June 16, 2014
Stephane Eljarrat, John Bodrug, Jean-Philippe Groleau & Gabriel Querry
(Davies Ward Phillips & Vineberg)
(Reprinted with permission)
On June 13, 2014, the Supreme Court of Canada rendered a key decision in R v. Spencer upholding the right to privacy on the Internet. The Court held that Internet users can reasonably expect that their anonymously undertaken Internet activities remain confidential. It also decided that the authorities’ practice of asking Internet service providers (“ISPs”) to disclose information about their clients pursuant to Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) without a warrant amounted to an unlawful search.
The Spencer decision marks an important development in the protection of privacy in Canada. It is the first decision from the Canadian Supreme Court to establish, in such clear terms, that the searching, by authorities, of data allowing them to find personal information by inference is subject to the fundamental right to privacy.
Facts and Decision
After having found by means of an online search the publicly available Internet Protocol (“IP”) address of a computer that had been used to commit crimes, the police asked the relevant ISP for the subscriber information associated with the IP address. In making that request, the police relied on a provision of PIPEDA that allows an organization to disclose personal information to a government institution “that has made a request for the information [and] identified its lawful authority to obtain the information”.
Based on that subscriber information, the police obtained a warrant to search the suspect’s home and to seize his computer. A search of the computer led the police to incriminating evidence, which the accused attempted to exclude at trial on the ground that the ISP information was obtained by an unlawful search.
The Court unanimously found that the request for information was an unlawful search. However, it refused to exclude the evidence as it believed that its use in this case would not bring the administration of justice into disrepute when considering the seriousness of the offences and the authorities’ sincere belief that their request for information was lawful1. The decision is nonetheless likely to influence the authorities’ reasonable expectations going forward such that evidence gathered in a similar manner in the future is more likely to be excluded.
Expectations of Privacy for Anonymous
The Court looked beyond the information that was specifically requested – such as the name, the address and the telephone number corresponding to an IP address – and considered the potential of that information to reveal intimate details of the lifestyle and personal choices of an individual. In so doing, the Court noted that “it is clear that the tendency of information sought to support inferences in relation to other personal information must be taken into account in characterizing the subject matter of the search.”
In this case, the object of the search was not simply to obtain the identity of one of the ISP’s clients. Rather, the search was mainly intended to link the identity of an Internet subscriber and an IP address to particular Internet activities monitored by the police. Since, in the Court’s view, maintaining anonymity can be essential to ensure the protection of privacy, users can expect that their online activities, anonymously undertaken, remain confidential. In contrast, online activities using one’s real identity are unlikely to yield the same protection.
Although the location where the online activities occur (for instance, at home, at work or in public transportation) is relevant to an Internet subscriber’s reasonable expectation of privacy, it is not determinative. In the Court’s view, “Internet users do not expect their online anonymity to cease when they access the Internet outside their homes, via smartphones, or portable devices.”
Prohibition on the Disclosure of
Personal Information without Consent on Request by the Police
The Court concluded that neither PIPEDA nor the ISP’s terms of service diminished the accused’s expectations of confidentiality of his online activities. By the same token, the Court noted that a simple request for information by the police, without any binding power, is insufficient to set aside the general prohibition for businesses subject to PIPEDA on disclosing personal information regarding their clients without the client’s consent.
However, the Court noted that different considerations may apply when an ISP itself detects illegal activity and, as permitted by PIPEDA, reports it to the police on its own initiative. The Court also added that its decision in Spencer does not address or diminish any existing powers of the police to obtain subscriber information without a warrant in exigent circumstances, notably where the information is required to prevent imminent bodily harm.
The decision reaffirms, as in the recent Vu decision – where the Court determined that a computer search must be specifically authorized by a warrant – the fundamental importance of search warrants and, therefore, of courts to supervise the legality of searches and seizures in the virtual domain. It follows that not all requests for information from authorities are binding. Businesses should seek legal advice before complying with warrantless requests for information about employees or clients.
1 In Canada, when evidence is obtained in a manner that violates the rights and freedoms guaranteed by the Canadian Charter of Rights and Freedoms, a court must exclude the evidence only if its admission would bring the administration of justice into disrepute.
DISCLAIMER: The foregoing is not intended as legal advice and does not establish a solicitor-client relationship. If you wish to obtain legal advice regarding your particular situation, you should retain qualified legal counsel.
For more information about my regulatory services: contact
For more regulatory law updates follow me on Twitter: @CanadaAttorney
Visit my Google+ page for more updates: Canadian Competition & Regulatory Law