|
Charter - Section 8 - Informational Privacy. R. v. Bykovets
In R. v. Bykovets (SCC, 2024) the Supreme Court of Canada considers an important case on Charter s.8 ["unreasonable search or seizure"] and the internet, specifically the police requesting IP addresses used in certain credit card transactions from third parties without a warrant.
Here, the court holds that requests for IP addresses from third parties constitute a 'search', and thus require a warrant (ie. prior judicial authorization):[85] In my view, however, requiring that police obtain prior judicial authorization before obtaining an IP address is not an onerous investigative step, and it would not unduly interfere with law enforcement’s ability to deal with this crime. Where the IP address, or the subscriber information, is sufficiently linked to the commission of a crime, judicial authorization is readily available and adds little to the information police must already provide for a Spencer production order. For example, under s. 487.015(1) of the Criminal Code, R.S.C. 1985, c. C-46, a production order for information relating to a specified transmission of a communication is available if there are reasonable grounds to suspect that an offence has been or will be committed. Police often apply for and obtain multiple authorizations to protect different territorial privacy interests. The same is true to protect informational privacy.
[86] On balance, the burden imposed on the state by recognizing a reasonable expectation of privacy in IP addresses pales compared to the substantial privacy concerns implicated in this case. Law enforcement will need to demonstrate enough grounds to intrude on an individual’s privacy but, in the age of telewarrants and around-the-clock access to justices of the peace, this burden is not onerous. Police engaging in legitimate investigatory activities can readily establish the requisite constitutional grounds. Recognizing that an IP address attracts s. 8 protection will not thwart police investigations involving IP addresses; rather, it aims to make sure police investigations better reflect what each reasonable Canadian expects from a privacy perspective and from a crime control perspective.
[87] A reasonable expectation of privacy limits the state to searches motivated by legitimate law enforcement concerns. The benefits to privacy are significant. Judicial pre-authorization considerably narrows the state’s online reach and prevents it from acquiring the details of a user’s online life revealed by their IP address that are not relevant to the investigation. This significantly reduces the potential of any “arbitrary and even discriminatory” exercises of discretion that would empower the state to identify information about any Internet user it pleases for any reason it sees fit (L. M. Austin, “Getting Past Privacy? Surveillance, the Charter, and the Rule of Law” (2012), 27 C.J.L.S. 381, at p. 392). In a democratic society, it is “inconceivable that the state should have unrestricted discretion to target whomever it wishes for surreptitious [digital] surveillance” (R. v. Wong, 1990 CanLII 56 (SCC), [1990] 3 S.C.R. 36, at p. 47).
[88] Judicial oversight in respect of an IP address is the way to accomplish s. 8’s goal of preventing infringements on privacy. Since Hunter, we have held that s. 8 seeks to prevent breaches of privacy, not to condemn or condone breaches after the fact based on the state’s use of that information. Privacy, once breached, cannot be restored.
[89] Finally, judicial oversight removes the decision to disclose information — and how much to disclose — from private corporations and returns it to the purview of the Charter. The increase in state power occasioned by the Internet is thus offset by a broad, purposive approach to s. 8 that meets our “new social, political and historical realities” (Hunter, at p. 155). To leave it to the private sector to decide whether to provide police with information that may betray our most intimate selves strikes an unacceptable blow to s. 8. To leave the protection of the Charter to the next intended step in the investigation is insufficient. As I have explained, the next step might be too late.
[90] Thus, viewed normatively, s. 8 of the Charter ought to extend a reasonable expectation of privacy to IP addresses. They provide the state with the means through which to obtain information of a deeply personal nature about a specific Internet user and, ultimately, their identity whether or not another warrant is required. An IP address plays an integral role in maintaining privacy on the Internet. It is the key to unlocking an Internet user’s online activity and the key to identifying the user behind online activity. Given these serious privacy concerns, the public’s interest in being left alone should prevail over the relatively straightforward burden imposed on law enforcement. Recognizing a reasonable expectation of privacy in IP addresses would ensure that the veil of privacy all Canadians expect when they access the Internet is only lifted when an independent judicial officer is satisfied that providing this information to the state will serve a legitimate law enforcement purpose.
[91] In my view, the reasonable and informed person concerned about the long‑term consequences of government action for the protection of privacy would conclude that IP addresses should attract a reasonable expectation of privacy. Extending s. 8’s reach to IP addresses protects the first “digital breadcrumb” and therefore obscures the trail of an Internet user’s journey through the cyberspace.
V. Disposition
[92] I would find the request by the state for an IP address is a search under s. 8 of the Charter. I would allow the appeal, set aside the conviction, and order a new trial. . R. v. Bykovets
In R. v. Bykovets (SCC, 2024) the Supreme Court of Canada considers an important case on Charter s.8 ["unreasonable search or seizure"] and the internet, specifically the police requesting IP addresses used in certain credit card transactions from third parties without a warrant. At paras 44-84 the court considers whether an expectation of privacy was 'reasonable'.
. R. v. Bykovets
In R. v. Bykovets (SCC, 2024) the Supreme Court of Canada considers an important case on Charter s.8 ["unreasonable search or seizure"] and the internet, specifically the police requesting IP addresses used in certain credit card transactions from third parties without a warrant.
Here, the court discusses the importance of characterizing the 'subject-matter' of the police interest realistically:[38] This Court has never described the constitutional right to privacy according to the state’s declared intention, or according to one particular use of the information. Rather, we have consistently taken a broad and functional approach to the subject matter of the search, “examining the connection between the police investigative technique and the privacy interest at stake” (Spencer, at para. 26). The subject matter is defined not only in terms of the information itself, but also “the tendency of information sought to support inferences in relation to other personal information” (para. 31). In Marakah, for example, the issue was whether the sender of a text message has a reasonable expectation of privacy in that text message on the recipient’s device. Writing for the majority, McLachlin C.J. determined that the subject matter of the search was not the recipient’s telephone, or even the text message itself, but an “electronic conversation” including “any inferences about associations and activities that can be drawn from that information” (para. 20).
[39] Courts must be especially careful in describing the subject matter of a search touching electronic data (Marakah, at para. 14). In R. v. Cole, 2012 SCC 53, [2012] 3 S.C.R. 34, where police had examined the contents of a computer, this Court described the subject matter of the alleged search as “the data, or informational content of the laptop . . . not the devic[e] [itself]” (para. 41 (emphasis in original)).
[40] Similarly, in Reeves, where police had seized the appellant’s shared home computer, the search was not merely for the computer itself, but “ultimately the data it contained about Reeves’ usage, including the files he accessed, saved and deleted” (para. 30). The state engaged s. 8 by seizing the computer even though police needed a warrant to search its contents because, through the seizure, police “obtained the means through which to access [highly private] information” (para. 34).
[41] The same is true here. Police were not “really after” IP addresses in the abstract. As “a collection of numbers”, an IP address is of no interest to police. Rather, police were after the information an IP address tends to reveal about a specific Internet user including their online activity and, ultimately, their identity “as the source, possessor or user of that information” (Spencer, at para. 47). As the identifier of Internet-connected activity originating at a specific location, an IP address is a powerful tool that allows the state — with or without another warrant — to collect a user’s Internet activity over the time period a particular IP address is linked to that source. Thus, as in Reeves, an IP address provided the state with the means through which to draw immediate and direct inferences about the user behind specific Internet activity. The information inferred from a device’s Internet activity can be deeply personal, including linking that activity to a particular user’s identity (see Spencer, at para. 47).
[42] This description takes a broad and functional view of the subject matter. By “properly avoid[ing] a mechanical approach that defines the subject matter in terms of physical acts, spaces, or modalities of [informational] transmission”, it “reflects the technological reality” (Marakah, at para. 17). This description does not extend the shield of Charter protection to every investigatory step. Instead, it affirms that investigative techniques that reveal seemingly innocuous information must still be examined in connection with the privacy interest at stake (Spencer, at para. 26). Recognizing that police wanted the IP address — as the link between a specific subscriber and location and particular Internet activity — to obtain more information about the user lets the court assess the expectation of privacy in relation to all the information this IP address “tends to reveal” (Spencer, at para. 27 (emphasis in original), quoting R. v. Plant, 1993 CanLII 70 (SCC), [1993] 3 S.C.R. 281, at p. 293), and, therefore “by reference to the nature of the privacy interests potentially compromised by the state action” (Marakah, at para. 15, citing Ward, at para. 65 (emphasis added)).
[43] Thus, the subject matter of this alleged search is an IP address as the key to obtaining more information about a particular Internet user including their online activity and, ultimately, their identity as the source of that information. Here, police sought to obtain that information through a production order as contemplated by Spencer. But, as the expert report states, a Spencer warrant is not the only way an IP address can reveal intimate details of an Internet user’s lifestyle and personal choices. Online activity associated to the IP address may itself betray highly personal information without the safeguards of judicial pre-authorization. I turn to that issue next.
|
