In 2014, the Supreme Court of Canada held that a reasonable expectation of privacy attached to the subscriber information associated with an Internal Protocol (IP) address. Now, ten years later, the Court has held that a reasonable expectation of privacy extends to the IP address itself.
In R v Bykovets, 2024 SCC 6, the Supreme Court of Canada was tasked to determine whether the police's request for IP addresses from a third-party payment processing company was a “search” under s. 8 of the Canada Charter of Rights and Freedoms (the “Charter”).
Police were investigating the use of unauthorized credit card data to purchase gift cards that were then used to make fraudulent online purchases. Police contacted Moneris, a third-party payment processing company, to obtain the IP addresses used for certain transactions under investigation. Moneris volunteered the IP addresses without requiring a production order. After obtaining those IP addresses, police then sought and obtained a production order compelling the Internet Service Provider for those IP addresses to disclose the subscriber information. At issue was whether the internet subscribers had a reasonable expectation of privacy in relation to their IP address such that the police's request for that information from Moneris constituted an unreasonable search and seizure contrary to s. 8 of the Charter.
The Trial Judge and the majority of the Alberta Court of Appeal held that there was no reasonable expectation of privacy in an IP address, and therefore police's request to Moneris did not amount to a search under s. 8 of the Charter. As such, a production order or warrant was not required to seek this information from Moneris.
The Supreme Court of Canada allowed the appeal, holding that IP addresses carry a reasonable expectation of privacy and therefore s. 8 of the Charter was engaged. The Court explained that an IP address is a crucial link between an internet user and their online activity, and serves as a portal to that person's identity. The Court rejected the argument that an IP address is not more than a “collection of numbers”. Instead, Justice Karakatsanis (writing for the majority) explained that an IP address is the “first digital breadcrumb” in a trail of online information, and can reveal personal information regarding the subscriber. A request for an IP address connected to an individual is therefore subject to the protections of s. 8 of the Charter.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
