Internet Users Have Expectation of Privacy In IP Address: 3 Take-Aways
Published:
March 14, 2024
Author(s):
On March 1, 2024, the Supreme Court of Canada decided a police request for disclosure of an IP address is a “search” under section 8 of the Canadian Charter of Rights and Freedoms – and police require a court order to obtain it. The decision in R. v. Bykovets will likely motivate Canadian police to clamor for an alternative to production orders to facilitate access to this kind of information, as they have in the past under the name “lawful access”. In the meantime, companies are wise to require a legally enforceable production order or a Missing Persons Act order before providing Canadian law enforcement with any customer information, including IP addresses, basic subscriber information (BSI) and the like. And while the Court’s decision is about police’s ability to obtain the information and make use of it in a prosecution, there’s a good chance courts will treat it as authority for requiring service providers and intermediaries to closely scrutinize any requests to provide information to law enforcement. Here’s a look at the decision and three key privacy law take-aways.
In R. v. Bykovets, police were investigating fraudulent online purchases made from a liquor store. Police approached the store’s payment processor and asked for the IP addresses associated with the fraudulent transactions. The payments processor voluntarily handed the information over. Police then sought and obtained a production order requiring the internet service provider to provide the customer’s name and address associated with the IP addresses (a.k.a. a “Spencer Order” named for the 2014 Supreme Court of Canada decision that held police require a court order to get the customer name and address associated with a particular IP address from a particular time). Police arrested and charged the customer with criminal offences. At their trial, the customer argued getting the IP addresses was a “search” under section 8 of the Charter, which protects everyone from unreasonable searches and seizures. Police could therefore only get the IP addresses with a production order or if there were “exigent circumstances”. The trial court decided the customer didn’t have a reasonable expectation of privacy in the IP addresses held by the payments processor, so police didn’t require a production order to get them. A majority of the Alberta Court of Appeal agreed, with one judge disagreeing. But a majority of the Supreme Court of Canada (five of the nine judges) did not. The Court decided a request by police for an IP address is a “search” under section 8 of the Charter and police require a Criminal Code of Canada production order to get them.
Here are three key privacy law take-aways from the decision in R. v. Bykovets.
Modern Society. The decision recognizes and reflects the realities of today’s digital world. Third parties often hold a lot of information about people that they’ve “incidentally” collected because of technology. The Court expressly recognized that living in today’s digital world requires people do much online, necessitating disclosing IP address information to a range of third parties. The Court noted an IP address is the link between an Internet user and their online activity that might not directly identify an individual but can be connected to an individual or from which their behaviour can be inferred by analysis of data associated with the IP address use. The Court reasoned that for section 8 to meaningfully protect Canadians’ online privacy in today’s digital world it must protect their IP address – and leaving to private corporations the decision whether to disclose this information that “may betray our most intimate selves” to police isn’t acceptable. The Court concluded that recognizing a reasonable expectation of privacy in IP addresses ensures the “veil of privacy” Canadians expect when they access the Internet is lifted only when an independent court is satisfied that providing it to the government serves a legitimate law enforcement purpose.
Lawful Authority. It’s important to remember that police generally bear the risk whether they can obtain the information sought and subsequently use it in a prosecution. This decision didn’t focus on the payments processor and whether its disclosure to police was “lawful”. In Alberta, where this case originated, the payments processor would be subject to the Alberta Personal Information Protection Act, which permits disclosure to a Canadian law enforcement agency to assist in an investigation undertaken with either a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result. However, the federal privacy law (the Personal Information Protection and Electronic Documents Act or PIPEDA, soon to be replaced by the Consumer Privacy Protection Act or CPPA) only permits the disclosure where “required by law”. The Court’s 2014 Spencer decision found the reference to “lawful authority” in PIPEDA must be something substantially more than just a legitimate police investigation. A Criminal Code production order creates such a lawful compulsion and satisfies the “required by law” test. The Court’s conclusion indicates it remains vigilant about reasonable expectations of privacy for the purposes of section 8 of the Charter in a time of evolving technologies when information is increasingly spread to third party repositories – and that these repositories are not available to law enforcement to access without judicial authorization.
Exigent Circumstances. Even without a court order, Canadian Police can still lawfully require third parties to provide IP logs in exigent circumstances. Under PIDEDA, those holding personal information can voluntarily make such a disclosure to a person “who needs the information because of an emergency that threatens the life, health or security of an individual and, if the individual whom the information is about is alive, the organization informs that individual in writing without delay of the disclosure.” For example, an imminent risk of serious self-harm by a user would likely constitute such exigent circumstances. However, absent such exigent circumstances a court order or other legal compulsion (such as a production order or Missing Persons Act order is required to require disclosure of IP address logs.
Please contact your McInnes Cooper lawyer or any member of our Privacy, Data Protection & Cyber Security Team @ McInnes Cooper to discuss whether and when you should disclose information to law enforcement.
Related Lawyers
Related Services
Related Industries
McInnes Cooper has prepared this document for information only; it is not intended to be legal advice. You should consult McInnes Cooper about your unique circumstances before acting on this information. McInnes Cooper excludes all liability for anything contained in this document and any use you make of it.
© McInnes Cooper, 2024. All rights reserved. McInnes Cooper owns the copyright in this document. You may reproduce and distribute this document in its entirety as long as you do not alter the form or the content and you give McInnes Cooper credit for it. You must obtain McInnes Cooper’s consent for any other form of reproduction or distribution. Email us at [email protected] to request our consent.
