On June 13, 2014, the Supreme Court of Canada delivered a major decision affecting privacy. The matter involved a criminal trial where the accused, Spencer, was facing certain child pornography offences.
The police had used a software program to identify anyone sharing child pornography, and they located one such IP (internet protocol) address in Saskatoon, with Shaw as the internet service provider (ISP). The police then requested subscriber information including name, address and telephone number from Shaw.
The request was a routine request under Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA) which permits disclosure to a government institution which has "identified its lawful authority" to obtain the information and indicates that the disclosure is required to enforce a law or carry out an investigation relating to enforcement of a law.
Shaw complied with the request and provided the name, address and telephone number, which happened to be for the accused's sister. Spencer sought to exclude the evidence at trial based on an unlawful search.
The Crown argued that the subject of the search was simply name, address and telephone number, and therefore material privacy or search issues did not arise. But the Supreme Court answered that constitutional protection against search and seizure applies not only to the information requested, but information which tends to be revealed by the search – in this case, the identity of the subscriber corresponds to particular Internet usage which can of course say much.
The Court also recognized that anonymity in the context of internet use deserves privacy protection under the law. The Court did not believe this would threaten effectiveness of law enforcement, as in cases such as this, it seemed clear that the police had ample information to obtain a necessary production order.
The Court also examined whether Spencer had a reasonable expectation of privacy, including with an examination of Shaw's terms of use. While such terms of use permitted disclosure to government authorities, they also, as is quite typical, linked to a privacy policy which emphasized commitments to protection of personal information and strict confidentiality. On the whole, such terms therefore did not remove any expectation of privacy.
The Court specifically addressed section 7(3)(c.1)(ii) of PIPEDA which has been used for such requests, and emphasized that this section only permits disclosure if the government institution or the police have lawful authority to request the disclosure. The Court stated:
"It would be reasonable for an Internet user to expect that a simple request by police would not trigger an obligation to disclose personal information or defeat PIPEDA's general prohibition on the disclosure of personal information without consent."
The Court concluded that the information was unconstitutionally obtained.
Note that ultimately the evidence was not excluded by the Supreme Court, since the police had not acted unreasonably based on the state of the law prior to this new decision from the Supreme Court.
This decision will have a major impact on disclosure of subscriber information from ISPs and also on the federal government's proposed expansion of these disclosure rights under their Bill C-13.
(Case name: R. v. Spencer, 2014 SCC 43)
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.