|
Charter - Section 8 - Informational Privacy. R. v. Knelsen
In R. v. Knelsen (Ont CA, 2024) the Ontario Court of Appeal dismissed a criminal appeal on Charter s.8 ['search and seizure'] grounds, here focussing on 'privacy' in an electronic context [Marakah (SCC, 2017)]:[6] For the reasons that follow, I would dismiss the appeal. In my view the trial judge erred in concluding that the appellant had standing to assert his s. 8 rights and challenge the admissibility of the text messages. As I will explain, applying the test articulated in R. v. Marakah, 2017 SCC 59, [2017] 2 S.C.R. 608, and R. v. Mills, 2019 SCC 22, [2019] 2 S.C.R. 320, and considering the totality of the circumstances, the appellant did not have a reasonable expectation of privacy in text messages he sent to the complainant – that he met only once and whom he knew was 15 – to arrange to meet for sex. Further, and in the alternative, the text messages did not attract any protection under s. 8 of the Charter because they were the means by which the appellant committed the offence of child luring.
[7] The text messages were accordingly admissible at trial, and there is no basis to set aside the appellant’s convictions. It is therefore unnecessary to address the arguments respecting the trial judge’s s. 24(2) analysis.
....
Applicable Legal Principles
[31] Whether an object or a place gives rise to a reasonable expectation of privacy is a question of law, reviewable on a standard of correctness. Deference is owed to the relevant factual findings made by the trial judge, but not to the trial judge’s determination of whether a reasonable expectation of privacy was engaged by the facts: R. v. Chow, 2022 ONCA 555, 163 O.R. (3d) 241, at paras. 24-25.
[32] Before considering whether the trial judge erred in this case in concluding that the appellant had a reasonable expectation of privacy in the text messages he exchanged with the complainant, it is helpful to summarize the guiding legal principles.
[33] The point of departure is the Supreme Court’s decision in Marakah, a case that dealt with the warrantless search and seizure by the police of text messages between two individuals suspected of engaging in illegal firearms transactions. Marakah cited and built upon many prior authorities of the Supreme Court in addressing whether the sender of an electronic message retained a reasonable expectation of privacy in messages after they were sent.
[34] To establish a reasonable expectation of privacy and engage s. 8 of the Charter, a s. 8 claimant must establish an expectation of privacy in the subject matter at issue that is “objectively reasonable” given “the totality of the circumstances”: Marakah, at para. 10. As McLachlin C.J. stated at para. 11, there are four lines of inquiry that guide the court’s analysis: (1) the subject matter of the alleged search; (2) whether the claimant had a direct interest in the subject matter; (3) whether the claimant had a subjective expectation of privacy in the subject matter; and (4) if so, whether the claimant’s subjective expectation of privacy was objectively reasonable.
[35] Marakah recognizes that the expectation of privacy is in the electronic conversation itself and not the electronic device: at paras. 16-19. This is a question of “informational privacy”, which has been defined as the claim of individuals, groups or institutions to determine for themselves when, how and to what extent information about them is communicated to others: R. v. Tessling, 2004 SCC 67, [2004] 3 S.C.R. 432, at para. 23. The electronic conversation includes “the existence of the conversation, the identities of the participants, the information shared, and any inferences about associations and activities that can be drawn from that information”: Marakah, at para. 20.
[36] Marakah also confirms that a reasonable expectation of privacy can exist in a conversation even after the message is no longer in the sender’s control, and irrespective of the potential for disclosure by the recipient. Although recognizing that control is a factor to be considered in the totality of the circumstances, McLachlin C.J. concluded that the risk that the recipient of the subject text messages could have disclosed them did not negate the reasonableness of Mr. Marakah’s expectation of privacy against state intrusion: at paras. 44-45.
[37] A reasonable expectation of privacy can exist even when it shelters illegal activity: R. v. Edwards, 1996 CanLII 255 (SCC), [1996] 1 S.C.R. 128, at para. 43; R. v. Spencer, 2014 SCC 43, [2014] 2 S.C.R. 212, at para. 36; and R. v. Reeves, 2018 SCC 56, [2018] 3 S.C.R. 531, at para. 28. The focus is not on the actual contents of the message seized by the police, but on the potential of a given electronic conversation to reveal private information: Marakah, at para. 32. This is the principle of “content neutrality” applied in the context of s. 8, also expressed as the inability of the state to justify a s. 8 intrusion ex post facto, based on the results of the search: see Marakah, at para. 48. See also R. v. Duarte, 1990 CanLII 150 (SCC), [1990] 1 S.C.R. 30, at pp. 45-47, 54‑56.
[38] There is no automatic standing to assert a s. 8 right in respect of text messages that have been sent and received. “The conclusion that a text message conversation can, in some circumstances, attract a reasonable expectation of privacy does not lead inexorably to the conclusion that an exchange of electronic messages will always attract a reasonable expectation of privacy”: Marakah, at para. 5 (emphasis in original). Whether there is a reasonable expectation of privacy depends on the “totality of the circumstances” to be assessed in each case based on its own unique facts: Edwards, at para. 45; Marakah, at para. 11. The question is whether a reasonable and informed person in the position of the accused would expect privacy in the subject matter of the search: R. v. Cole, 2012 SCC 53, [2012] 3 S.C.R. 34, at para. 35.
[39] The “totality of the circumstances” test depends on a non-exhaustive list of factors, including (1) the place where the search occurred; (2) the private nature of the subject matter, i.e., whether the informational content of the electronic conversation would be details of the claimant’s lifestyle or information of a biographic nature; and (3) control over the subject matter: Marakah, at para. 24.
[40] The evaluation of the totality of the circumstances is not a purely factual inquiry; it is also normative. This has been expressed as the need to balance “societal interests in protecting individual dignity, integrity and autonomy with effective law enforcement”: R. v. Plant, 1993 CanLII 70 (SCC), [1993] 3 S.C.R. 281, at p. 293. In Reeves, at para. 11, the Supreme Court noted that the question is “whether in a particular situation the public’s interest in being left alone by government must give way to the government’s interest in intruding on the individual’s privacy in order to advance its goals, notably those of law enforcement”.
[41] In Mills the Supreme Court expressly recognized societal interests other than those underlying an individual’s interest in privacy and the state’s interest in law enforcement in determining whether an expectation of privacy is reasonable. Mills involved the admissibility of text messages sent by an adult during a police sting operation to a recipient who had assumed the identity of a child. Brown J.’s majority reasons[4] noted that the determination of whether an expectation of privacy is objectively reasonable is “not purely a descriptive question, but rather a normative question about when Canadians ought to expect privacy, given the applicable considerations”: at para. 20 (emphasis in original). In that case, the societal interest to be balanced against the individual’s right to privacy was the protection of vulnerable children. Brown J. acknowledged that the offender had instructed the person he believed was a child to delete their messages regularly and to keep their relationship hidden. Nevertheless, he held that, in the totality of the circumstances, “any subjective expectation of privacy the [offender] might have held [in the messages] would not be objectively reasonable”: at para. 20.
[42] Observing that the Internet allows for greater opportunities to sexually exploit children, and that enhancing protection to children from becoming victims of sexual offences is vital in a free and democratic society, Brown J. concluded that “on the normative standard of expectations of privacy … adults cannot reasonably expect privacy online with children they do not know”: at para. 23. He noted that, while many adult-child relationships are also worthy of s. 8’s protection, the relationship between the offender and the person he believed was a child was not one of them, and that this conclusion “may or may not apply to other types of relationships, depending on the nature of the relationship in question and the circumstances surrounding it at the time of the alleged search”: at para. 26.
[43] In her concurring reasons in Mills, Karakatsanis J. also spoke of the need to balance individual privacy with the protection of children. In rejecting a reasonable expectation of privacy in the offender’s online conversation with a police officer posing as a child, she stated, at para. 52, that “[t]he alternative conclusion would significantly and negatively impact police undercover operations, including those conducted electronically … [and it] simply does not strike an appropriate balance between individual privacy and the safety and security of our children”.
[44] In the recent Supreme Court decision in R. v. Bykovets, 2024 SCC 6, 489 D.L.R. (4th) 1, Karakatsanis J. observed, at para. 71, that defining a reasonable expectation of privacy “is an exercise in balance”, and that while individuals are entitled to insist on their right to be left alone by the state, “[a]t the same time, social and economic life creates competing demands.… The community wants privacy but it also insists on protection”. See also this court’s decisions in El-Azrak, where Fairburn A.C.J.O. observed, at para. 62, that “[p]roperly viewed through a normative lens, privacy interests will rise to constitutional status when those interests reflect the ‘aspirations and values’ of the society in which we live”, and R. v. Singh, 2024 ONCA 66, 432 C.C.C. (3d) 527, where Doherty J.A. noted, at para. 66, that the reasonable expectation of privacy constitutionally protected by s. 8 of the Charter is “intended to reflect and reinforce sometimes competing societal values”.
[45] Accordingly, in considering whether the appellant had a reasonable expectation of privacy in the text messages on the complainant’s cell phone, it is appropriate for the court to consider the competing societal value of the protection of vulnerable children from exploitation through the use of electronic media.
[46] Before moving to the application of the law to the facts of this case, I pause to note that there have been a number of reported cases involving the admissibility of electronic messages sent to a complainant where the messages in which a privacy interest was claimed had been voluntarily provided to the police by the complainant. In some, as here, the courts have applied a “totality of the circumstances” test: see, for example, R v. K.A. and A.S.A., 2022 ONSC 1241, 504 C.R.R. (2d) 1, and R. v. C.M., 2022 ONCJ 372, 515 C.R.R. (2d) 100. In others, courts have found that s. 8 was not engaged because there was no state intrusion or seizure by the police, or that, if s. 8 was engaged, the search was reasonable in part because the messages were turned over voluntarily.[5]
[47] In this case, the Crown did not argue that, because of the consent of the complainant and her father, there was no police seizure, or that, if the appellant had a reasonable expectation of privacy, the seizure of the text messages with the consent of the complainant was reasonable. Accordingly, it is beyond the scope of these reasons to consider whether such arguments might succeed in another case.[6] The focus for the disposition of this appeal is on whether the appellant’s subjective expectation of privacy in the messages he exchanged with the complainant, on the totality of the circumstances, including normative considerations, was objectively reasonable.
Application of the Principles to This Case
[48] I begin by summarizing what is not in dispute in this case: the parties agree that, subject to whether the appellant had a reasonable expectation of privacy in the text messages on the complainant’s cell phone, their access by the police constituted a seizure. In other words, there was a “state action” that is subject to s. 8. The parties also agree that, as at first instance, if the appellant had a reasonable expectation of privacy, then the police ought to have obtained a warrant before they looked at the text messages. That is, the fact that the text messages were voluntarily provided to the police by their recipient, while relevant to the objective reasonableness of the expectation of privacy (according to the Crown), does not by itself render the seizure reasonable.
[49] It is accepted here, as in the court below, that the subject matter of the search is the communications by text between the complainant and the appellant; that the appellant had a direct interest in the messages because he co-authored them; and that he had a subjective expectation of privacy because the messages were sent privately to the complainant to her cell number and both had agreed to keep their planned meeting a secret. It is only the fourth part of the totality of the circumstances test that is at issue: whether there was an objectively reasonable expectation of privacy. . R. v. Bykovets
In R. v. Bykovets (SCC, 2024) the Supreme Court of Canada considers an important case on Charter s.8 ["unreasonable search or seizure"] and the internet, specifically the police requesting IP addresses used in certain credit card transactions from third parties without a warrant.
Here, the court holds that requests for IP addresses from third parties constitute a 'search', and thus require a warrant (ie. prior judicial authorization):[85] In my view, however, requiring that police obtain prior judicial authorization before obtaining an IP address is not an onerous investigative step, and it would not unduly interfere with law enforcement’s ability to deal with this crime. Where the IP address, or the subscriber information, is sufficiently linked to the commission of a crime, judicial authorization is readily available and adds little to the information police must already provide for a Spencer production order. For example, under s. 487.015(1) of the Criminal Code, R.S.C. 1985, c. C-46, a production order for information relating to a specified transmission of a communication is available if there are reasonable grounds to suspect that an offence has been or will be committed. Police often apply for and obtain multiple authorizations to protect different territorial privacy interests. The same is true to protect informational privacy.
[86] On balance, the burden imposed on the state by recognizing a reasonable expectation of privacy in IP addresses pales compared to the substantial privacy concerns implicated in this case. Law enforcement will need to demonstrate enough grounds to intrude on an individual’s privacy but, in the age of telewarrants and around-the-clock access to justices of the peace, this burden is not onerous. Police engaging in legitimate investigatory activities can readily establish the requisite constitutional grounds. Recognizing that an IP address attracts s. 8 protection will not thwart police investigations involving IP addresses; rather, it aims to make sure police investigations better reflect what each reasonable Canadian expects from a privacy perspective and from a crime control perspective.
[87] A reasonable expectation of privacy limits the state to searches motivated by legitimate law enforcement concerns. The benefits to privacy are significant. Judicial pre-authorization considerably narrows the state’s online reach and prevents it from acquiring the details of a user’s online life revealed by their IP address that are not relevant to the investigation. This significantly reduces the potential of any “arbitrary and even discriminatory” exercises of discretion that would empower the state to identify information about any Internet user it pleases for any reason it sees fit (L. M. Austin, “Getting Past Privacy? Surveillance, the Charter, and the Rule of Law” (2012), 27 C.J.L.S. 381, at p. 392). In a democratic society, it is “inconceivable that the state should have unrestricted discretion to target whomever it wishes for surreptitious [digital] surveillance” (R. v. Wong, 1990 CanLII 56 (SCC), [1990] 3 S.C.R. 36, at p. 47).
[88] Judicial oversight in respect of an IP address is the way to accomplish s. 8’s goal of preventing infringements on privacy. Since Hunter, we have held that s. 8 seeks to prevent breaches of privacy, not to condemn or condone breaches after the fact based on the state’s use of that information. Privacy, once breached, cannot be restored.
[89] Finally, judicial oversight removes the decision to disclose information — and how much to disclose — from private corporations and returns it to the purview of the Charter. The increase in state power occasioned by the Internet is thus offset by a broad, purposive approach to s. 8 that meets our “new social, political and historical realities” (Hunter, at p. 155). To leave it to the private sector to decide whether to provide police with information that may betray our most intimate selves strikes an unacceptable blow to s. 8. To leave the protection of the Charter to the next intended step in the investigation is insufficient. As I have explained, the next step might be too late.
[90] Thus, viewed normatively, s. 8 of the Charter ought to extend a reasonable expectation of privacy to IP addresses. They provide the state with the means through which to obtain information of a deeply personal nature about a specific Internet user and, ultimately, their identity whether or not another warrant is required. An IP address plays an integral role in maintaining privacy on the Internet. It is the key to unlocking an Internet user’s online activity and the key to identifying the user behind online activity. Given these serious privacy concerns, the public’s interest in being left alone should prevail over the relatively straightforward burden imposed on law enforcement. Recognizing a reasonable expectation of privacy in IP addresses would ensure that the veil of privacy all Canadians expect when they access the Internet is only lifted when an independent judicial officer is satisfied that providing this information to the state will serve a legitimate law enforcement purpose.
[91] In my view, the reasonable and informed person concerned about the long‑term consequences of government action for the protection of privacy would conclude that IP addresses should attract a reasonable expectation of privacy. Extending s. 8’s reach to IP addresses protects the first “digital breadcrumb” and therefore obscures the trail of an Internet user’s journey through the cyberspace.
V. Disposition
[92] I would find the request by the state for an IP address is a search under s. 8 of the Charter. I would allow the appeal, set aside the conviction, and order a new trial. . R. v. Bykovets
In R. v. Bykovets (SCC, 2024) the Supreme Court of Canada considers an important case on Charter s.8 ["unreasonable search or seizure"] and the internet, specifically the police requesting IP addresses used in certain credit card transactions from third parties without a warrant. At paras 44-84 the court considers whether an expectation of privacy was 'reasonable'.
. R. v. Bykovets
In R. v. Bykovets (SCC, 2024) the Supreme Court of Canada considers an important case on Charter s.8 ["unreasonable search or seizure"] and the internet, specifically the police requesting IP addresses used in certain credit card transactions from third parties without a warrant.
Here, the court discusses the importance of characterizing the 'subject-matter' of the police interest realistically:[38] This Court has never described the constitutional right to privacy according to the state’s declared intention, or according to one particular use of the information. Rather, we have consistently taken a broad and functional approach to the subject matter of the search, “examining the connection between the police investigative technique and the privacy interest at stake” (Spencer, at para. 26). The subject matter is defined not only in terms of the information itself, but also “the tendency of information sought to support inferences in relation to other personal information” (para. 31). In Marakah, for example, the issue was whether the sender of a text message has a reasonable expectation of privacy in that text message on the recipient’s device. Writing for the majority, McLachlin C.J. determined that the subject matter of the search was not the recipient’s telephone, or even the text message itself, but an “electronic conversation” including “any inferences about associations and activities that can be drawn from that information” (para. 20).
[39] Courts must be especially careful in describing the subject matter of a search touching electronic data (Marakah, at para. 14). In R. v. Cole, 2012 SCC 53, [2012] 3 S.C.R. 34, where police had examined the contents of a computer, this Court described the subject matter of the alleged search as “the data, or informational content of the laptop . . . not the devic[e] [itself]” (para. 41 (emphasis in original)).
[40] Similarly, in Reeves, where police had seized the appellant’s shared home computer, the search was not merely for the computer itself, but “ultimately the data it contained about Reeves’ usage, including the files he accessed, saved and deleted” (para. 30). The state engaged s. 8 by seizing the computer even though police needed a warrant to search its contents because, through the seizure, police “obtained the means through which to access [highly private] information” (para. 34).
[41] The same is true here. Police were not “really after” IP addresses in the abstract. As “a collection of numbers”, an IP address is of no interest to police. Rather, police were after the information an IP address tends to reveal about a specific Internet user including their online activity and, ultimately, their identity “as the source, possessor or user of that information” (Spencer, at para. 47). As the identifier of Internet-connected activity originating at a specific location, an IP address is a powerful tool that allows the state — with or without another warrant — to collect a user’s Internet activity over the time period a particular IP address is linked to that source. Thus, as in Reeves, an IP address provided the state with the means through which to draw immediate and direct inferences about the user behind specific Internet activity. The information inferred from a device’s Internet activity can be deeply personal, including linking that activity to a particular user’s identity (see Spencer, at para. 47).
[42] This description takes a broad and functional view of the subject matter. By “properly avoid[ing] a mechanical approach that defines the subject matter in terms of physical acts, spaces, or modalities of [informational] transmission”, it “reflects the technological reality” (Marakah, at para. 17). This description does not extend the shield of Charter protection to every investigatory step. Instead, it affirms that investigative techniques that reveal seemingly innocuous information must still be examined in connection with the privacy interest at stake (Spencer, at para. 26). Recognizing that police wanted the IP address — as the link between a specific subscriber and location and particular Internet activity — to obtain more information about the user lets the court assess the expectation of privacy in relation to all the information this IP address “tends to reveal” (Spencer, at para. 27 (emphasis in original), quoting R. v. Plant, 1993 CanLII 70 (SCC), [1993] 3 S.C.R. 281, at p. 293), and, therefore “by reference to the nature of the privacy interests potentially compromised by the state action” (Marakah, at para. 15, citing Ward, at para. 65 (emphasis added)).
[43] Thus, the subject matter of this alleged search is an IP address as the key to obtaining more information about a particular Internet user including their online activity and, ultimately, their identity as the source of that information. Here, police sought to obtain that information through a production order as contemplated by Spencer. But, as the expert report states, a Spencer warrant is not the only way an IP address can reveal intimate details of an Internet user’s lifestyle and personal choices. Online activity associated to the IP address may itself betray highly personal information without the safeguards of judicial pre-authorization. I turn to that issue next.
|
