Internet providers can’t provide customer names and addresses to police without a warrant
CBC News Jun 13, 2014
Canadians have the right to be anonymous on the internet, and police must obtain a warrant to uncover their identities, Canada’s top court has ruled.
The landmark decision from the Supreme Court Friday bars internet service providers from disclosing the names, addresses and phone numbers of their customers to law enforcement officials voluntarily in response to a simple request — something ISPs have been doing hundreds of thousands of times a year.
It also means parts of the cyberbullying and digital privacy bills that are currently before the House of Commons may be unconstitutional.
Friday’s decision concerned the case of Matthew David Spencer, of Saskatchewan, who was charged in 2007 and convicted of possession of child pornography after a police officer saw illegal files being downloaded to his IP address — a series of numbers representing the internet identity of a device such as a computer.
The police officer went to Spencer’s internet service provider (ISP), Shaw, and asked for the real identity of the customer attached to the IP address. The police officer did not have a search warrant, but was given subscriber information for Spencer’s sister, allowing police to track him down.
Spencer appealed his conviction, arguing that the search was unconstitutional and his rights were violated.
The Saskatchewan Court of Appeal ruled there is no reasonable expectation of privacy for basic internet subscriber information, prompting Spencer to appeal to the Supreme Court of Canada.
The Supreme Court disagreed that there is no reasonable expectation of privacy for the data obtained by police.
“In my view, in the totality of the circumstances of this case, there is a reasonable expectation of privacy in the subscriber information,” Supreme Court Justice Thomas Cromwell wrote.
“The disclosure of this information will often amount to the identification of a user with intimate or sensitive activities being carried out online, usually on the understanding that these activities would be anonymous.”
Warrantless search ‘unreasonable’
He added, “A warrantless search, such as the one that occurred in this case, is presumptively unreasonable. The Crown bears the burden of rebutting this presumption.”
Although the Supreme Court set limits on when internet providers can disclose customer information, it dismissed Spencer’s appeal.
The Supreme Court of Canada says in a decision released Friday that internet users have a right to privacy pending a search warrant. (Shutterstock )
It said police should have obtained a warrant before asking Shaw for the customer information. But it also said police acted reasonably and in good faith, so the administration of justice would be impaired if the evidence gathered by searching Spencer’s home in this particular case were thrown out of court.
The top court decision means Spencer would be subjected to a new trial, on a charge of making child pornography available to others.
The Canadian Civil Liberties Association said in a statement that the Supreme Court decision clarifies “a point of long-standing disagreement between privacy advocates and law enforcement authorities” – whether Canada’s Personal Information Protection and Electronic Documents Act allows police to obtain subscriber information without a warrant. The act governs how the private sector gathers and handles personal information.
The Supreme Court’s ruling that a warrant is required “confirms CCLA’s view that PIPEDA is legislation to protect privacy, and cannot be used to undermine it,” the association said.
The CCLA launched a challenge in May to have parts of PIPEDA declared unconstitutional. It said the new Supreme Court decision may play a “significant role” in the challenge.
‘Huge victory for internet privacy’
Michael Geist, a professor of internet law at the University of Ottawa, called the Supreme Court decision a “huge victory for internet privacy.”
The decision means that the common police practice of obtaining information about customers from internet service providers simply by asking for it must stop, he wrote in a blog post Friday.
“This means ISPs must change their practices on voluntary, warrantless disclosure,” he added.
The decision could also affect two federal government bills, rendering parts of them unconstitutional:
- Bill C-13, which is intended to crack down on cyberbullying, but includes provisions that would give police easier access to the metadata that internet service providers and phone companies keep on every call and email from their customers.
- Bill S-4, to be known as the digital privacy act, would update the Personal Information Protection and Electronic Documents Act that governs how the private sector handles private information. It includes provisions that also make it easier for police to obtain basic subscriber information without a warrant.
Government reviewing decision
The government is reviewing the decision, said Bob Dechert, parliamentary secretary to Justice Minister Peter MacKay during question period Friday.
“In addition,” he said, “we’ll continue to crack down on cyberbullies and online criminals who work against and make our children and all Canadians unsafe.”
A spokesperson for Industry Minister James Moore, who introduced the digital privacy act bill in April, told CBC News that his office is also reviewing the Supreme Court decision.
Meanwhile, opposition MPs said the ruling was no surprise.
NDP House leader Peter Julian said, also during question period, that the NDP and privacy experts had warned the government all along.
“And yet Conservatives are steamrolling ahead with Bill C-13, which also allows unconstitutional spying on Canadians,” he said. “When will they finally take a balanced approach that keeps Canadians secure without infringing on constitutional rights?”
Recent reports show that law enforcement and government agencies have been routinely asking Canadian telecommunications companies for information about hundreds of thousands of their subscribers each year without a warrant.
Rogers Communications released a report last week showing that it received almost 175,000 requests for information about its customers from government and police agencies last year.
In March, the Chronicle Herald newspaper in Halifax reported the Canada Border Services Agency alone accessed telecom customer data almost 19,000 times in one year — and without a warrant more than 99 per cent of the time.
In 2011, the Canadian Wireless Telecommunications Association reported to Canada’s privacy commissioner its members received 1.2 million requests for customer information in one year and disclosed information about 780,000 customers.
Andrew Phillip Chernoff 