In today’s hyper-connected world, your online activity leaves a trail of digital breadcrumbs. One crucial piece of information within this trail is your IP address, which is a unique identifier that acts like your virtual home address. So, if law enforcement asks your internet service provider for your IP address, does this constitute an invasion of privacy?
This blog will examine the legal justifications for police access to IP addresses while recognizing individual’s rights to privacy in the digital sphere. This blog will also summarize a recent key decision from the Supreme Court of Canada, in which the Court adopted a broad view of internet privacy in relation to s. 8 of the Charter.
Police Request IP Addresses From Third-Party Company
In the recent decision of R. v. Bykovets, the Supreme Court of Canada held that individuals are afforded a reasonable expectation of privacy regarding their internet protocol (“IP”) addresses under s. 8 of the Canadian Charter of Rights and Freedoms (the “Charter”). At the crux of the appeal was the question of “whether an IP address itself attracts a reasonable expectation of privacy” to which the Supreme Court of Canada answered yes.
The case centred around a police investigation into fraudulent online purchases from a liquor retailer. The appellant was convicted of 14 offences for using unauthorized credit card data to purchase gift cards online, which he would use to make in-store purchases, and for possessing material related to credit card fraud.
During the Calgary Police Service’s investigation, they learned that a third-party payment processing company managed the store’s online sales. Subsequently, the police contacted this company to obtain the IP addresses that were used for the transactions in question, two of which were voluntarily identified by the third-party company. Police then used this information to seek and obtain a warrant (a court order compelling the internet service provider to disclose subscriber information associated with IP addresses) after which “the appellant was arrested, convicted at trial, and his convictions were confirmed on appeal.”
Does an IP Address Attract a Reasonable Expectation of Privacy?
Before the trial began, the appellant argued that the police’s request to the third-party company “violated his right against unreasonable search and seizure under s. 8 of the Charter.” On the voir dire, the key question for the Court was whether the appellant had a “reasonable expectation of privacy in his IP address.” The trial judge found that there was no “reasonable expectation” of privacy in the IP addresses because “IP addresses do not provide a link to, or any other information about, an Internet user.” The majority agreed with this conclusion when the matter was appealed to the Court of Appeal for Alberta.
When the matter came before the Supreme Court of Canada, the appeal was allowed, with the Court noting that police were required to obtain a warrant prior to asking the service provider for IP addresses associated with the fraudulent transaction. The Court highlighted the fact that “online activity associated to the IP address may itself betray highly personal information without the safeguards of judicial pre-authorization.” The Court also highlighted that the purpose of s. 8 of the Charter is to protect privacy, including informational privacy, which includes “a biographical core of personal information which individuals in a free and democratic society would wish to maintain and control from dissemination to the state.”
Canadians Have a Reasonable Expectation to Privacy of IP Addresses
In order to establish a violation of s. 8, a claimant must prove that a search or seizure occurred, and that the search or seizure was unreasonable. In this case, the question of whether the request for the IP addresses was a search was a key issue. Here, although courts will consider several factors to determine whether a reasonable expectation of privacy arises in certain circumstances, two key factors were at issue:
- the subject matter of the search; and
- whether the appellant’s subjective expectation of privacy was objectively reasonable.
Under this assessment, the majority of the Court held that Canadians have a reasonable expectation of privacy in their IP addresses under s. 8 of the Charter.
IP Address is the First Digital Breadcrumb of an individual’s Internet Activity
The Court noted that the “new realities” associated with the Internet “have forced courts to grapple with “a host of new and challenging questions about privacy.” In R v. Spencer, the Supreme Court of Canada held that a “reasonable expectation of privacy attaches to subscriber information — the name, address, and contact information — associated with an individual Internet Protocol (IP) address. A request for this information by the state is a “search” under s. 8 of the Canadian Charter of Rights and Freedoms.”
The Court held that the police had committed a breach of the appellant’s privacy rights by making the request to the third-party internet provider without having obtained prior judicial authorization. In other words, by making such a request without first obtaining permission from a judge, police will usually be found to have breached s. 8 of the Charter. Moreover, the Court stated that an IP address is “the first digital breadcrumb that can lead the state on the trail of an individual’s Internet activity” and is the “the key to obtaining more information about a particular Internet user including their online activity and, ultimately, their identity.”
Key Takeaways Regarding Digital Privacy
This decision has far-reaching implications for private organizations that regularly respond to production requests for information from law enforcement or other regulatory bodies. This decision affirms that Canadians have a reasonable expectation of privacy in their IP addresses and emphasizes that law enforcement generally must apply for judicial authorization prior to making requests for IP addresses. Further, this decision reflects the broad concept of online privacy, which may impact the development of Canadian privacy laws.
Contact Hicks Adams for Comprehensive Legal Advice on Your Charter Rights
At Hicks Adams, our experienced criminal defence lawyers ensure that your Charter and Constitutional rights are protected from the moment you come into contact with police until the conclusion of your case. When it comes to appealing a Charter violation, we will protect your interests and defend your rights. To speak with a member of our criminal defence team regarding your case, contact us by phone at 975-1700 (toll-free at 1-877-975-1700) or reach out to us online.
