Compelled production of a passcode for a digital device by state authorities violates the right to silence under s. 7 of the Canadian Charter of Rights and Freedoms. But whether the compelled use of biometrics yields the same result has been an open question. And a recent ruling of the Ontario Court of Justice concluding that both are testimonial is a result achieved by asking the wrong question.

1. Introduction

On March 16, 2026, Justice Trevor Brown of the Ontario Court of Justice issued an endorsement denying an application for a general warrant to compel the target to participate in defeating passcode protection or encryption of any seized digital device by providing a fingerprint or thumbprint to unlock the device or by posing for the camera to trigger the facial recognition software. In reasons indexed as Application for Biometrics Scanning as part of a General Warrant (Re), Justice Brown held that the proposed biometrics scan would violate the right to silence and the protection against self-incrimination. (here) The ruling is an important extension of the law governing “testimonial compulsion” that compelled disclosure of a passcode is testimonial but compelled use of a fingerprint or other biometrics is not. The case presents an opportunity to consider an issue I discussed in previous posts to On The Wire. (here and here)

2. Background

The compelled unlocking of electronic devices is a slowly developing area in Canadian and American jurisprudence dominated by trial court rulings and some appellate opinions. Three reported decisions by Canadian courts were considered by Justice Brown. In R. v. Boudreau-Fontaine the police obtained a search warrant for electronic devices seized from the respondent. (here) The warrant contained a term requiring him to provide the passcode to a laptop computer. He complied. The Quebec Court of Appeal held that the warrant commanded him to give “crucial information” to the police contrary to the right to silence and the protection against self-incrimination. His statement identifying the passcode was inadmissible and the subsequent seizure of data was unreasonable in violation of s. 8 of the Charter.

In R. v. Talbot the Crown applied for an assistance order under s. 487.02 of the Criminal Code to compel the defendant to assist the police by providing the passcode to his cellphone. (here) Justice Cecile Applegate of the Ontario Court of Justice observed that case law in the United States has drawn a distinction between the physical act of providing a fingerprint and the mental act of providing a passcode. “There has been more resistance with ordering the latter,” he concluded, “given that it forces targets to impart their knowledge of what is solely created and stored in their minds.” Justice Applegate held that the compelled participation was “particularly intrusive” forcing the defendant to communicate information to the police that “solely exists in his head” as opposed to “passively providing” some physical characteristic such as a DNA sample, fingerprints or a breath sample.

In R. v. Shergill the Crown also applied for an assistance order to compel the defendant to provide the passcode to his BlackBerry that was seized by the police incidental to his arrest. (here) Justice Philip Downes rejected the suggestion that the police were seeking an act rather than a form of speech. “The distinguishing feature in this case is the testimonial nature of the compulsion contemplated by the assistance order,” he said. “Mr. Shergill will be required in effect to ‘speak his mind’ to the police. His assistance can only come about through an utterance conveying a thought in his head.” It was the compelled utterance that distinguished the case from other provisions of the Code requiring participation of a defendant in providing evidence such as breath samples. Justice Downes concluded that the data on the BlackBerry “must be protected by derivative use immunity” to avoid a violation of s. 7 of the Charter.

I will round out this review of the case law with reference to two opinions from the United States Court of Appeals; U.S. v. Payne, a 2024 opinion of the Ninth Circuit and U.S. v. Brown, a 2025 opinion of the District of Columbia Circuit. (here and here) The rulings in Payne and Brown were decided after U.S. v. Hubbell where the United States Supreme Court held that compelled disclosure of a passcode was testimonial. It violated the Fifth Amendment because it was “unquestionably necessary for respondent to make extensive use of ‘the contents of his own mind’. […]” (here) However, the Hubbell court did not consider whether compelled use of fingerprints or other biometrics such as facial recognition technology were also testimonial.

In Payne, the Ninth Circuit held that the compelled use of a biometric during an arrest was not testimonial because it required no cognitive exertion “placing it in the same category as a blood draw or a fingerprint taken at booking.” The Fifth Amendment therefore did not apply. Nor did the police violate the Fourth Amendment when an officer grabbed Mr. Payne’s thumb and used it to unlock his cellphone. Mr. Payne was on parole and had “a significantly diminished expectation of privacy.” A condition of his parole required him to surrender any electronic device to a police officer for inspection. The condition was reasonable under the Fourth Amendment “even considering the way [the officer] accessed its contents.”

In Brown, the District of Columbia Circuit came to the opposite conclusion finding that the compelled use of a thumbprint by a co-defendant, Peter Schwartz, was testimonial. First, under the physical trait cases, the court held that the compelled use of fingerprints communicates knowledge about ownership and means of access unlike blood draws or fingerprinting. It was “much closer to responding to a lie detector test.” Second, under the act of production doctrine, Mr. Schwartz’s response disclosed information about his control over the phone, and his knowledge about how to access it, which was tantamount to answering questions about ownership or control of the device. The act of unlocking the phone represented the thoughts “I know how to open the phone,” “I have control over and access to this phone,” and “the print of this specific finger is the password to this phone.” The compelled opening of the cellphone was no different than if Mr. Schwartz was made to say “yes”, an answer that would be a testimonial communication.

It is apparent from the conflicting case law that whether compelled use of a biometric is testimonial in violation of s. 7 of the Charter and the self-incrimination clause of the Fifth Amendment is a question ripe for consideration by the Supreme Courts of Canada and the United States. In a post to the Center for Democracy & Technology website titled Circuit Court Split Lays the Groundwork for SCOTUS Case on Biometric Cell Phone Unlocking, Tom Bowman said a national standard for unlocking secured devices “would have significant implications for digital privacy because law enforcement has long argued that its inability to open locked devices justifies its arsenal of backdoor access tools.” (here)

3. Use Immunity

Canadian courts have often implemented “use immunity” measures to achieve a balance between the state’s search for the truth and the citizen’s right to silence. In Talbot, the Crown suggested that the court could impose conditions of use immunity pertaining to the details of the swipe pattern, the fact that it unlocked the cellphone and the defendant’s connection with the swipe pattern.  In Shergill, the Crown similarly argued that self-incrimination concerns could be met by the grant of immunity over the defendant’s knowledge of the passcode. And in Application for Biometrics Scanning, the police undertook to “guarantee” that the unlocking by the defendant would not be used against him. All three courts rejected the proposed immunity. In Shergill, Justice Downes suggested that the inquiry is with respect to the purpose for which testimony is desired by the state. “[I]t seems clear,” he said, “that if the predominant purpose of the state action is to incriminate the person who is being compelled to speak, then the violation will at least be harder to justify through the guarantee of some form of immunity.”

4. Asking the Wrong Question

Is there, then, any real distinction between compelled disclosure of a passcode and compelled use of biometrics? That question brings me to the point of this post. In Application for Biometrics Scanning, Justice Brown concluded that fingerprint locks and facial recognition locks are shortcuts of the same thing – the deliberate input of a passcode that exists only in the user’s mind. “Whether being required to utter the password itself to authorities, to input manually the password on the device, or to provide their finger, thumb or face to the police to assist in unlocking the device, these are all part and parcel of the same testimonial compulsion,” he said. “They all compel the Target to participate in their own incrimination by providing the information held only by them.” The affiant’s assertion that the proposed biometrics scan did not compel disclosure of a passcode and only required “passive participation” was a “difference without a distinction.” That is the ratio decedendi of Justice Brown’s endorsement and I have concluded it is wrongly decided.

Let’s consider the difference with a distinction. A passcode for an electronic device exists only in the user’s mind. Compelled disclosure of a passcode would therefore violate the user’s right to silence under s. 7 of the Charter. In R. v. Hebert, the Supreme Court of Canada held that the theme underlying the right to silence is “the idea that a person in the power of the state in the course of the criminal process has the right to choose whether to speak to the police or remain silent.” (here) But the compelled use of biometrics is not “speaking”. The Ninth Circuit got it right in Payne that compelled use of a fingerprint is not testimonial and not protected under the Fifth Amendment. And Justice Brown erred in Application for Biometrics Scanning by conflating a “finger, thumb or face” with “utter[ing] the password”. Simply put, they are not part of “the same testimonial compulsion.”

Although compelled use of biometrics is not the same as speaking a passcode, they are, however, functionally equivalent. Both will give law enforcement access to a vast trove of personal information stored on cellphones. They are the gateway to what the police in all these cases were really after – the data stored on the devices. The right question, then, is not whether the compelled use of biometrics violates s. 7 but whether it violates s. 8. An assistance order compelling a defendant to provide a fingerprint or activate facial recognition technology authorizes an unreasonable seizure because the manner of the search is unreasonable under the test in R. v. Edwards. (here) And that takes us to R. v. Bykovets where Justice Andromache Karakatsanis, writing for a majority of the Supreme Court of Canada, reaffirmed that s. 8 is defined “in terms of what privacy should be – in a free, democratic, and open society – balancing the individual’s right to be left alone against the community’s insistence on protection.” (here) The opinion in Bykovets post dated Boudreau-Fontaine, Talbot and Shergill and was not considered by Justice Brown in Application for Biometrics Scanning.

In Bykovets, Justice Karakatsanis reiterated the court’s broad and functional approach to the subject matter of the search “examining the connection between the police investigative technique and the privacy interest at stake.” The police were not “really after” IP addresses in the abstract. They were after the information an IP address tends to reveal. So too in Application for Biometrics Scanning. The police were not really after a thumbprint. They were after the information a thumbprint would reveal. By avoiding a mechanical approach that defines the subject matter in terms of “physical acts, spaces or modalities of [information] transmission”, Justice Karakatsanis concluded that the appellant had a reasonable expectation of privacy in his IP address and thus reached a result that “reflects the technological reality”. The right question is therefore whether the compelled use of biometrics is an unreasonable search or seizure.

5. Conclusion

Lower courts in the United States are divided on whether biometric features are functionally the same as a passcode and therefore testimonial in nature under the Fifth Amendment. In U.S. v. Wright it was held that “a biometric feature is functionally the same as a passcode, and because telling a law enforcement officer your passcode would be testimonial, so too must the compelled use of your biometric feature [facial recognition] to unlock a device.” (here and here) In Canadian constitutional law, however, it is not necessary for the courts to determine whether fingers can do the talking. The subject matter of a cellphone search is the data that resides on electronic devices and what it may reveal about the user – the “informational content” that individuals in a free and democratic society wish to maintain and control from dissemination to the state. The jurisprudence on that question resides more comfortably in the domain of s. 8 of the Charter. It is, fundamentally, a question of self-determination and not one of self-incrimination.