Section 49 to force key disclosure should only happen if:
+ The person being given the notice has the key
+ Investigators need the key to prevent or detect crime
+ Disclosure is proportionate
+ They can't get the encrypted material by other means
Not complying with the is a criminal offence. The maximum sentence is 2 years, unless it's a case involving child sexual exploitation or national security where the maximum sentence is 5 years.
There is a code of practice for use of these powers here: https://www.gov.uk/government/publications/code-of-practice-...
I think that properly regulated key disclosure powers are important. I'm not sure we're (the UK) are getting it right with RIPA. I'd want to see stronger audit and oversight of the S49 notices, and better advice given to people who are served S49 notices.
For example: I have no idea how many people are served S49 notices, and I don't really know how to find out. I don't know how many people have been imprisoned for not disclosing keys; I don't know what sentences they've been given; and I'm not clear on how to find that out. I feel that it should be easier for citizens to have clear data about these really intrusive powers.
EDIT: I just found this page, and it seems like it's small numbers of people. But still, it's a bit worrying. https://wiki.openrightsgroup.org/wiki/Regulation_of_Investig...