Canadian Internet providers can’t turn over basic subscriber information to police without a search warrant, the country’s top court has ruled.
In a unanimous decision released Friday morning, the Supreme Court of Canada said Canadians expect that information held by carriers is private – that they have a right to anonymity on the Internet that can’t be violated by a police request for information in the process of a criminal investigation.
“It would be reasonable for an Internet user to expect that a simple request by police would not trigger an obligation to disclose personal information,” the court said. By asking for information, police are in fact requesting a search – which needs a court-authorized warrant. No warrant, then any information police get is a violation of a subscriber’s Charter of Rights freedoms.
On the other hand, in the specific case before the court the judges said the evidence police gained – a subscriber’s name and address linked to his IP address – could still be allowed in a trial. Police were acting what they reasonably thought was a lawful way to pursue an important law enforcement purpose, the court said: Possession of child pornography. Therefore it will allow the evidence to stand. However, it sent the case back to a lower court for a new trial on a separate point (see below).
The case has important ramifications for carriers. Rogers Communications recently revealed that of the 174,000 requests for information it received last year from law enforcement agencies, roughly half are to confirm the name and address of a subscriber they already have. Some 9,339 dealt with emergency requests from police officers in life-threatening situations where court orders couldn’t be obtained – so called exigent circumstances.
Asked for comment, Rogers issues a statement saying it is reviewing the decision. “We’ll continue to safeguard our customers’ information and comply with the law,” it added. BCE Inc.’s Bell Canada also said it is reviewing the decision.
The ruling could also force the Harper government to change the wording of the controversial C-13 and S-4 legislation now before Parliament. C-13, the so-called cyberbulling law, includes provisions that protect organizations from being sued for voluntarily handing over information to police under certain circumstances.
The Supreme Court said voluntarily giving information to police can only happen in time-pressing circumstances, or under a reasonable law.
In a blog Halifax-based privacy lawyer David Fraser said the decision is the opposite of the views of most police agencies and the Harper government that basic subscriber information is not the same as that available in a phone book, but the identity of a subscriber linked to specific Internet usage.
University of Ottawa Internet law professor Michael Geist wrote that the decision means Internet service providers “need radical reform” of their practice of sometimes handing over subscriber information to police on request.
The case involved a Saskatchewan police investigation into an IP address of a computer being used to access and store child pornography available to other Internet users. Police asked the Internet provider for the subscriber name and address under a section of the Personal Information Protection and Electronics Documents Act (PIPEDA), which allows the disclosure of personal information so police can carry out a criminal law.
Using the information Matthew David Spencer was charged and convicted of possession of child pornography, and acquitted on a charge of making child porn available to the public. The Saskatchewan Court of Appeal upheld the conviction, but ordered a new trail on the making available charge. That led the man’s lawyer to appeal to the Supreme Court, arguing the giving of subscriber information to police without a warrant was unconstitutional because subscribers have an expectation of privacy.
The Supreme Court noted that what police wanted was not simply the name and address of a subscriber who had a contractual relationship with an ISP – it wanted the identity of a subscriber that corresponded with particular Internet usage.
“Informational privacy is often equated with secrecy or confidentiality, and also includes the related but wider notion of control over, access to and use of information,” the court said. “However, particularly important in the context of Internet usage is the understanding of privacy as anonymity. The identity of a person linked to their use of the Internet must be recognized as giving rise to a privacy interest beyond that inherent in the person’s name, address and telephone number found in the subscriber information.
“Subscriber information, by tending to link particular kinds of information to identifiable individuals may implicate privacy interests relating to an individual’s identity as the source, possessor or user of that information. Some degree of anonymity is a feature of much Internet activity and depending on the totality of the circumstances, anonymity may be the foundation of a privacy interest that engages constitutional protection against unreasonable search and seizure.
“In this case, the police request to link a given IP address to subscriber information was in effect a request to link a specific person to specific online activities. This sort of request engages the anonymity aspect of the informational privacy interest by attempting to link the suspect with anonymously undertaken online activities, activities which have been recognized in other circumstances as engaging significant privacy interests.”
“It would be reasonable for an Internet user to expect that a simple request by police would not trigger an obligation to disclose personal information,” the court said, “or defeat PIPEDA’s general prohibition on the disclosure of personal information without consent.”
That made the request to voluntarily hand over information into a search. Police have lawful powers to search without a warrant, but only if there is what the law calls exigent circumstances — that is, urgent. That wasn’t the case here, so the evidence of identification was unlawfully obtained.
Under most circumstances, illegally obtained evidence can’t be admitted in court. However, the Charter of Rights includes an exception: Such evidence can be admitted in individual cases if the administration of justice would be brought into disrepute if it was forbidden. Because this case involved child pornography, the court said the evidence stands. And it will be presented at Spencer’s new trial.
The new trial was ordered — upholding the Saskatchewan appeal court decision — because of the original trial judge’s ruling acquitting Spencer of making child porn available to the public from his computer. The prosecution has to prove an accused had knowledge that such material was being made available — and Spenser told the court during his trial he didn’t know others could access the files on his PC.
The trial judge ruled that Spenser has to make some “positive facilitation” to be guilty of the offence, essentially saying he didn’t have the intent needed for a conviction. However, the Supreme Court said that was a wrong interpretation of the law. There is a legal concept called “willful blindness” the trial judge should have considered, the top court said.
