On March 1, 2024, the Supreme Court of Canada decided that there was a reasonable expectation of privacy in Internet Protocol (IP) addresses. As a consequence, the court allowed Mr. Bykovets’ appeal in R v Bykovets, set aside his convictions, and ordered a new trial. This decision reversed the decisions of the lower courts and confirmed that the right to privacy included the meaningful protection of Canadians’ online privacy, which involved protecting their IP addresses.
What happened?
Back in 2017, the Calgary police began an investigation into fraudulent online purchases from a liquor store and discovered that the store’s online sales were managed by Moneris (a third-party payment processing company). The police contacted Moneris to obtain the IP addresses that were used, and Moneris identified two IP addresses.
The police then obtained an order from the court compelling the addresses’ Internet Service Provider (ISP) to disclose the name and residential address of the customer for each of the two addresses (there was one for Mr. Bykovets, and one for his father).
Subsequently, the police used the information to obtain and execute search warrants at the residences. As a result, Mr. Bykovets was arrested and charged with offences relating to, among others, possession and use of third parties’ credit cards and personal information documents.
Before the trial, Mr. Bykovets challenged the police’s request to obtain the IP addresses from Moneris and alleged that it violated his right against unreasonable search and seizure under section 8 of the Charter of Rights and Freedoms (Charter).
In fact, he argued that what the police did constituted a “search,” and that search invaded the reasonable expectation of privacy that he had regarding his IP address.
What did the trial judge decide?
The trial judge found that the police’s request to Moneris was not a “search” because there was no reasonable expectation of privacy in an Internet user’s IP address. The judge explained that on their own, the IP addresses did not provide a link to an Internet use, or any other information about the use for that matter.
More specifically, the judge considered several factors and concluded that it was not objectively reasonable to recognize a subjective expectation of privacy in an IP address used by an individual.
Since there was no reasonable expectation of privacy in Mr. Bykovets’ IP address, there was no violation of section 8 of the Charter.
Mr. Bykovets was convicted of 14 offences. He appealed to the Court of Appeal.
What did the Alberta Court of Appeal decide?
The Court of Appeal agreed with the trial judge—the majority did anyway.
More specifically, the court noted that an IP address did not tell police where the address was being used or who was using it. To obtain the core biographical data (address, name, phone number of the user), the police had to get and serve a production order on the ISP in accordance with a well-known case, R v Spencer.
The court stated, “That is what the police did here.”
The court continued to explain that IP addresses were abstract numbers that revealed none of the core biographical information that attached to the person: “Standing alone, it reveals nothing”. It also did not communicate confidential information. In fact, only the ISP could provide the subscriber information. Police could also get the information with an order under Spencer.
The court stated:
“In this case, the trial judge correctly held that, because Spencer already protects a person’s section 8 interests, the appellant has no reasonable expectation of privacy in an IP address and there is no requirement for the police to obtain judicial authorization at that preliminary stage in the investigation.”
Further, the court stated that the trial judge rightly referred to the important factors to consider to determine whether there was a reasonable expectation of privacy, correctly interpreted the scope of section 8 of the Charter, and applied the correct principles. The judge also referred to other relevant cases such as R v Cole, R v Tessling, and R v Marakah.
This meant that Mr. Bykovets’ appeal was dismissed. Mr. Bykovets appealed to the Supreme Court of Canada.
But first, it is important to note that there was a dissent whereby the dissenting judge (Veldhuis JA) stated that he would have allowed the appeal because there was a reasonable expectation of privacy associated with IP addresses.
Essentially, the judge noted the purpose of section 8 of the Charter: to protect an individual’s right to be left alone. He also noted that the Supreme Court has recognized that personal privacy was vital to an individual’s dignity, autonomy, and personal growth—this was a basic prerequisite to the flourishing of a free and healthy democracy.
In this case, the dissenting judge pointed out the four main factors found in Spencer:
- The subject matter of the alleged search
- The claimant’s interest in the subject matter
- The claimant’s subjective expectation of privacy in the subject matter
- Whether the subjective expectation of privacy was objectively reasonable, having regard to the totality of the circumstances
The judge also pointed out that the reasonable expectation of privacy was a normative standard rather than simply descriptive. This meant that the standard had to be laden with value judgments made from the independent perspective of the reasonable and informed person who was concerned about the long-term consequences of government action for the protection of privacy.
The dissenting judge also stated that the normative approach required us to consider whether piercing an Internet user’s anonymity presented such a risk to privacy as to demand constitutional protection. He answered “yes” to this question. He also stated that Mr. Bykovets had a reasonable expectation of privacy in IP addresses because they were linked to a particular, monitored Internet activity that could disclose biographical core information. Therefore, prior judicial authorization was required to obtain the IP addresses.
Since the dissenting judge would have found that there was a reasonable expectation of privacy in IP addresses, he would have found a breach of section 8 of the Charter, and returned the matter for a new trial.
What did the Supreme Court of Canada decide?
Justice Karakatsanis wrote for the majority and confirmed that section 8 of the Charter had to meaningfully protect the online privacy of Canadians in today’s digital world, and this entailed the protection of their IP addresses. IP addresses were unique identification numbers that were necessary to access the Internet. ISPs kept track of user information that was attached to each IP address.
In fact, an IP address was the crucial link between an Internet user and that user’s online activity—it was the key to unlocking a user’s identity such that it attracted a reasonable expectation of privacy.
The court explained that, viewed normatively, the IP address was the key to unlocking the user’s identity. When protecting informational privacy, the claim of individuals, groups, or institutions determined for themselves when, how, and to what extent information about them is communicated to others.
The court also noted the main factors used to consider whether there was a reasonable expectation of privacy (highlighted by the dissenting judge), and subsequently made the important point that defining a reasonable expectation of privacy was an exercise in balance. In this case, the court stated that the balance weighed in favour of extending a reasonable expectation of privacy to IP addresses. The court stated, “The intensely private nature of the information an IP address may betray strongly suggests that the public’s interest in being left alone should prevail over the government’s interest in advancing its law enforcement goals.”
The court also stressed that for safety and security reasons, police should have the investigative tools to deal with online crime; however, requiring police to obtain prior judicial authorization before obtaining an IP address was not an onerous investigative step. This requirement better reflected what each reasonable Canadian expected from a privacy perspective, and also from a crime control perspective.
Since the Supreme Court of Canada found that there was a reasonable expectation of privacy in IP addresses, a request by the state (the police) for an IP address did constitute a “search” under section 8 of the Charter.
Therefore, the Supreme Court of Canada allowed Mr. Bykovets’ appeal, set aside his convictions, and ordered a new trial.
What does this mean for Canada?
As can be seen with this case, the courts are evolving with societal expectations of privacy. Building on several key Supreme Court of Canada decisions, the Supreme Court of Canada has set out a more comprehensive understanding of the reasonable expectation of privacy with respect to section 8 of the Charter.
An early foreshadowing surfaced with the opinion of the dissenting judge at the Court of Appeal, and the Supreme Court of Canada picked up on the idea that section 8 of the Charter required a more refined view in the current digital age.
What can we expect going forward? Certainly, we will likely see law enforcement seeking authorization to search IP addresses before arresting individuals. As mentioned by the court, this step is not so onerous that it should outweigh privacy rights.
- Recent proposal for an American federal privacy law - April 19, 2024
- Bill 149 receives royal assent March 21, 2024 - April 1, 2024
- Reasonable expectation of privacy in Internet Protocol (IP) addresses - March 26, 2024
Leave a Reply