In its June 13, 2014 decision in R v. Spencer, the Supreme Court
of Canada has begun what will undoubtedly be a long process of
delineating the privacy rights of Canadians in their online
activities. Justice Cromwell, writing for the Court, started his
reasons by noting that the internet has raised manifold and
challenging privacy concerns. The question at issue in
Spencer is whether Canadians have a Charter
protected privacy interest in data gathered by their internet
service provider ("ISP") about their online activities.
The Court answered this question in the affirmative.
Mr. Spencer was the subject of a police investigation for
activities related to child pornography. During the investigation,
the police requested information from Mr. Spencer's ISP, which
complied with the request. The police had not obtained a search
warrant for this information, and Mr. Spencer challenged the
provision of the information to the police by his ISP on the
grounds that it violated his Charter right against
unreasonable search and seizure.
Under section 8 of the Charter, every person has the
right to be protected from state intrusion on information to which
they have a reasonable expectation of privacy, except where such
intrusion is authorized by law and the law itself is reasonable.
The question of interest in this case was whether an individual has
a reasonable expectation of privacy over information about their
internet activities, where that information was gathered by their
ISP. This requires both the subjective expectation of privacy by
the person and that the expectation of privacy be objectively
reasonable in the circumstances. The Court concluded that there is
such a reasonable expectation.
In coming to this conclusion, Justice Cromwell noted that a
subjective expectation of privacy by an internet user can be
inferred from the fact that they transmit sensitive information
through their internet connection. This expands the internet
user's subjective expectation of privacy from the contractual
relationship between him or herself and the ISP, to any ISP through
which sensitive information is transmitted by a person. Justice
Cromwell did not consider this aspect of the test to be
However, the question of whether it is reasonable for an
internet user to expect that their information would not be
disclosed is more challenging. Anonymity in the public sphere has
been recognized as being a type of privacy that can reasonably be
expected in certain circumstances. Of particular interest in this
context, the Court recognized that the internet has extended both
the self-perceived ability of individuals to present themselves
anonymously to the world, and the extent to which information can
be gathered on people's activities while they believe
themselves to be acting anonymously. The contrast between this
perceived anonymity and the ability of many entities to track
individual online activity will certainly be the subject of further
comment in the realm of internet privacy. In this case, the Court
determined that it was reasonable to expect that one's internet
activities would remain private.
Justice Cromwell then moved on to consider the effect of the
ISP's terms of service on Mr. Spencer's privacy interest.
Although Mr. Spencer was not a party to a contract with the ISP (he
was using his sister's connection), the Court found that he
would have been aware that use of the ISP's service would be
governed by terms and conditions, and that he would have had access
to those terms and conditions online. The terms of service in
question indicated that the ISP would only release personal
information when requested by the police in accordance with the
Personal Information Protection and Electronic Documents
Act, which requires the police to have lawful authority for
the ISP to release the information. Justice Cromwell found that
lawful authority in this case meant more than a bare request. As a
result, the ISP terms of service reinforced the conclusion that Mr.
Spencer's expectation of privacy was reasonable.
Ultimately, the Court found that the evidence should be admitted
despite the Charter violation. More important, from a
civil perspective, are the implications for businesses that collect
private information and for individuals who engage in activities on
the internet. Internet companies and employers must carefully
consider their obligations under privacy legislation in order to
avoid running afoul of such laws. The ease with which online
activities can be traced highlights the importance of securing
personal information from outside scrutiny by both governmental and
non-governmental actors. This case is only the first of many that
will deal with privacy concerns stemming from internet activity.
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).