Introduction
The Supreme Court of Canada (“SCC”) recently handed down a landmark ruling that will significantly impact the Canadian privacy landscape and help propel Canada forward in the Internet privacy space. In recent years, Canada has taken a series of steps to overhaul and improve its approach to data privacy.
At the federal level, data privacy is currently governed by the Personal Information Protection and Electronic Documents Act, a relatively old piece of legislation. A new bill, C-27 has been put before Parliament with the aim of modernizing privacy legislation by addressing artificial intelligence and introducing fines for breaches. In early 2024, the Privacy Commissioner of Canada, Phillipe Dufresne, outlined a strategic plan naming three priorities: maximising the protection of the fundamental right to privacy, addressing privacy in a time of technological change, and championing the privacy rights of children. This bill will bring Canada closer in line to the GDPR, but without some of the more bureaucratic elements. The SCC’s recent ruling has adopted a broad view to Internet privacy, specifically regarding the protection of IP addresses from the police in the course of an investigation, aligning with Canada’s recent developments in the privacy space.
In the European context, Internet Protocol (“IP”) addresses are often considered personal data and are therefore protected under the GDPR. In its judgement in Patrick Breyer v Bundesrepublik Deutschland[1], the CJEU ruled that dynamic IP addresses may constitute personal data and found that a dynamic IP address is personal data where an online media services provider has legal means that enable them to identify natural persons. Additionally, in its guidance, the ICO lists IP addresses as online identifiers which may also be considered personal data[2].
According to both authorities, the IP address is considered personal data when it is combined with other data. In R. v. Bykovets[3], however, the SCC has taken this approach slightly further. The SCC held that IP addresses alone attract a reasonable expectation of privacy under section 8 of the Canadian Charter of Rights and Freedoms[4](“Charter”). It is important to note that the SCC’s decision is in the context of personal information being used for law enforcement purposes, which has been in dispute in Canada for quite some time. However, this landmark ruling underscores the Office of the Privacy Commissioners’ new strategy of prioritising Canadians’ privacy in the digital age and will no doubt have an impact on Canadian privacy law in general.
The Facts of the Case
The police were investigating fraudulent online purchases from a liquor store in Calgary, Alberta. Once the police learned that the store’s online sales were managed by a third-party payment processing company, Moneris, they contacted Moneris to obtain the IP addresses that were used for the transactions. Moneris offered two potential IP addresses for the transactions, the police then obtained a production order compelling the ISP to disclose the name and address of the IP addresses in question. This information led to Mr. Andrei Bykovets, and the police used this information to execute warrants at his residences and arrest him.
Mr. Bykovets challenged the police requesting the IP addresses from Moneris, on the basis that this violated s. 8 of the Charter which protects the right to be secure against unreasonable search and seizure. The purpose of this section is to protect a reasonable expectation of privacy and stipulates that those who act on behalf of the government must carry out their duties in a fair and reasonable way.
The trial judge found that the police request to Moneris did not amount to a “search” as there was no reasonable expectation of privacy in an IP address, because on its own an IP address does not provide nor link to information about an Internet user. Thus, Mr. Bykovets did not have a reasonable expectation of privacy in his IP address. The majority of the Alberta Court of Appeal agreed with the trial judge and dismissed Mr. Bykovets appeal.
Mr. Bykovets then appealed again to the SCC. The SCC found that Mr. Bykovets had a reasonable expectation of privacy in his IP address, therefore his appeal was allowed, his convictions set aside, and a new trial ordered. This decision was very close with five judges allowing the appeal and four judges dissenting. The views of the judges will therefore be analysed below.
Analysis
The majority found that Mr. Bykovets had a reasonable expectation of privacy in his IP address, as the potential of IP addresses to reveal extremely personal and intimate details about an individual’s life and their choices can be concerning. Throughout Justice Karakatsanis’ opinion for the majority there was a clear emphasis on the Internet, technological advancements and how they interact with Canadians’ right to privacy. Karakatsanis J went so far as to state that the Internet has added private companies to the constitutional ecosystem, “making the horizontal relationship between the individual and the state tripartite”[5].
In order to establish that there was a violation of s. 8, the claimant, Mr. Bykovets, had to demonstrate that there was a search and that this search was unreasonable. The definition of a “search” is when the state invades an individual’s expectation of privacy, and an expectation of privacy is reasonable where the public interest of being left alone outweighs the government’s interest in intruding the individual’s privacy[6].
In analysing the expectation of privacy, the court paid particular attention to the subject matter of the search and whether the subjective expectation of privacy was objectively reasonable.
- Subject matter
When assessing the subject matter of the search, the Court is guided by the question “what were the police really after?” The Court acknowledged that this must be examined from a holistic view that reflects technological reality (para. 34). Taking a broad and functional approach, the subject matter is not limited to the information that was sought itself, but also the inferences that could be made in relation to other personal information. In this case, the police were not simply after the IP address as a collection of numbers itself, but the police wanted the information the IP address reveals about an Internet user. The IP address gave the state the means through which to draw inferences about the user behind the specific Internet activity, this information could be deeply personal and link Internet activity to a particular user. In her opinion, Karakatsanis J noted that “viewed normatively, an IP address is the key to unlocking a user’s Internet activity and, ultimately, their identity, such that it attracts a reasonable expectation of privacy”[7].
The Court reasoned that the ability of third-party websites to track IP addresses and collect massive amounts of extremely personal information requires that IP addresses attract a reasonable expectation of privacy under s. 8 of the Charter. As a result, judicial authorisation must be sought for the IP address, distinct from a Spencer warrant, which allows the police to obtain subscriber information from an ISP. In this case, the police used the IP address to obtain the Spencer warrant and access Mr. Bykovets’ subscriber information that led to his arrest. The IP address can lead to other information, outside the jurisdiction of a Spencer warrant, such as third-party information, which the state could then access without judicial authorisation. This puts the privacy of Canadians at risk.
The Court recognised that subscriber information is not the only way an IP address can reveal intimate details of an Internet user’s activities and lifestyle. Third-party websites can track IP addresses and collect significant amounts of other information such as YouTube history and Google searches. As a result, the IP address is an avenue to a user’s intimate details which attracts a reasonable expectation of privacy.
The police had obtained the required Spencer warrant to gain access to subscriber information, as mandated by R v Spencer[8], which led to the arrest of Mr. Bykovets.
The dissenting judges disagreed, arguing that the IP address should not be considered the subject matter of the search. Justice Côté noted that personal information was not revealed by the raw IP address alone and therefore could not be the subject matter of the search. Instead of viewing the IP address as a door that leads to the exposure of personal information, the dissent viewed what information is actually revealed from the IP address itself, and that a warrant or authorisation for subscriber information, not including the IP address, is enough of a safeguard for Canadians’ privacy.
- Reasonable Expectation of Privacy
To ascertain whether an individual has a reasonable expectation of privacy, certain factors must be weighed between the public’s interest in being left alone against the government interest in intruding someone’s privacy in order to advance government goals.[9] The claimant’s control over the subject matter, the place of the search, and the private nature of the subject matter will be considered.
In the context of technological realities versus informational privacy, neither a lack of control over the subject matter nor a lack of physical intrusion on the place where the search occurred is determinative of the reasonable expectation of privacy. The majority reiterated their finding in R v Jones[10], stating that the only way to control information on the Internet. would be to not use it all, which in current times, is clearly not a meaningful choice[11].
When considering the private nature of the subject matter the majority found that this is not limited to core biographical information but also information that reveals intimate details and personal choices, which is what the police were searching for and found, as the IP address uncovered it. The Court also determined that requesting judicial authorisation before requesting an IP address will not hinder the investigative process.
The dissent disagreed, stating that individuals lacked control over IP addresses, as an ISP can change an IP address at will and without notice, supporting their argument against finding a reasonable expectation of privacy. Côté J also expressed concern that having to obtain judicial authorisation in every case may be too burdensome for law enforcement.
Conclusion
This seminal ruling has truly underscored Canada’s step forward and progressive view with respect to protecting Canadians’ digital privacy. The majority came to this decision by allowing Mr. Bykovets’ appeal on the grounds that he had a reasonable expectation of privacy in his IP address, not because of the collection of numbers that make up an IP address but because of the information an IP address has the potential to reveal. Government agencies will have to obtain judicial authorisation for an individual’s IP address since obtaining it will now be considered a search, and if the government agency obtains the IP address without authorisation it may be violating s. 8 of the Charter. Furthermore, Karakatsanis J stated that third-party companies should not be the ones that choose when to reveal personal information, as they are not bound by the Charter. This underscores the need for government agencies to get judicial authorisation is another safeguard that the disclosure occurs in accordance with the Charter.
In Europe an individual may have the protection of the GDPR, in regard to their IP address depending on what data it is combined with and what role the IP address plays in identifying them as it may be considered information relating to an identifiable person. The SCC has established that an individual can expect a right to privacy in their IP address, regardless of its combination with other data, taking Canada’s protection of IP addresses a step further. This decision has underscored the strategy the Office of the Privacy Commissioner has announced this year to propel Canada forward in the Internet privacy space. The decision balances combatting online crime and Canadian’s reasonable privacy rights, and a more robust interpretation of s. 8 of the Charter.
[1] Case C-582/14 Breyer v Bundesrepublik Deutschland ECLI:EU:C:2016:779
[2] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/what-is-personal-information-a-guide/#:~:text=Personal%20data%20is%20information%20that,cookie%20identifier%2C%20or%20other%20factors.
[3] 2024 SCC 6 (CanLII).
[4] https://www.canada.ca/en/canadian-heritage/services/how-rights-protected/guide-canadian-charter-rights-freedoms.html
[5] ibid. (para. 78).
[6] ibid. (para. 31).
[7] ibid. (para. 28).
[8] 2014 SCC 43.
[9] R. v. Bykovets, 2024 SCC 6 (CanLII), at para. 45.
[10] 2017 SCC 60.
[11] R. v. Bykovets, 2024 SCC 6 (CanLII), at para. 48.
