In its June 13, 2014 decision in R v. Spencer, the Supreme Court of Canada has begun what will undoubtedly be a long process of delineating the privacy rights of Canadians in their online activities. Justice Cromwell, writing for the Court, started his reasons by noting that the internet has raised manifold and challenging privacy concerns. The question at issue in Spencer is whether Canadians have a Charter protected privacy interest in data gathered by their internet service provider ("ISP") about their online activities. The Court answered this question in the affirmative.
Mr. Spencer was the subject of a police investigation for activities related to child pornography. During the investigation, the police requested information from Mr. Spencer's ISP, which complied with the request. The police had not obtained a search warrant for this information, and Mr. Spencer challenged the provision of the information to the police by his ISP on the grounds that it violated his Charter right against unreasonable search and seizure.
Under section 8 of the Charter, every person has the right to be protected from state intrusion on information to which they have a reasonable expectation of privacy, except where such intrusion is authorized by law and the law itself is reasonable. The question of interest in this case was whether an individual has a reasonable expectation of privacy over information about their internet activities, where that information was gathered by their ISP. This requires both the subjective expectation of privacy by the person and that the expectation of privacy be objectively reasonable in the circumstances. The Court concluded that there is such a reasonable expectation.
In coming to this conclusion, Justice Cromwell noted that a subjective expectation of privacy by an internet user can be inferred from the fact that they transmit sensitive information through their internet connection. This expands the internet user's subjective expectation of privacy from the contractual relationship between him or herself and the ISP, to any ISP through which sensitive information is transmitted by a person. Justice Cromwell did not consider this aspect of the test to be controversial.
However, the question of whether it is reasonable for an internet user to expect that their information would not be disclosed is more challenging. Anonymity in the public sphere has been recognized as being a type of privacy that can reasonably be expected in certain circumstances. Of particular interest in this context, the Court recognized that the internet has extended both the self-perceived ability of individuals to present themselves anonymously to the world, and the extent to which information can be gathered on people's activities while they believe themselves to be acting anonymously. The contrast between this perceived anonymity and the ability of many entities to track individual online activity will certainly be the subject of further comment in the realm of internet privacy. In this case, the Court determined that it was reasonable to expect that one's internet activities would remain private.
Justice Cromwell then moved on to consider the effect of the ISP's terms of service on Mr. Spencer's privacy interest. Although Mr. Spencer was not a party to a contract with the ISP (he was using his sister's connection), the Court found that he would have been aware that use of the ISP's service would be governed by terms and conditions, and that he would have had access to those terms and conditions online. The terms of service in question indicated that the ISP would only release personal information when requested by the police in accordance with the Personal Information Protection and Electronic Documents Act, which requires the police to have lawful authority for the ISP to release the information. Justice Cromwell found that lawful authority in this case meant more than a bare request. As a result, the ISP terms of service reinforced the conclusion that Mr. Spencer's expectation of privacy was reasonable.
Ultimately, the Court found that the evidence should be admitted despite the Charter violation. More important, from a civil perspective, are the implications for businesses that collect private information and for individuals who engage in activities on the internet. Internet companies and employers must carefully consider their obligations under privacy legislation in order to avoid running afoul of such laws. The ease with which online activities can be traced highlights the importance of securing personal information from outside scrutiny by both governmental and non-governmental actors. This case is only the first of many that will deal with privacy concerns stemming from internet activity.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
