On Friday, June 13, 2014, the Supreme Court of Canada issued a landmark decision (R v Spencer) upsetting a common interpretation of a provision of the Personal Information Protection and Electronic Documents Act (PIPEDA) that had been relied upon for many years as permitting pre-warrant disclosures of subscriber information by Internet Service Providers and other organizations in response to police requests.
The provision at issue was paragraph 7(3)(c.1) of PIPEDA, which provides that an organization may disclose personal information without the knowledge or consent of the individual if (a) the government institution (which includes law enforcement) has made a request for the information, (b) the government institution has identified its lawful authority, and (c) the disclosure falls within one of the following specified categories:
7(3) [...] an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is
(c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that
(i) it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs,
(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or
(iii) the disclosure is requested for the purpose of administering any law of Canada or a province;
The court concluded that the determination of whether law enforcement has lawful authority to request information without a production order or warrant depends on an analysis of whether the individual whose personal information is at issue has a reasonable expectation of privacy in that information. If the individual has a reasonable expectation of privacy in the information, law enforcement would (under current provisions of the Criminal Code) require a production order or warrant to obtain access to the information. If there is no reasonable expectation of privacy in the information, the information could be disclosed without a production order or warrant.
In coming to this conclusion, the court expressly rejected a common interpretation of paragraph 7(3)(c.1) of PIPEDA. Under that interpretation, lawful authority was law enforcement's bona fide investigation of an offence. An organization could lawfully provide information in response to such a request. Instead, the court has affirmed that the analysis must begin with an understanding of whether there is a reasonable expectation of privacy in the information at issue. The fact that PIPEDA may permit disclosure without an order or warrant if there is no reasonable expectation of privacy is not relevant to determining whether there is a reasonable expectation of privacy in the first place.
Although the case involved access to subscriber records based on an IP address, the court's ruling has broad implications for any organization that receives a police request for information that is not accompanied by a production order or warrant. Whether the current state of the law will remain for long is uncertain. Given the overall government agenda in Bill C-13, which is currently before Parliament, to expand the investigatory tool kit of policy, one might expect to see some dialogue between Parliament and the court on this issue.
For more information, visit our Privacy and Data Security blog at www.datagovernancelaw.com
Dentons is a global firm driven to provide you with the competitive edge in an increasingly complex and interconnected marketplace. We were formed by the March 2013 combination of international law firm Salans LLP, Canadian law firm Fraser Milner Casgrain LLP (FMC) and international law firm SNR Denton.
Dentons is built on the solid foundations of three highly regarded law firms. Each built its outstanding reputation and valued clientele by responding to the local, regional and national needs of a broad spectrum of clients of all sizes – individuals; entrepreneurs; small businesses and start-ups; local, regional and national governments and government agencies; and mid-sized and larger private and public corporations, including international and global entities.
Now clients benefit from more than 2,500 lawyers and professionals in 79 locations in 52 countries across Africa, Asia Pacific, Canada, Central Asia, Europe, the Middle East, Russia and the CIS, the UK and the US who are committed to challenging the status quo to offer creative, actionable business and legal solutions.
Learn more at www.dentons.com
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances. Specific Questions relating to this article should be addressed directly to the author.