Unreasonable searches

Last week, the Supreme Court handed down a landmark ruling acknowledging Canadians’ right to privacy online. In doing so, the Court has arguably placed the biggest limitation on PIPEDA since its inception. What’s more, the justices appear to have frustrated Ottawa’s efforts to extend police powers to obtain data without a warrant. It is still unclear how much of an impact the ruling will have.

In R. v. Spencer, the Court effectively reigned in police powers to make informal requests under the Personal Information Protection and Electronic Documents Act (PIPEDA). The requests were, more often than not, police receiving a suspect’s name and address based only an IP address. For Brandon Spencer, that meant police could connect his online activity — allegedly downloading and sharing child pornography — with his Saskatoon home, thanks to a PIPEDA request made to his Internet Service Provider, Shaw.

While the court upheld one conviction, and allowed a new trial on the second charge to proceed — it allowed the evidence, as they found that the police acted in good faith in obtaining the evidence — the ruling is quite clear: police no longer have the power to make warrantless requests to telecommunications companies.

Justice Thomas Cromwell, writing for the majority, noted that the lower courts had upheld the practice. Throwing out the charges, he wrote, “would bring the administration of justice into disrepute.”

The only asterisk on that ruling is that the court upheld police power to obtain the data in “exigent circumstances.”

The ruling squares itself on the somewhat obvious opinion that these request ingrained Canadians’ right, under Section 8 of the Charter, protecting them from unreasonable searches, but it also contends that, under the statutes, police never really had the power in the first place. The unanimous court concluded that section 487.014(1) of the Criminal Code, which provides that no production order is necessary when someone voluntarily provides data to police, can’t be combined with section 7(3)(c.1)(ii) of PIPEDA, which allows for companies to hand over that data.

“Since in the circumstances of this case the police do not have the power to conduct a search for subscriber information in the absence of exigent circumstances or a reasonable law, I do not see how they could gain a new search power through the combination of a declaratory provision and a provision enacted to promote the protection of personal information,” wrote Cromwell.

“I wasn’t surprised by it,” says Matthew Gourlay of Henein Hutchinson. “I think it was consistent with an emerging line of cases from the Supreme Court that have taken a very strong line in favour with electronic privacy rights.”

The practical effect of the ruling, says Gourlay, is that this sort of data-disclosure will now be limited by jurisprudence, instead of the internal policies of a handful of corporations. For the exigent circumstances where police do side-step judicial oversight, Gourlay anticipates that the requests will be “interpreted very narrowly by the courts.” 

The ruling could have huge impacts on the Conservatives’ crime legislation, Bill C-13. That bill aims to expand immunity under the Criminal Code to telecommunications who provide this data, and it broadens which public and peace officers who can request the data. This decision, however, appears to make those new powers moot.

Has it been neutered the bill? “Potentially,” says Éloïse Gratton, co-chair of the privacy section at McMillan. Gratton has advised telecommunications companies on how to comply with those PIPEDA requests and she says she usually airs on the side of not disclosing without a warrant.

“It’s always a little bit tricky,” she says. While she points out that there was always the risk for liability — something that C-13 is aiming to remove — the real concern was public perception. Even if some companies refused disclose, other companies complied, with the government making over a million requests a year.

“At the end of the day, it’s affecting everyone’s reputation,” she says.

Gratton says the court came to the right conclusion. “I was not surprised. For me, it was obvious.” Releasing someone’s identity based on just an IP address isn’t “a simple connection,” she says, it reveals a lot about a person. It connects a person to their browsing history and online activity. That’s fundamentally sensitive, she says, and everybody — consumers and telcos included — should be happy with the decision. “I think it will provide consumer confidence that telcos will not be disclosing their information without warrants.”

That statement comes with a caveat. While the Court has found that law enforcement’s use of section 7 in PIPEDA is rarely justified, it didn’t clarify how other entities could use the section. In Bill S-4, the government is seeking to give private companies a similar power — to share data with each other, if they’re investigating fraud or breach of contract.

While this decision certainly doesn’t preclude that sort of sharing, Gratton says it could put a chill on corporations.

“Maybe these private sector entities will use caution before they exchange sensitive information that relates to someone online activity,” she says.

At the very least, Gratton says, it could spur the government to amend the legislation.

“It’s sending a message,” she says, now the question remains: “Are they going to take this message into account with S-4 and C-13?”

While Gourlay says the Spencer ruling may have essentially rendered section 487.014(1) useless — if it used, he says, “a Charter challenge will follow,” — the Courts haven’t entirely shut the door on Parliament getting involved. He says that the justices appeared careful not to “freeze” that section of the Criminal Code.

“My strong sense is that the breadth of the proposed legislation [C-13] is out of step with what the Supreme Court considers to be a reasonable expectation of privacy. I think what the court is signaling is that they’re open to engaging in a dialog with Parliament, but I think they’ve been very clear that any kind of blanket immunity is not going to pass constitutional muster,” says Gourlay. “But we’ll see.”