Right to Privacy

Can the police ask for our passwords? What if we forget them? Experts weigh in after Patrick Teoh’s Facebook insult case

I was asked by The Malay Mail to comment on laws relating to request of passwords of computer devices and online accounts and also the arrest of Patrick Teoh, a veteran radio personality. Patrick had allegedly posted certain disparaging comments about the Crown Prince of Johor and was arrested by the police for doing so. His remanded was extended because, among others, he had forgotten his email password.

Datuk Joshua Kevin, Rajsurian Pillai, Fong Choong Fook and I were interviewed by The Malay Mail. My answers are reproduced below with some modifications. The full answers can be viewed at The Malay Mail’s website.

Can the police search my phone and ask for my passwords?


Specifically on passwords, lawyer Foong Cheng Leong confirmed that authorities can request for passwords as part of investigations to allow for digital forensic tests to be conducted on the device, in order to obtain sufficient evidence to prove their case in court.

“It is generally to determine whether a particular message or conduct originated from that device.

“The authorities are given the power to do so for most offences, including in Patrick Teoh’s case which falls under the Communications and Multimedia Act 1998,” said Foong, who is co-deputy chair of the Bar Council’s Cyber Law Committee. Teoh’s case was probed under Section 233 of the CMA.

Under Section 249 of the Communications and Multimedia Act 1998 (CMA) which is similar to the Criminal Procedure Code’s Section 116B, police investigators who are conducting a search are to be given access to computerised data, with access again defined as including passwords, encryption codes, decryption codes, hardware or software.

While the term “computerised data” in both the CPC’s Section 116B and the CMA’s Section 249 is not defined, Foong confirmed that this would apply to passwords to social media accounts, email accounts, log-in passwords for computers, and codes to unlock a smartphone’s screen.

What happens if I refuse to reveal my passwords?

For those who refuse to give their passwords to digital devices or social media accounts to the police during investigations, Foong pointed out that such action may be considered a crime.

“A refusal to comply with the search may amount to an offence under, among others, Section 186 of the Penal Code i.e. voluntary obstruction of a public servant’s duty to discharge of his public functions.

“If it’s a search warrant by the Court, it may amount to contempt of court. However, such affected person may apply to set aside the Court warrant,” he said.

When asked whether the right to privacy or data protection could be cited to refuse the giving up of such passwords to investigators, Foong said that such rights are generally not taken into account during a search and seizure but noted a High Court case [Chong Chieng Jen v. Mohd Irwan Hafiz Md Radzi & Anor [2010] 1 CLJ 355] where the judge had said the court should consider the right to privacy when issuing a search warrant.

Asked if an individual could provide the password only for the investigation period for investigations with their presence, Foong said the device would generally be taken and sent to another department for forensic tests and the person being investigated is “generally not given the right to sit and watch how the investigation is done”.

“Further, the right to do search and seizure is very wide. They can search the entire computer for all relevant information,” he said, adding that a person who was investigated could opt to sue later on if the search was wrongfully done.

What if I forget my passwords?

Foong said it is a reasonable scenario for anyone to have forgotten their passwords to online accounts as passwords could be saved by the internet browser on a device, adding that authorities could in such cases still access the online account if they have access to the computer which were used to access the account.

“This is because that person’s computer generally would have saved the password unless that person has set it to do otherwise,” he said.

Foong highlighted however that even if an individual refuses to or is unable to furnish passwords to online accounts, they may still find that they are considered under the law as the publisher of the content of an offence unless they can prove they are not the publisher.

“The accused may take the position that they were not the originator of the message or did not do the act and there is no electronic evidence to prove that.

“Nevertheless, the prosecution may still rely on the presumption of publication under Section 114A of the Evidence Act 1950. The presumption of publication provides that a person deemed to be a publisher of a content unless proven otherwise by him or her,” he said.


India wants to monitor, intercept and track WhatsApp messages in a bid to curb the spread of misinformation. As you can imagine, this has caused quite the furore but you might be interested to know that some good could also come from the move.

Produced by: Sumitra Selvaraj
Presented by: Tee Shiao Eek, Sumitra Selvaraj, Sharmilla Ganesan

My Neighbour Is Spying On Me!

In the recent LoyarBurok “Msia I Can Series: The Right To Your Privacy” on BFM Radio, which I have been reliably informed is one of the top hit links on BFM, I told a story about neighbours fighting over CCTVs which faced a neighbour’s house.

In the case of Lew Cher Phow @ Lew Cha Paw & 11 Ors v Pua Yong Yong & Anor, the occupants of a house at Skudai, Johor initiated an action against their neighbour for invasion of privacy sometime in 2007.

In this case, the Defendants had installed CCTVs around their house and one of the CCTVs captured part of the Plaintiffs’ house, notwithstanding that the CCTV also captured the front yard of the Defendants’ house. The Plaintiffs complained that they were being spied on and therefore their right to privacy had been infringed. The Defendants claimed that the CCTVs were for safety reasons.

The Plaintiffs filed an interim injunction against their neighbour requesting that the CCTVs be taken down. However, the application was dismissed by the High Court on the grounds that, among others, the tort of invasion of privacy is not recognised in Malaysia (see Lew Cher Phow @ Lew Cha Paw & 11 Ors v Pua Yong Yong & Anor [2009] 1 LNS 1256).

A different kind of use of CCTV.

The case went to trial and recently the High Court allowed the CCTV to be taken down.

Justice Vernon Ong, like the judges in Maslinda Ishak v. Mohd Tahir Osman & Ors [2009] 6 CLJ 653 (impliedly recognised the tort); Lee Ewe Poh v Dr. Lim Teik Man & Anor [2010] 1 LNS 1162; and Sherrina Nur Elena bt Abdullah v Kent Well Edar Sdn Bhd (Sabah High Court Suit No. K22-187-2009-I (Unreported)), recognised the right to privacy and the tort of invasion of privacy in Malaysia.

According to the learned Judge, the test to determine whether there is an invasion of privacy of rights is:

Arising from this case are two competing values: safety and privacy. Does the defendants’ fear for their safety and security override the right to privacy of the plaintiffs? Does the CCTV surveillance constitute an intrusion or interference with plaintiffs’ right to respect for their private and family life and their home? Is the CCTV surveillance an unreasonable intrusion upon the privacy of the plaintiffs?

Ultimately this is a question of balance between the rights of the owner of the CCTV camera (the defendants) and the CCTV camera’s target (the plaintiffs).

The learned Judge held that the balance lies on the Plaintiffs. The right to privacy is a fundamental human right. On the peculiar facts of this case, the right to privacy consists of the plaintiffs’ right to private and family life and home. This is a basic right and need which everyone cherishes and holds dear. The well known saying that a man’s home is his castle holds true.

The recognition of privacy rights and invasion of the same have a tremendous impact to Malaysians. This would include the following:

  1. Employees’ right to privacy. Employers would now have to take into account of the same. Each task which affects employees’ privacy will need to be subject to a privacy impact assessment.
  2. Public authorities’ investigation powers. They now would need to take into account of an individuals’ rights. They cannot force suspects or witnesses (like Teoh Beng Hock‘s case) to reveal their personal email and computer.
  3. Celebrities’ right to privacy.
  4. Media’s right to express themselves. Media will now have to take into account of any individuals’ privacy right when reporting stories. Most litigations involving privacy rights in United Kingdom are fought by the media.
  5. The advent of Superinjunctions? Superinjunction, also known as a gagging order, refers to an order that prevents any parties from reporting details of a court case including mentioning the fact that the injunction has been taken out. This injunction was taken by many UK celebrities. Footballers John Terry and Michael Owen are known to have taken a superinjunction over their alleged extramarital affairs.
  6. Bloggers’ rights. As a consequence to the effect on authorities, bloggers’ private information such as password to their personal email and computer data are protected by the right to privacy. Authorities must take measures to ensure that their investigation does not affect the bloggers’ privacy right. However, a blogger’s identity is not protected by right to privacy (see The Author of A Blog v Times Newspapers Ltd [2009] EWHC 1358 (QB) (16 June 2009))

The above list is non exhaustive. It is interesting to see how the right of privacy will develop further in Malaysia.

Download Written Judgement of Lew Cher Phow @ Lew Cha Paw & 11 Ors v Pua Yong Yong & Anor by Justice Vernon Ong.

 Scroll to top