In a 5:4 split, a majority of the Supreme Court of Canada recently held in R. v. Bykovets that internet protocol ("IP") addresses1 attract a reasonable expectation of privacy protected by section 8 of the Charter. This decision will have practical implications for law enforcement authorities who will need prior judicial authorization before requesting IP addresses and for private organizations such as internet service providers, search engines, generative AI providers, and online advertising companies if the majority's reasons also influence the development and interpretation of Canadian privacy laws. The decision could be especially impactful on the interpretation of PIPEDA and the amendments proposed in Bill C-27 to enact the Consumer Privacy Protection Act (CPPA).
Facts
The case involved a police investigation into fraudulent online purchases from a liquor store. Prior to seeking a production order under the Criminal Code, police contacted the store's third-party payment processing company to ask for the IP addresses used for the alleged fraudulent transactions, which the company voluntarily provided. Police then used the IP addresses to obtain a "Spencer warrant", i.e., a court order, compelling Mr. Bykovets' internet service provider to disclose the subscriber information—name and residential address—associated with the IP addresses and executed a search warrant for Mr. Bykovets and his father.
At trial, Mr. Bykovets argued unsuccessfully that the police's request for IP addresses from the third-party payment processing company violated his right against unreasonable search and seizure under section 8 of the Charter. The Alberta Court of Appeal upheld the trial court's decision and held that section 8 did not apply because an IP address alone does not provide any information about a person's lifestyle or core biographical information, and therefore Mr. Bykovets had no reasonable expectation of privacy in the IP address.
The Majority's Decision
The issue on appeal before the Supreme Court was whether the request for the IP addresses was a "search".2 A search occurs where the state invades a "reasonable expectation of privacy".
A 5:4 majority of the Supreme Court overturned the Court of Appeal's decision and held that Mr. Bykovets had a reasonable expectation of privacy in his IP addresses and therefore the police violated section 8 by obtaining his IP address without prior judicial authorization.
The majority analyzed whether IP addresses attract a reasonable expectation of privacy by considering both (1) the subject matter of the search (i.e., the nature of an IP address); and (2) whether Mr. Bykovets' expectation of privacy in that subject matter was objectively reasonable.
Addressing the question of whether there is a reasonable expectation of privacy in an IP address, the Supreme Court emphasized that Section 8 protects informational privacy: the claim of individuals, groups, or institutions to determine for themselves when, how and to what extent information about them is communicated to others. This includes "a biographical core of personal information which individuals in a free and democratic society would wish to maintain and control from dissemination to the state".
In the views of the majority, section 8 has the capacity to adjust to the increasing importance of information aggregated by private third parties. As summarized in the decision:
The ubiquity of the Internet means we must increasingly consider "the ways in which different data sets in combination with other data sets affect privacy rights"... Not only does the Internet keep an accurate permanent record, it has concentrated this mass of data in the hands of third parties, investing these third parties with immense informational power. It has given large private corporations the ability to collect vast stores of user information and to aggregate that data into sharp images of their users' online activity to determine what their users want and when they want it. In exchange, these corporations are "building possibly the most lasting, ponderous, and significant cultural artifact in the history of humankind"... By concentrating this mass of information with private third parties and granting them the tools to aggregate and dissect that data, the Internet has essentially altered the topography of privacy under the Charter. It has added a third party to the constitutional ecosystem, making the horizontal relationship between the individual and the state tripartite. Though third parties are not themselves subject to section 8, they "mediat[e] a relationship which is directly governed by the Charter — that between the defendant and police".
Regarding the subject matter of the search, the majority stated that courts must consider not only the information searched, but also any personal information that could be inferred from the information searched. In this context, the majority stated that police often seek IP addresses "as the key to obtaining more information about a particular Internet user including their online activity and, ultimately, their identity". The "potential to reveal personal or biographical core information" is enough to trigger Section 8 protection.
In assessing the reasonable expectations of privacy in IP addresses, the majority of the Court repeated on five separate occasions, that an IP address is "the first digital breadcrumb that can lead the state on the trail of an individual's Internet activity". While a given IP address may not necessarily reveal any personal information in itself, when connected to other information available over the Internet or in the possession of third parties, it can "betray deeply personal information, even before police try to link the address to the user's identity" and thereby serve as a "means" of "establish[ing] an Internet user's entire daily, weekly, or even monthly online activity, leading to an electronic roadmap of the user's cybernetic peregrinations".
The Court explained:
The reasonable expectation of privacy analysis revolves around the potential of a particular subject matter to reveal an individual's biographical core to the state, not whether the IP addresses revealed information about the appellant on these facts.
IP addresses play a crucial role in the inherent structure of the Internet. They are the means by which Internet-connected devices both send and receive data. As such, they are the key to unlocking an Internet user's online activity — the first 'digital breadcrumbs' on the user's cybernetic trail. (emphasis in original, citations omitted)
Regarding the objective reasonableness of a subjective expectation of privacy in an IP address, the majority rejected the Crown's argument that such an expectation is unreasonable because the Court's prior ruling in R. v. Spencer requires police to obtain a warrant to obtain the internet user's name and address from the internet service provider. Rather, the majority held that before ever obtaining a Spencer warrant for the user's subscriber information, accessing an IP address allows police to access "deeply revealing" information ranging from shopping habits to dating history, which police can often use to infer the user's identity.
Given the capacity for intrusion into a person's private life, the majority concluded that "requiring that police obtain prior judicial authorization before obtaining an IP address is not an onerous investigative step". Judicial oversight "considerably narrows the state's online reach" and "removes the decision to disclose information — and how much to disclose — from private corporations and returns it to the purview of the Charter". Ultimately, according to the majority, Canadian society does not expect the "intimately private version of ourselves" revealed by our internet searches to "spill over into the offline world".
The majority concluded that section 8 protects IP addresses by recognizing that persons have a reasonable expectation of privacy in them. In the result, the Court ordered a new trial because the police violated this reasonable expectation.
The Dissenting Reasons
Four dissenting justices would have held that the IP addresses in this case did not attract a reasonable expectation of privacy because the search revealed nothing more than the IP addresses and the associated internet service providers. Unlike the majority, the dissent considered that the requirement to obtain a Spencer warrant provides adequate protection: it ensures police cannot obtain subscriber information from internet service providers or internet activity associated with IP addresses from third-party websites without prior judicial authorization.
Key Takeaways
The majority's approach recognizes the often interconnected nature of information on the internet. The majority's approach holds that although IP addresses do not themselves say much (if anything) about an identifiable person, they can be revealing when combined with, or potentially combined, other information. Thus, in the context of section 8 of the Charter, which generally applies only against the state, IP addresses attract a reasonable expectation of privacy.
The majority's decision also recognizes the unique and complex role that private organizations play in today's digital society, as "the Internet has fundamentally altered the topography of informational privacy under the Charter by introducing third-party mediators between the individual and the state — mediators that are not themselves subject to the Charter".
The majority observed that private organizations often receive requests for information about internet-related activities from law enforcement authorities, and are often in a position to provide a wide variety of internet-related information to those authorities. In view of the decision, private organizations will have to rethink whether they are able to share such information. While this case focuses on the importance of IP addresses to privacy, and subjects them to Charter protection from searches, they are now just one example of "digital breadcrumbs" that may be subject to Charter protection. Future cases will undoubtedly focus on other data, potentially including user profiles, location data and ad network data including browsing and shopping histories, even when the data is anonymized and could only reveal personal information about individuals when matched with other publicly available information.
Further, it is very common for police to use forensic tools to collect IP addresses when doing investigations. This is common, for example, in investigations involving child pornography. While such investigations were not in issue in the case, the decision raises the further question as to whether such investigations will also be impacted.
The majority's decision resolves a longstanding debate about whether IP addresses attract a reasonable expectation of privacy. Before this decision, a number of lower courts had held that IP addresses, by themselves and without an ability to link them to any individual, generally attract no reasonable expectation of privacy for Charter purposes. But the majority's decision holds that IP addresses attract a reasonable expectation of privacy under section 8 of the Charter. From a practical perspective, this means that law enforcement authorities will need prior judicial authorization before requesting IP addresses from internet intermediaries. The Supreme Court did not specifically prescribe the form of judicial authorization, but did refer to s. 487.015(1) of the Code which requires reasonable suspicion—a lesser standard than reasonable belief.3 It follows that private organizations should take care in safeguarding records associated with an IP address, including by insisting that state-based actors obtain a production order or rely expressly on a power to compel information rather than voluntarily divulge the IP address or associated records.
The majority's decision will likely have other spillover implications for private organizations. Under the prior law, IP addresses were not considered per se to be personal information, but could be if there was a reasonable expectation that they could be associated with an "identifiable individual". The decision in R v Bykovets will now lead to the further question as to whether IP addresses will be personal information because of their potential to be the "breadcrumbs" to link the IP addresses to identifiable individuals. Similarly, the decision raises the question as to whether other digital de-identified data will be considered to be within privacy laws such as PIPEDA and the CPPA and not outside of them as being anonymous information.
Footnotes
1. According to the Court an "IP address" "is a unique identification number. IP addresses identify Internet-connected activity and enable the transfer of information from one source to another. They are necessary to access the Internet. An IP address identifies the source of every online activity and connects that activity (through a modem) to a specific location. And an Internet Service Provider (ISP) keeps track of the subscriber information that attaches to each IP address.
2. The Court did not address whether the search itself was "reasonable".
3. See, however, R. v. Otto, 2019 ONSC 2473, where the production order for subscriber information in that case could "only be obtained using a general production order under s. 487.014 (relating to an IP address)".
To view the original article click here
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
