Supreme Court confirms importance of information privacy and Internet anonymity

Here is a posting written by Lisa Di Valentino about the internet privacy decision issued today from the SCC . . .

Supreme Court confirms importance of information privacy and Internet anonymity
by Lisa Di Valentino

Today, the Canadian Supreme Court handed down its long-awaited decision in R. v. Spencer. Daniel Therrien, Canada’s new Privacy Commissioner, has called it “a seminal decision”.

Spencer was convicted by the trial court of possession of child pornography. During the investigation, police made a request to Shaw (the ISP) for the name, address, and telephone number of the household associated with the particular IP address of the user who was sharing these files on a peer-to-peer site. The investigators did not have a warrant or production order for this information; Shaw voluntarily disclosed the data they were seeking. With the information in hand, the police obtained a search and seizure warrant for Spencer’s residence and computer, in which they located the files.

Spencer appealed his conviction on the grounds that the warrantless disclosure of his personal information was not authorized by law (therefore violating) his Charter right to be protected against unreasonable search and seizure by the state). The prosecutor contended, among other things, that the disclosure was permitted by Shaw’s Internet subscription contract and terms of use agreement, and by section 7(3)(c.1)(ii) of the Personal Information and Protectionof Electronic Documents Act (PIPEDA).

The Supreme Court decided that the disclosure did violate Spencer’s Charter rights, but that due to the gravity of the offence, exclusion of the images as evidence would bring the justice system into disrepute. Spencer’s appeal was denied and his conviction for possession of child pornography was upheld.

This decision might seem like a loss for privacy advocates, given that the evidence was ultimately allowed. However, the Court’s ratios confirm the importance of information privacy in the digital networked era.

1. Anonymity can be a privacy interest. The Court did not go so far as to say that anonymity on the Internet is a right, but it confirmed its importance to the section 8 concept of privacy in the Charter.

2. There is a reasonable expectation of privacy in Internet browsing activity, even where ISP contract and policy terms provide that information may be shared with law enforcement without judicial authorization. PIPEDA itself does not create or negate a reasonable expectation of privacy. Section 7(3)(c.1)(ii), permitting the disclosure of personal information without the knowledge or consent of the individual, requires that the body making the request have “lawful authority to obtain the information.” Whether the government institution has lawful authority to obtain the information in fact depends on whether there was a reasonable expectation of privacy in the information.

3. A related and very important result of the decision is that the scope of s. 7(3)(c.1)(ii) has been narrowed. The plain text of the section ostensibly permits private companies to give up clients’ personal information as long as there is a request by someone with “lawful authority”. One could interpret this to mean anyone involved in law enforcement who has “authority” — say, from a superior — to request the information for a specific investigation. Indeed, this seems to have been Shaw’s view at the time.

The Supreme Court, on the other hand, interprets it to mean that the police must not only have authority to ask for the information, they must have the authority to obtain it (para; 70), or in other words, the “authority to compel compliance with that request.” (para. 65). For example, there may be exigent circumstances, or the request may be made pursuant to a law that specifically allows or requires disclosure. It requires “more than a bare request by law enforcement.” (para. 71) Again, the notion of a reasonable expectation of privacy is pertinent: “it would be reasonable for an Internet user to expect that a simple request by police would not trigger an obligation to disclose personal information or defeat PIPEDA’s general prohibition on the disclosure of personal information without consent.” (para. 62)

What is the effect of this decision for the average Internet user — those of us who do not possess or share child pornography? Does it mean that we can rest easy, knowing that ISPs are less likely to give out our personal information to police in a seemingly indiscriminate manner? We don’t necessarily know why ISPs disclose personal information of subscribers to law enforcement without a warrant or production order. There is no requirement in PIPEDA to keep records of the requests, or to be transparent about its privacy activities. In fact, Rogers admits that it does not keep track of their disclosures (see Michael Geist’s June 6 post). Even companies who do keep track do not always distinguish between requests that are judicially authorized and those that are not (see, e.g., Google, Twitter), and those who do may not reveal the specific grounds upon which the government requested the information (e.g. TekSavvy (pdf)).

Of course, we cannot ignore the current legislative attempts to scale back Canadians’ privacy rights — Bill C-13, the “lawful access” bill, and Bill S-4. Bill C-13 would immunize companies from civil and criminal liability for warrantless disclosure of clients’ personal information to law enforcement. It would also lower the standard of authorization for a production order for transmission data from “reasonable grounds to believe that the data will afford evidence respecting the commission of an offence” to “reasonable grounds to suspect that the data will assist in the investigation of the offence.” Transmission data is precisely the sort of information that the Supreme Court has described as the type “to support inferences in relation to other personal information” (para. 31) and, as such, is the subject of a reasonable privacy interest.

Bill S-4 would amend PIPEDA to repeal section 7(3)(c.1)(ii), although the section would not so much be repealed as replaced with section 7(3)(d.1). The new section removes the requirement of “lawful authority”, and even removes the requirement of a request by a government institution. Section 7(3)(d.1) would also extend the scope of warrantless disclosures beyond law enforcement by the state (whether criminal or otherwise) to the investigation of breaches of agreement.

It is unclear what effect R. v. Spencer might have on the progress of Bill C-4. On the one hand, the Supreme Court has affirmed that “lawful authority” requires (for the purposes of section 8 of the Charter) more than just asking. Perhaps the provisions will be found unconstitutional. On the other hand, the Supreme Court made its statements in the context of a criminal case and the Charter of Rights and Freedoms, and cannot yet be said whether the ratio is applicable in contract law. Still, the ruling does raise serious questions about the direction of the government’s privacy policies (see below links). Therrien has encouraged lawmakers to “carefully consider the implications of this ruling.”

Further reading and commentary:

Canadian Civil Liberties Association post (June 13, 2014)

Michael Geist’s blog post (June 13, 2014)

David Fraser blog post (June 13, 2014)

Steven Maher comment (June 13, 2014)

Globe and Mail coverage (June 13, 2014)

CBC coverage (June 13, 2014)

CCLA challenge to PIPEDA (cited in CBC article) (May 21, 2014)

Lisa Di Valentino is a doctoral student in Library & Information Science in the Faculty of Information & Media Studies at the University of Western Ontario.  She maintains a website at  http://fairdealingineducation.com/ and her research  is supported by the GRAND NCE.