In the physical world, disclosing personal information is a voluntary choice. Online, however, disclosing personal information is required to use search engines, websites, and other intermediaries. Disclosure may be voluntary, but it is an unavoidable condition of participating online. The question, then, is whether information disclosed to private intermediaries as a condition of participating online is protected by Section 8?
Section 8 Framework
Under Section 8 of the Canadian Charter of Rights and Freedoms, every Canadian has the right to be secure against unreasonable search and seizure.[1] Government action constitutes a search or seizure where it interferes with a place, object, or information in which a person has a reasonable expectation of privacy (REP).[2] Whether a REP exists is determined through an analysis of the “totality of the circumstances.”[3] Courts assess the totality of the circumstances through 4 lines of inquiry: (1) what is the subject matter of the search or seizure; (2) does the claimant have a direct interest in the subject matter; (3) whether the claimant had a subjective expectation of privacy in the subject matter; and (4) whether that expectation was objectively reasonable in the circumstances.[4] Together, these inquiries determine whether the claimant has a privacy interest that engages the protection of Section 8.
Defining the Subject Matter
Courts recognize three categories of privacy interests: personal, territorial, and informational.[5] Personal privacy concerns bodily integrity; territorial privacy concerns physical spaces; and informational privacy concerns personal data.[6] For online activity, informational privacy is the relevant interest because the concern is with the information that online activity reveals about an individual. A REP will be found where the subject matter of the search or seizure touches a “biographical core of personal information”, meaning information that reveals intimate details of an individual’s lifestyle, habits, and personal choices.[7] The Supreme Court’s decisions in R v Spencer and R v Bykovets illustrate the application of informational privacy to online activity.
Privacy in Subscriber Information
In R v Spencer, police were investigating child pornography distributed through a peer-to-peer file-sharing network.[8] Police identified an IP address associated with the distribution of the material and contacted the internet service provider (ISP) to request the related subscriber information.[9] The ISP willingly gave the subscriber information to police.[10] Police subsequently obtained a search warrant for the accused’s residence and discovered the illicit files.[11]
The issue before the Supreme Court was whether the accused had a REP in subscriber information held by the ISP. The Court found a privacy interest arose not merely from the subscriber information, but from the connection between the subscriber’s identity and their online activity.[12] Anonymity is an important dimension of informational privacy. Online activity can reveal highly personal information about the person behind that activity. The Court concluded that the accused had a REP in subscriber information and that police conduct in obtaining it without judicial authorization constituted a search under Section 8.[13]
Privacy in an IP Address
If there is a privacy interest in subscriber information connecting an individual to online activity, what about the IP address itself? The Supreme Court considered that question in R v Bykovets. In Bykovets, police were investigating fraudulent online purchases.[14] They obtained IP addresses associated with fraudulent transactions from a payment processor.[15] The police had not received judicial authorization to obtain the IP addresses.
The Crown argued that an IP address was simply a string of numbers and did not itself reveal the identity of the person using it.[16] On this view, no REP could exist until police took the additional step of obtaining subscriber information linking the IP address to a particular person. The Supreme Court rejected that approach.[17] The Court recognized that an IP address is not merely a numerical label. The relevant privacy interest arises not only from what the IP address reveals, but from its potential to provide access to information about an identifiable internet user.[18] The Court concluded that a REP attaches to an IP address.
Bill C-22 and the Tension with Spencer and Bykovets
Spencer and Bykovets established that Canadians have a REP in both their subscriber information and their IP address. However, Bill C-22, a bill expanding the legal authorities of law enforcement to obtain digital information, threatens to undermine the privacy protections recognized in Spencer and Bykovets by lowering the evidentiary threshold for accessing digital information that attracts a REP.[19] The bill would create a “subscriber information production order” allowing police to obtain subscriber information on a standard of “reasonable grounds to suspect” rather than “reasonable grounds to believe.”[20] This raises a fundamental Section 8 question: can the government lower the threshold for accessing digital information that the Supreme Court has recognized as constitutionally protected? The implications of Bill C-22 may extend beyond the specific powers it creates, potentially shaping the extent to which Canadians can expect privacy in the digital information they disclose to participate in modern life.
How can Collett Read LLP Help?
Constitutional privacy rights under Section 8 of the Charter are protected, but navigating digital privacy claims and police investigations requires precise legal strategy.
If you are facing a criminal investigation involving internet activity contact us today at 905-541-2228 or fill out our intake form for a free consultation.
[1] Canadian Charter of Rights and Freedoms at s 8, Part 1 of the Constitution Act, 1982, being Schedule B to the Canada Act, 1982, 1982, c 11 (UK) [Charter].
[2] Hunter v Southam, 1984 CanLII 33 (SCC) at pp 159-160, [1984] 2 SCR 145 [Hunter].
[3] R v Buhay, 2003 SCC 30 at para 18 [Buhay].
[4] R v Tessling, 2004 SCC 67 at paras 31-32 [Tessling].
[5] Tessling at para 20.
[6] Tessling at paras 20-24.
[7] Tessling at para 23; R v Plant, 1993 CanLII 70 (SCC) at p 293, [1993] 3 SCR 281 [Plant].
[8] R v Spencer, 2014 SCC 43, at para 7 [Spencer].
[9] Spencer at paras 9-11.
[10] Spencer at para 12.
[11] Spencer at paras 12-13.
[12] Spencer at paras 32, 66.
[13] Spencer at paras 67-68.
[14] R v Bykovets, 2024 SCC 6 at para 16 [Bykovets].
[15] Bykovets at para 16.
[16] Bykovets at paras 9, 80.
[17] Bykovets at paras 9, 80.
[18] Bykovets at para 69.
[19] Department of Justice Canada, “Proposed changes to laws on timely access to information (Bill C-22 – Part 1)” (n.d.) https://www.justice.gc.ca/eng/csj-sjc/pl/c22/.
[20] Department of Justice Canada, “Proposed changes to laws on timely access to information (Bill C-22 – Part 1)” (n.d.) https://www.justice.gc.ca/eng/csj-sjc/pl/c22/.
