Earlier this morning, the Canadian Supreme Court ruled on a recent case before them which examined the legality of voluntary warrantless disclosure of subscriber information from an internet service provider (ISP) to law enforcement. Matthew David Spencer was charged and convicted after a police officer tracked illegal child pornography file downloads to his IP address. The police officer was able to obtain Spencer’s real identity – without a search warrant – by asking his ISP (Shaw) for the customer information attached to that IP address which then allowed the police to track Spencer down.
Spencer appealed the decision but the Saskatchewan Court of Appeal previously ruled “there is no reasonable expectation of privacy for basic internet subscriber information”. The Supreme Court of Canada however disagreed:
the Internet has exponentially increased both the quality and quantity of information that is stored about Internet users. Browsing logs, for example, may provide detailed information about users’ interests. Search engines may gather records of users’ search terms. Advertisers may track their users across networks of websites, gathering an overview of their interests and concerns. “Cookies” may be used to track consumer habits and may provide information about the options selected within a website, which web pages were visited before and after the visit to the host website and any other personal information provided. The user cannot fully control or even necessarily be aware of who may observe a pattern of online activity, but by remaining anonymous – by guarding the link between the information and the identity of the person to whom it relates – the user can in large measure be assured that the activity remains private.
This decision comes at a critical time in Canada as the Canadian government is currently debating privacy reform in the form of two bills – lawful access (Bill C-13) and Personal Information Protection and Electronic Documents Act (PIPEDA) reform (Bill S-4). One of the contentious issues for Canadians in these bills is the government’s desire to expand the scope of warrantless voluntary disclosure of personal information from ISPs and telecommunications companies.
Michael Geist, the Canada Research Chair in Internet and E-commerce Law, has examined the decision and calls it “a huge victory for internet privacy” and says that it “blows away government plans for reform”. Geist continues with a few key findings:
- First, the Court recognizes that there is a privacy interest in subscriber information.
- Second, the court expands our understanding of informational privacy, concluding that there three conceptually distinct issues: privacy as secrecy, privacy as control, and privacy as anonymity.
- Third, not only is there a significant privacy interest, but there is also a reasonable expectation of privacy by the user.
- Fourth, having concluded that obtaining subscriber information was a search with a reasonable expectation of privacy, the information was unconstitutionally obtained therefore led to an unlawful search.
The decision was unanimous and based on the findings, “ISPs are not required to disclose this information and this case reaches the conclusion that they are not permitted to do so absent a warrant either. This means ISPs must change their practices on voluntary warrantless disclosure.”
Even though the Supreme Court ultimately dismissed Spencer’s appeal by finding that the “police acted reasonably and in good faith”, the decision regarding Canadian Internet user’s privacy is indeed a huge victory for internet privacy.
Sources: CBC News, Michael Geist, Supreme Court of Canada Judgement: R. v. Spencer
Last Updated on November 27, 2018.
