Supreme Court of Canada rules internet users’ privacy must be better protected from police search

Open this photo in gallery:

The Supreme Court has ruled that police need a judge’s authorization to access Canadians’ internet protocol addresses, saying that such digital identifiers carry an expectation of individual privacy.

In a narrow 5-4 ruling on Friday, the court said that online activity logged by corporations needs to be better protected from warrantless searches. The ruling effectively fences off a form of internet traffic data from unfettered probes by authorities.

In doing so, the court elevated concerns about Canadians’ online privacy over the objections from law-enforcement bodies, who had argued that such data is not private and that courts are already too congested with warrant application work.

IP addresses are the digital-device equivalent of mailing-address information. Computers use this routing information – strings of numbers punctuated by periods and devoid of people’s names – to send data to other computers, and phones and routers.

“Does a reasonable expectation of privacy attach to an IP address? In my view, the answer is yes,” ruled Justice Andromache Karakatsanis, writing for the five-judge majority. She wrote that because “an IP address is the key to unlocking a user’s internet activity,” the courts must set some rules around these cyphers by imposing judicial oversight that puts distance between police and data corporations.

The ruling highlights how tech companies are increasingly gathering and trading data about internet traffic and making sophisticated deductions about the habits – and identities – of individuals who may think they are anonymous.

“Third-party companies, such as Google or Facebook, can track the external IP addresses of each user who visits their site and log this information to varying degrees. These companies can determine the identity of those individual users based on their internet activity on their sites,” Justice Karakatsanis wrote.

She noted that such practices merit a reconsideration of the bounds of what is considered a search by the state.

“The internet has fundamentally altered the topography of informational privacy under the Charter,” she wrote.

But the dissenting judges warned that imposing more warrant requirements on police will eventually create an unworkable burden on law enforcement.

“Given this evolution of online crime, requiring that police seek authorization to obtain an IP address in every case would also exacerbate the existing challenges faced by the criminal justice system,” wrote Justice Suzanne Côté.

Because the new ruling could have ripple effects on all kinds of police searches, police and intelligence agencies are already studying it.

“We are aware of the SCC decision and are examining the possible impacts,” said Robin Percival, a spokeswoman for the RCMP.

The federal electronic eavesdropping agency known as Communications Security Establishment “is aware of the Supreme Court of Canada’s ruling and is reviewing it,” said spokesman Ryan Foreman.

In making its decision, the Supreme Court majority overturned two lower-court rulings. Andrei Bykovets, of Calgary, will now get a new trial. In 2017, he faced 14 criminal charges for allegedly making fraudulent online purchases from an Alberta store.

Without a warrant, police pressed that store’s online payment processing company to hand over suspicious IP addresses. Detectives who acquired that data used it to swear a warrant application, where a judge ordered a telecommunications company to provide police with the names behind the internet account that was associated with the IPs.

These methods identified Mr. Bykovets as the suspect. He was convicted at trial. But he appealed by arguing that the IP address handover by the payment processor was the digital equivalent of unlawful search and seizure.

The new ruling builds on a decade-old Supreme Court decision known as Spencer, which told telecommunications companies they cannot hand over information about their customers to police without judicial authorization.

The decision will be useful as the data-swapping industry grows and as Canadians spend ever-greater portions of their lives online, experts say.

“It is much bigger than internet protocol addresses,” said Kate Robertson, a senior research associate at the University of Toronto’s Citizen Lab. “It gives the public confidence they are not going to have their information waded through and tracked and amassed into data sets without having the court having the opportunity to limit that.”

Daniel Song represented the B.C. Civil Liberties Association as an intervenor in the Supreme Court case. He said the court is now telling police they cannot use companies as investigative proxies – at least not without appropriate checks and balances.

“Given the breadth of information that companies have about us, the ability to give police access to the key to that information – that is, the IP address, without prior judicial authorization – would open the door for police to have access to so much more information about each of us,” he said.