foreign agent, under the law, refers to individuals acting on behalf of foreign governments, political groups, or certain international organisations.
At the same time, a new legal channel has been introduced. Individuals identified as foreign agents can apply to a court to challenge or modify data requests.
Background and legal context
The changes follow a ruling by Hong Kong’s top court last year. The court overturned convictions linked to a national security data request, citing insufficient proof and concerns around fair trial standards.
Authorities say the amendments address gaps identified in that case.
A government spokesperson said the rules ‘only enhance’ enforcement powers and remain aligned with the Basic Law and human rights protections. The statement added that “law-abiding persons will not contravene the law inadvertently.”
What this means in practice
The law itself is not aimed at routine checks. Still, the expanded powers mean access to personal data can be legally required under certain conditions.
The changes stand as part of Hong Kong’s broader national security framework introduced in 2020 – a system authorities say ensures stability, while critics continue to question its reach.
