Reporting abuse or a sexual offence: requests for your phone

This page is for a person who has reported an offence and is asked for their own phone. Nothing on it tells you to agree or to refuse; it sets out what the Act and the Code say, in their words. Section 37(1) of the Police, Crime, Sentencing and Courts Act 2022 says an authorised person may extract information stored on an electronic device from that device if a user of the device has voluntarily provided the device to an authorised person, and that user has agreed to the extraction of information from the device by an authorised person. The power and its conditions are covered on the PCSC page.

The Code says it “only applies as regards the powers in Chapter 3 of Part 2 of the Act” and that “If another power is being used as the basis for extracting information from an electronic device, the guidance/code for that power will apply.” Read every Code paragraph quoted below with that scope in mind. A phone taken under a seizure power is a different situation: see extraction after seizure.

Section 207(2) says sections 37 to 44 (and Schedule 3) extend to England and Wales, Scotland and Northern Ireland. For Scotland, see seizure and cyber kiosks in Scotland.

Section 39(1) says a person (‘P’) is treated for the purposes of section 37 or 38 as having voluntarily provided an electronic device to an authorised person and agreed to the extraction of information from it only if the requirements of section 39 have been met. Under section 39(3), an authorised person must have given P notice in writing specifying or describing the information that is sought; specifying the reason why the information is sought; specifying how the information will be dealt with once it has been extracted; stating that P may refuse to provide the device or agree to the extraction of information from it; and stating that the investigation or enquiry for the purposes of which the information is sought will not be brought to an end merely because P refuses to provide the device or agree to the extraction of information from it. Paragraphs (d) and (e) are worded as things the written notice must state, in the Act’s words.

Section 39(2) says an authorised person must not have placed undue pressure on P to provide the device or agree to the extraction of information from it. The Code says the individual must not have had any undue pressure placed on them or been coerced by anyone (including an authorised person) to provide the device or agree to the extraction of information from it. It describes “undue pressure” as making the person feel as though they do not have a choice about volunteering the device and agreeing to extraction, and says there may be cases where the information on the device is the only remaining reasonable line of enquiry, which should be clearly explained to the individual; and that it is recognised that in some circumstances the very act of making a request for a device and the extraction of information from it may make the victim or witness feel a degree of pressure, which the authorised person should take into account when communicating the reason for the request.

Section 39(4) to (7) sets further requirements for P to be treated as having voluntarily provided the device and agreed to the extraction. Subject to subsection (5), P must have confirmed in writing that P has voluntarily provided the device and agreed to the extraction. If P was unable to provide that confirmation in writing as a result of P’s physical impairment or lack of literacy skills, P must have given it orally and an authorised person must have recorded it in writing. If the confirmation was given in writing and in hard copy form, the authorised person must have given P a copy of it (in hard copy or electronic form); if it was given orally, the authorised person must have given P a copy of the record of it (in hard copy or electronic form).

Code paragraph 158 says the device user, or the person who has voluntarily provided the device and agreed to the extraction of information from it in accordance with Section 38, has the right to withdraw their agreement for information to be extracted from the device; that it is that individual’s decision to give the authorised person the device and to agree to the extraction, and they can change their mind; and that, in the case of a device that is used by multiple users, only the person who voluntarily provided the device and agreed to the extraction can withdraw that agreement.

Code paragraph 159 says: “It should be made clear that withdrawal of agreement will mean that the device is returned, if the extraction has not already taken place, then the information will not be taken from the device. However, if agreement is withdrawn after the extraction of information has taken place, it may not be possible to delete or return it. This is because of the duties on investigating agencies and prosecution services to disclose information to the defence.”

The Code says that in all cases authorised persons must ensure information extraction is not excessive, minimising intrusion into the device user’s privacy and the privacy of others (paragraph 133), and that in all cases, before exercising the Section 37 power, an authorised person must consider other methods for obtaining the required information that do not have the same level of intrusion (paragraph 191). Paragraph 134 adds that in some cases, it may be necessary to extract a larger subset of information to understand the context of it, for example viewing the conversation immediately before and after a relevant comment.

Paragraph 136 says that where the Section 37 power is used, the device user, or person providing agreement if different, should be offered an opportunity to be present when the extraction takes place. The exceptions are where the authorised persons consider it impractical or inappropriate to do so, or where there are technical limitations that do not allow it.

These are the Code’s words; “should” is its verb in paragraphs 135, 195 and 197, not “must”. Paragraph 135 says authorised persons should make every effort to limit the time that a device user is left without their device. Paragraph 195 says that in all cases where a person has provided agreement to extract information, authorised persons should aim to return a device as quickly as possible; in the case of a rape victim, the device should ideally be returned within 24 hours of “the being taken” (the Code’s wording), and the 24-hour period starts at the point the device is physically transferred to the authority for the extraction. Paragraph 197 says that where a rape victim’s electronic device is taken for examination and it is not possible to return it within 24 hours, they should be provided with a replacement device or support in obtaining one.

Paragraph 159 adds that in all cases the extracted information and the device must only be retained where there is a lawful basis to do so and as long as necessary in line with each authority’s data retention policies and other relevant guidance. What the Code says about deleting information that is not relevant is covered on how long police can keep your phone data.

Section 37(13) says that in this Chapter “child” means a person aged under 18. Section 38 says a child is not to be treated for the purposes of section 37(1) as being capable of voluntarily providing an electronic device to an authorised person for those purposes, or agreeing for those purposes to the extraction of information from the device. If a child is a user of an electronic device, a person who is not a user of the device but is listed in subsection (3) may do both: a parent or guardian of the child or, if the child is in the care of a relevant authority or voluntary organisation, a person representing that authority or organisation, or, if no such person is available, any responsible person who is aged 18 or over other than a relevant authorised person. Before exercising the power by virtue of subsection (2), an authorised person must, so far as it is reasonably practicable to do so, ascertain the views of the child and have regard to any views so ascertained, taking account of the child’s age and maturity. If an authorised person exercises the power under section 37(1) as a result of action taken under subsection (2) by a person within subsection (3)(b), the authorised person must, unless they consider that it is not appropriate to do so, inform a person within subsection (3)(a) that they have exercised the power. Nothing in the section prevents any other user of an electronic device who is not a child or an adult without capacity from voluntarily providing the device to an authorised person for the purposes of section 37(1), or agreeing for those purposes to the extraction of information from the device by an authorised person. The section is subject to section 39.

Section 37(12) says that section 37 does not affect any power relating to the extraction or production of information, or any power to seize any item or obtain any information, conferred by an enactment or rule of law. Code paragraph 193 deals with a vulnerable victim who is involved in an activity where they are a victim but does not see themselves as such: it says that in cases where the only option is to examine a device belonging to someone who does not believe they are a victim, it may be necessary to use a different power to obtain the device that does not rely on the individual’s agreement, and that any use of an alternative power in these circumstances should be carefully considered and must only be used in the case of a victim as a last resort. For what the PACE seizure powers are in England and Wales, see can police take my phone; for Scotland, see seizure and cyber kiosks in Scotland.

Section 37(11) says an authorised person must have regard to the code of practice for the time being in force under section 42 in exercising, or deciding whether to exercise, the power in subsection (1). Section 42(9) and (10) say a failure on the part of an authorised person to act in accordance with the code does not of itself render the person liable to any criminal or civil proceedings, but the code is admissible in evidence in criminal or civil proceedings and a court may take into account a failure to act in accordance with it in determining a question in the proceedings.

See also rightsandlimits.com’s page on victim phone extraction. Related pages on this site: the phone of someone who has died and what a full extraction contains.