Legal and Social Affairs Division
This HillNote is the last in a series of four. (Également disponible en français : L’affaire R. c. Spencer, la protection de la vie privée sur Internet et le Parlement)
In June 2014 the Supreme Court of Canada released a landmark decision in R. v. Spencer in which it held that Internet users can have a reasonable expectation of privacy in their online activities. It found that a police request made without a warrant to an Internet Service Provider (ISP) for customer information corresponding to particular Internet activity amounted to a “search” under section 8 of the Canadian Charter of Rights and Freedoms (the Charter).
The Court also determined that the term “lawful authority” found in the Personal Information Protection and Electronic Documents Act (PIPEDA) must mean something more than a “simple request” from a government institution. The term is in a section of PIPEDA that allows, for example, an ISP to disclose a user’s personal information without his or her knowledge or consent to a government institution such as the police.
This HillNote reviews the decision and some possible implications for legislation currently being considered by Parliament, namely Bill C-13 (Protecting Canadians from Online Crime Act) and Bill S-4 (Digital Privacy Act).
The appellant, Matthew Spencer, was convicted at trial with possession of child pornography.
During the preceding investigation, police had identified the Internet Protocol (IP) address of a computer that was being used to access and store child pornography through a file-sharing program. The police sought and obtained the subscriber information associated with that IP address from the ISP, Shaw Communications, without prior judicial consent (such as a warrant). This led them to Mr. Spencer.
To obtain this subscriber information, police relied on section 7(3)(c.1)(ii) of PIPEDA. It permits disclosure without consent to a government institution that has made the request for the purpose of law enforcement and has stated its “lawful authority” for the request.
The police also relied on section 487.014(1) of the Criminal Code. It provides that a peace officer does not need a production order “to ask a person to voluntarily provide to the officer documents, data or information that the person is not prohibited by law from disclosing.”
Mr. Spencer’s conviction at trial was upheld by the Court of Appeal of Saskatchewan. He appealed his conviction to the Supreme Court of Canada, alleging that the police violated the protection found in section 8 of the Charter “to be secure against unreasonable search and seizure” through the way they obtained the subscriber information matching the IP address from the ISP.
The Supreme Court’s decision
The Supreme Court agreed with Mr. Spencer’s arguments and made several determinations about one’s reasonable expectation of privacy in Internet activities. Nonetheless, it upheld Mr. Spencer’s conviction on the grounds that excluding the evidence obtained by the police – who were acting by what they reasonably thought were lawful means to pursue an important law enforcement purpose (paragraph 77 of the decision) – would bring the administration of justice into disrepute.
The Court has previously held that the purpose of section 8 of the Charter is to protect a reasonable expectation of privacy. To show that there is a reasonable expectation of privacy in the activity at issue, one must look at the subject matter of the search and the nature of the privacy interests involved.
The Court determined that the subject matter of the police search was “the identity of a subscriber whose Internet connection is linked to particular, monitored Internet activity” (paragraph 33) [emphasis added]. In other words, the subject matter of the search was not just the basic subscriber information, but subscriber information connected to particular online activities.
In terms of the privacy interests involved, the Court explained that privacy in relation to information includes three distinct but overlapping notions: privacy as secrecy, control and anonymity (paragraph 38). The police request in this case engaged the “anonymity aspect of the informational privacy interest” by attempting to link the suspect with anonymous online activities (paragraph 50).
The Court concluded that “the police request to Shaw for subscriber information corresponding to specifically observed, anonymous Internet activity engages a high level of informational privacy” (paragraph 51) and found that Mr. Spencer had a reasonable expectation of privacy in the subject of the search.
The Court then considered whether the police search was authorized by law. It found that neither of the two provisions used by police to justify the search established the authority for the search.
First, the Court noted that section 487.014(1) of the Criminal Code is not helpful, as it only provides that police can ask a person to voluntarily provide information; it does not give police the authority to obtain the information (paragraph 70).
The Court then looked at the meaning of “lawful authority” in section 7(3)(c.1)(ii) of PIPEDA. On the one hand, it held that “lawful authority” must mean more than a mere request from police.
On the other hand, because an adjacent section of PIPEDA sets out that personal information can be disclosed without consent in order to comply with a subpoena or warrant, the Court indicated that “lawful authority” must mean something other than a subpoena or warrant. Thus, “lawful authority” must fall somewhere between a mere request and a warrant.
The Court suggested that “lawful authority” could refer to the existing ability for police to request information about matters that do not trigger a reasonable expectation of privacy, or to seek information in order to prevent an imminent harm from occurring (for example, to prevent a murder). Or it could refer to some type of authority set out in another law (paragraph 71). None of these was the case.
Given the absence of any “lawful authority,” the Court concluded that the police search was not authorized by law (paragraph 73).
Implications for Parliament
Neither Bill C-13 nor Bill S-4 modifies the legislative provisions considered in R. v. Spencer. However, both contain provisions that may be interpreted as expanding the scope of disclosure to government institutions without the need for a warrant by organizations subject to PIPEDA.
Bill C-13 is now being considered by the Senate Standing Committee on Legal and Constitutional Affairs. It contains a provision confirming that telecommunications service providers who voluntarily preserve data and provide it to law enforcement agencies, even without a subpoena or warrant, will be immune from any criminal and civil liability (new section 487.0195 of the Criminal Code).
Bill S-4, which adds additional exceptions to the need to obtain consent to disclose personal information, was referred to the House of Commons Standing Committee on Industry, Science, and Technology before second reading in the House of Commons. Referral of a bill to a committee before second reading opens the bill to amendment beyond the bill’s original scope.
In a statement issued following the Supreme Court’s judgment, Privacy Commissioner Daniel Therrien indicated that R. v. Spencer confirms that the immunity clause found in Bill C-13 “does not in itself constitute any ‘lawful authority’ for the state to obtain that information under Canada’s federal private sector privacy legislation” (PIPEDA).
He added, “We would encourage parliamentarians to carefully consider the implications of this ruling as they deliberate on Bill C-13 as well as Bill S-4.”
It would appear that the question left open by the Supreme Court of Canada in the wake of R. v. Spencer is what may constitute a “lawful authority” according to section 7(3)(c.1)(ii) of PIPEDA. The upcoming committee meetings on Bill S-4 may engender discussion on this aspect of the law.