|
Internet - Privacy. R. v. Bykovets
In R. v. Bykovets (SCC, 2024) the Supreme Court of Canada considers an important case on Charter s.8 ["unreasonable search or seizure"] and the internet, specifically the police requesting IP addresses used in certain credit card transactions from third parties without a warrant:I. Introduction
[1] The Internet has shifted much of the human experience from physical spaces to cyberspace. It has grown to encompass public squares, libraries, markets, banks, theatres, and concert halls, becoming the most expansive cultural artifact our species has ever created. Along with our shopping mall and our town hall, for many of us, the Internet has become a constant companion, through which we confide our hopes, aspirations, and fears. Individuals use the Internet not only to find recipes, pay bills, or get directions, but also to explore their sexualities, to map out their futures, and to find love.
[2] These new realities have forced courts to grapple with “a host of new and challenging questions about privacy” (R. v. Spencer, 2014 SCC 43, [2014] 2 S.C.R. 212, at para. 1). In Spencer, this Court determined that a reasonable expectation of privacy attaches to subscriber information — the name, address, and contact information — associated with an individual Internet Protocol (IP) address. A request for this information by the state is a “search” under s. 8 of the Canadian Charter of Rights and Freedoms.
[3] This appeal asks whether an IP address itself attracts a reasonable expectation of privacy. The answer must be yes.
[4] An IP address is a unique identification number. IP addresses identify Internet-connected activity and enable the transfer of information from one source to another. They are necessary to access the Internet. An IP address identifies the source of every online activity and connects that activity (through a modem) to a specific location. And an Internet Service Provider (ISP) keeps track of the subscriber information that attaches to each IP address.
[5] But because IP addresses consist of numbers that can usually be changed by an ISP without notice, the Crown submits — and the majority of the Court of Appeal agreed — that an IP address does not attract a reasonable expectation of privacy. Here, the Crown contends that police were after no more than the collection of numbers that would ultimately allow them to obtain the production order contemplated by Spencer. Thus, the Crown reasons, the state did not infringe on the appellant’s right to privacy because Spencer sufficiently protected his personal information.
[6] I respectfully disagree. This analysis runs counter to this Court’s jurisprudence under s. 8 of the Charter. We have never approached privacy piecemeal, based on police’s stated intention to use the information they gather in only one way. The right against unreasonable search and seizure, like all Charter rights, must receive a broad and purposive interpretation, reflective of its constitutional source. Since Hunter v. Southam Inc., 1984 CanLII 33 (SCC), [1984] 2 S.C.R. 145, we have held that s. 8 seeks to prevent breaches of privacy, rather than to condemn or condone breaches based on the state’s ultimate use of that information. Privacy, once breached, cannot be restored.
[7] To that end, our Court has applied a normative standard to reasonable expectations of privacy. We have defined s. 8 in terms of what privacy should be — in a free, democratic, and open society — balancing the individual’s right to be left alone against the community’s insistence on protection. This normative standard demands we take a broad, functional approach to the subject matter of the search and that we focus on its potential to reveal personal or biographical core information (R. v. Marakah, 2017 SCC 59, [2017] 2 S.C.R. 608, at para. 32).
[8] Informational privacy is particularly critical — and particularly challenging. Our jurisprudence recognizes that computers are unique and present privacy risks that differ from s. 8’s traditional objects. Thus, this Court has determined that s. 8 generally prevents police from seizing a computer without a warrant — even though the device itself provides no information without judicial permission to search its contents — because seizing the computer gives the state the means through which to access its content (R. v. Reeves, 2018 SCC 56, [2018] 3 S.C.R. 531, at para. 34).
[9] Casting the subject matter of this search as an abstract string of numbers used solely to obtain a Spencer warrant goes against these precedents. IP addresses are not just meaningless numbers. Rather, as the link that connects Internet activity to a specific location, IP addresses may betray deeply personal information — including the identity of the device’s user — without ever triggering a warrant requirement. The specific online activity associated with the state’s search can itself tend to reveal highly private information. Correlated with other online information associated with that IP address, such as that volunteered by private companies or otherwise collected by the state, an IP address can reveal a range of highly personal online activity. And when associated with the profiles created and maintained by private third parties, the privacy risks associated with IP addresses rise exponentially. The information collected, aggregated and analyzed by these third parties lets them catalogue our most intimate biographical information. Viewed normatively and in context, an IP address is the first digital breadcrumb that can lead the state on the trail of an individual’s Internet activity. It may betray personal information long before a Spencer warrant is sought.
[10] And the Internet has concentrated this mass of information with private third parties operating beyond the Charter’s reach. In this way, the Internet has fundamentally altered the topography of informational privacy under the Charter by introducing third-party mediators between the individual and the state — mediators that are not themselves subject to the Charter. Private corporations respond to frequent requests by law enforcement and can volunteer all activity associated with the requested IP address. Private corporate citizens can volunteer granular profiles of an individual user’s Internet activity over days, weeks, or months without ever coming under the aegis of the Charter. This information can strike at the heart of a user’s biographical core and can ultimately be linked back to a user’s identity, with or without a Spencer warrant. It is a deeply intrusive invasion of privacy.
[11] Weighed against society’s legitimate interest in privacy is society’s legitimate interest in “[s]afety, security and the suppression of crime” (R. v. Tessling, 2004 SCC 67, [2004] 3 S.C.R. 432, at para. 17). While the right to be left alone must keep pace with technological developments, the way in which crime is committed and investigated also evolves. Easy access to the Internet and user anonymity combine to facilitate the commission of crime and challenge effective law enforcement. Clearly, the particularly insidious nature of much online crime, including child pornography and luring, presents serious and pressing social harm. Police must have the tools to investigate these crimes. And when an IP address (or subscriber information) is clearly linked to a crime — as it obviously can be for child pornography or luring — prior judicial authorization is readily available. A production order for an IP address would require little additional information to what police must already provide for a Spencer warrant. Both society’s interest in effective law enforcement and its interest in protecting the informational privacy rights of all Canadians must be respected and balanced.
[12] On balance, the burden imposed on the state by recognizing a reasonable expectation of privacy in IP addresses is not onerous. This recognition adds another step to criminal investigations by requiring that the state show grounds to intrude on privacy online. But in the age of telewarrants, this hurdle is easily overcome where the police seek the IP address in the investigation of a criminal offence. Section 8 protection would let police pursue the Internet activity related to their law enforcement goals while barring them from freely seeking the IP address associated with online activity not related to the investigation. Judicial oversight would also remove the decision of whether to reveal information — and how much to reveal — from private corporations and return it to the purview of the Charter.
[13] As a crucial component inherent in the structure of the Internet, an IP address is the key that can lead the state through the maze of a user’s Internet activity and is the link through which intermediaries can volunteer that user’s information to the state. Thus, s. 8 ought to protect IP addresses. Doing so would safeguard the first “digital breadcrumb” and shroud the trail of an Internet user’s journey through cyberspace; it would further s. 8’s purpose of preventing potential infringements of privacy rather than circumscribe its scope according to the state’s stated intentions about how it will use this key.
[14] I would allow the appeal. There is a reasonable expectation of privacy in an IP address. A request by the state for an IP address constitutes a search.
....
IV. Analysis
[28] This appeal raises a single issue: Does a reasonable expectation of privacy attach to an IP address? In my view, the answer is yes. As I will explain, an IP address is the crucial link between an Internet user and their online activity. Thus, the subject matter of this search was the information these IP addresses could reveal about specific Internet users including, ultimately, their identity. To find that s. 8 does not extend to an IP address because police collected it only to obtain a Spencer warrant ignores the information it can reveal without a warrant. Such an analysis reflects piecemeal reasoning based on how the state intends to use the information in a specific case, contrary to the broad, purposive approach required by s. 8’s constitutional status. Nor can the analysis be limited to the privacy interests affected by what the IP address can reveal on its own, without consideration of what it can reveal in combination with other available information, particularly from third-party websites. Viewed normatively, an IP address is the key to unlocking a user’s Internet activity and, ultimately, their identity, such that it attracts a reasonable expectation of privacy. If s. 8 is to meaningfully protect the online privacy of Canadians in today’s overwhelmingly digital world, it must protect their IP addresses. . James v. Amazon.com.ca, Inc.
In James v. Amazon.com.ca, Inc. (Fed CA, 2023) the Federal Court of Appeal considered an appeal from a Federal Court application decision "that dismissed her application pursuant to section 14 ['Hearing by Court'] of the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (PIPEDA)". These quotes illustrate some procedures involved in such applications, and involvement of the PIPEDA 'Principles' [Schedule 1: "Principles Set Out in the National Standard of Canada Entitled Model Code for the Protection of Personal Information, CAN/CSA-Q830-96"]:[2] Subsection 14(1) of PIPEDA contemplates an application concerning any matter in respect of which a complaint was made to the Office of the Privacy Commissioner (the Commissioner) pursuant to certain provisions of PIPEDA once the Commissioner has issued a report regarding the complaint or has indicated that the investigation of the complaint has been discontinued.
[3] In this case, Ms. James made a complaint pursuant to PIPEDA against the respondent, Amazon.com.ca, Inc. (Amazon) for denying her access to her personal information in its possession following her unsuccessful attempts to access the information. The Commissioner subsequently indicated that the investigation of the complaint would be discontinued because Amazon’s denial of access to personal information was due to an inability to verify her identity. The Commissioner found Amazon’s response to be fair and reasonable. Ms. James was unable to provide the password that Amazon had associated with the relevant information. Ms. James was also unwilling to take the steps required to reset the password.
[4] The Federal Court agreed with the Commissioner that Amazon had not been shown to violate Ms. James’ rights to access her personal information (pursuant to Principle 9 set out in Schedule 1 of PIPEDA) where it could not verify her identity. To the contrary, the Federal Court found that Amazon could have been faulted for disclosing such information without proper authorization.
[5] The Federal Court rejected Ms. James’ allegation that her inability to gain access to the information in question was because of some inaccuracy in such information, in contravention of Principle 6. The Federal Court noted that this allegation had not been raised in the complaint to the Commissioner, and further that there was no evidence to support the allegation.
[6] The Federal Court also rejected Ms. James’ argument that Amazon had failed to respond in a timely manner to her request for access to personal information. The Federal Court found that the timeframe for a response (as contemplated in subsection 8(3) of PIPEDA) would not begin until Amazon was able to confirm Ms. James’ identity.
[7] Ms. James raises several issues on appeal, which can be summarized as follows:That the Federal Court erred in raising new issues;
That the Federal Court erred in finding no violation of Principle 9 relating to individual access to information; and
That the Federal Court erred in limiting the scope of its jurisdiction under Principle 6 relating to accuracy of information. [8] Because the Federal Court hears an application under section 14 of PIPEDA de novo (without deference to the Commissioner), the normal appellate standard of review described in Housen v. Nikolaisen, 2002 SCC 33, [2002] 2 S.C.R. 235, applies. Questions of law are reviewed on a standard of correctness, and only in cases of palpable and overriding error will this Court intervene on questions of fact or of mixed fact and law from which no issue of law is extricable. Palpable and overriding error means an error that is obvious and goes to the very core of the outcome of the case: Canada v. South Yukon Forest Corporation, 2012 FCA 165, 431 N.R. 286 at para. 46.
....
[13] With regard to the Federal Court’s finding that Amazon did not violate Principle 9, we see no reviewable error. The Federal Court relied on the evidence before it to conclude that there was sufficient doubt as to Ms. James’ identity to justify Amazon seeking further information before providing the requested personal information. The Federal Court was entitled to reach such a conclusion. Although it would have been preferable to do so, its failure to mention explicitly subsection 8(7) of PIPEDA was not an error since it clearly considered the provision.
|
