Monday, June 23, 2014

Canada: Supreme Court Clarifies Internet Users’ Rights To Privacy And Anonymity ("R. v. Spencer")


Last Updated: June 23 2014

Article by Richard Corley, Peter Ruby, Amalia Berg and Joanna Creed Goodmans LLP
The Supreme Court of Canada has clarified Canadians' rights to privacy on the Internet. On June 13, 2014, the Supreme Court ruled that police cannot obtain the identity of an Internet user from the user's Internet service provider (ISP) without a warrant or court order. Recent reports suggest that police request information from ISPs without warrants or court orders, hundreds of thousands of times per year.

R. v. Spencer addressed this issue in an investigation, prosecution and conviction involving child pornography. The police obtained the IP address used by the accused by monitoring his Internet file sharing activities. The police asked his ISP to identify the subscriber associated with the IP address. With the subscriber information, police identified the accused and seized his computer. In seeking the subscriber information, the police relied on Canada's federal private-sector privacy legislation, known as PIPEDA. Police maintained that it permitted disclosure of personal information for law enforcement purposes even without a warrant or court order.

The accused argued that: (i) disclosure of his identity was an unreasonable search under Section 8 of the Charter; (ii) he had a reasonable expectation of privacy that his Internet activities would be kept private and that his identity would not be associated with those activities; (iii) his personal information was subject to protection under PIPEDA; and (iv) his personal information was not properly subject to disclosure under the lawful authority exemption, in response to a warrantless request made by the police. The Supreme Court agreed and, in an 8 to 0 ruling, decided that the disclosure of his identity was an unreasonable search (but permitted the admission of the resulting evidence).

This ruling has at least two implications for all organizations. First, it reinforces the emphasis in recent jurisprudence on the importance of protecting privacy interests. Second, absent a court order or warrant, an organization generally may not disclose personal information to the police.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.