In two recent decisions of the Ontario Superior Court, the court found that subscribers of Internet Service Providers (ISPs) and their family members have "no reasonable expectation of privacy" in the subscriber's name and municipal address. While the judges in R. v. Wilson and R. v. Vasic differed slightly in their classification of this information, both noted that the subscribers had agreed to the ISP's policies, which authorized disclosure of the information.
In both cases, police officers sought the names and address of subscribers associated with a specific IP address, pursuant to Section 7(3)(c.1) of the Personal Information Protection and Electronic Documents Act (PIPEDA). This section allows disclosure of personal information to a government institution without an individual's consent where the government institution makes a request, identifies its lawful authority for obtaining the information, and indicates the disclosure is being requested in order to enforce a law of Canada.
The officers filled out the ISPs' standard letter of request and indicated they required the information for child sexual exploitation investigations. The ISPs complied with the requests and made the disclosure as permitted under PIPEDA, though they did have the right to refuse the requests and require the officers to obtain a warrant.
In both instances, the applicants were relatives of the subscribers. They brought Charter applications, claiming that their rights under Section 8 of the Canadian Charter of Rights and Freedoms were violated when the ISPs disclosed their relatives' names and addresses without a search warrant.
Section 8 of the Charter protects citizens from unreasonable search and seizure, but courts have held that individual privacy must be balanced against social protections and that the guarantee of security from unreasonable search and seizure only protects a reasonable expectation. Therefore, to challenge a search, applicants must establish they have a reasonable expectation of privacy in the information.
Do The Applicants Have A Reasonable Expectation Of Privacy In The Subscriber's Name And Address?
In R. v. Wilson, the judge concluded that the applicant had no reasonable expectation of privacy in subscriber information. She noted that an expectation of privacy in personal information only extends to information that is biographical in nature and reveals specifics about the life and interests of the individual. A person's name and address, she found, is not "biographical information" that one would expect to keep private from the state.
By contrast, the judge in R. v. Vasic accepted that disclosure of an individual's name and address to someone who possesses the individual's IP address may reveal details of the lifestyle and personal choices of the individual, but ultimately came to the same conclusion as the judge in R. v. Wilson — that the applicant had no reasonable expectation of privacy in the subscriber's name and municipal address.
ISP Disclosure Agreements And Protocol
In assessing whether the applicants had a reasonable expectation of privacy, the courts also looked at the terms of the subscriber's contract with the ISP.
In R. v. Wilson, the court found that Bell Canada's disclosure was consistent with its Code of Fair Information Practices, which permits the disclosure of personal information without knowledge or consent when the disclosure is "required by law." Indeed, the disclosure of the personal information in question was consistent with the protocol established by certain Canadian Internet Service Providers, including Bell Canada. This protocol, established under the auspices of the Canadian Coalition against Internet Child Exploitation, allows ISPs to disclose the name and address of an account holder who was using a particular IP address at a specific date and time to law enforcement agencies in non-emergency situations without a court order.
In R. v. Vasic, the court noted that Rogers Yahoo! Acceptable Use Policy warns subscribers that Rogers does not treat their names, municipal addresses and telephone numbers as confidential information. The applicant's mother entered into the agreement with Rogers and was bound by its terms. As a result, she was put on notice that Rogers would not keep her name and address confidential (as were all others bound by the agreement's terms, including the applicant). In those circumstances, the court found that the applicant had no reasonable expectation of privacy in his mother's name and address.
McCarthy Tétrault Notes:
It is apparent from these decisions that ISPs may comply with pre-warrant information requests by government institutions for the names and addresses of subscribers associated with a specific IP address without breaching PIPEDA or their subscribers' reasonable expectation of privacy.
There is some concern that these decisions open people's activities on the Internet to police scrutiny without a warrant. However, one must bear in mind that the disclosures in question were made in the context of child pornography investigations by organizations with agreements in place that specifically permitted disclosure of limited subscriber information in such circumstances.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
