Great [Privacy] Expectations: Supreme Court Rules on Privacy Rights in IP Addresses in R. v. Bykovets

Introduction

In a recent 5-4 split decision, the Supreme Court of Canada (the “Court”) held that internet users have a reasonable expectation of privacy in the subject matter of their internet protocol (“IP”) addresses. Accordingly, requests from government agencies to internet third parties for users’ IP addresses is a “search” within the meaning of section 8 of the Canadian Charter of Rights and Freedoms^[1] and may be a violation of the right against unreasonable search and seizure.  

Background

The appellant in R. v. Bykovets,^[2] Andrei Bykovets, was convicted of 14 offences related to using unauthorized credit card data to buy gift cards and possessing material related to credit card fraud.^[3]

In its investigation of allegedly fraudulent online purchases from a liquor store, the Calgary Police Service (the “Police”) contacted Moneris, a third-party payment processing company, to obtain the IP addresses used for certain transactions, which Moneris voluntarily provided.^[4] The Police then obtained production orders compelling the internet service providers (“ISPs”) identified through the IP addresses to disclose subscriber information, thereby identifying Bykovets.^[5]

At trial, the Court of the Queen’s Bench of Alberta held that the Police’s request to Moneris was not a search within the meaning of section 8 of the Charter because Bykovets did not have a reasonable expectation of privacy in his IP address.^[6] The Court of Appeal of Alberta upheld the trial judge’s finding, holding that an IP address, standing alone, reveals nothing of a person’s “core biographical information” and therefore does not give rise to a reasonable expectation of privacy.^[7]

There Is a Reasonable Expectation of Privacy in an IP Address

Justice Karakatsanis, writing for the majority of the Court, concluded that there is a reasonable expectation of privacy in an IP address. A request by the state for an IP address, without judicial authorization through a warrant, therefore constitutes a search that violates Canadians’ section 8 rights.^[8]

To establish a section 8 violation, a claimant must demonstrate that: (1) there was a search or a seizure; and (2) the search or seizure was unreasonable.^[9] At issue in this case was the definition of a search, which occurs where the state invades an individual’s reasonable expectation of privacy.^[10] An expectation of privacy is reasonable where the public’s interest in being left alone outweighs the government’s interest in intruding on the individual’s privacy.^[11]

The courts’ analysis of an expectation of privacy looks at four “interrelated but often competing factors”: (1) the subject matter of the search; (2) the claimant’s interest in the subject matter; (3) the claimant’s subjective expectation of privacy; and (4) whether the subjective expectation of privacy was objectively reasonable.^[12]

The parties in R. v. Bykovets agreed, and the Court accepted, that the second and third factors in the expectation of privacy analysis were satisfied. At issue for the Court to determine were the first and fourth factors: what was the “subject matter” of the search and was Bykovets’ subjective expectation of privacy reasonable?^[13]

Subject Matter of the Search

The Court emphasized the “holistic view” that must be taken to define the subject matter of the search, stating that the approach “must not be mechanical…it must reflect technological reality.”^[14]

With this view in mind, the majority found that the lower courts adopted an “artificially narrow description” of the search’s subject matter in the Police’s IP address request.^[15] The “broad and functional approach” defines the subject matter of the search not only in terms of the information itself but also “the tendency of the information sought to support inferences in relation to other personal information” and does not circumscribe or narrow the subject matter to the state’s declared intention in the use of the information.^[16]

The Court determined that the Police was not requesting the IP addresses as a “collection of numbers” but was seeking all of the information an IP address tends to reveal about an internet user.^[17] An internet user’s online activity associated with an IP address may itself betray highly personal information.^[18]

This was a point of contention between the majority and dissenting opinions. Justice Côté, writing for the dissent, noted that, although the ultimate goal of collecting IP addresses may be to seek a further warrant, personal information is not revealed by the raw IP address alone and is therefore not the subject matter of the search.^[19] Justice Côté narrowed the question to ask: “What information do IP addresses, on their own, disclose, and what inferences do they support”?^[20]

While the dissent acknowledged the majority’s concern that an IP address may, through “third-party websites,” reveal a person’s identity even without the judicial authorization of a warrant,^[21] it found that, on the facts of this case, the evidentiary record established that the IP address alone revealed only limited information.^[22] Whether the analysis regarding a privacy interest in an IP address would change in a case where third-party websites were “spontaneously provid[ing] information without being asked” was “an issue for another day in a case where the situation actually arises on the facts.”^[23]

Reasonable Expectation of Privacy

In assessing whether a claimant’s subjective expectation of privacy is objectively reasonable, the courts ask “whether in a particular situation the public’s interest in being left alone by government must give way to the government’s interest in intruding on the individual’s privacy in order to advance its goals.”^[24]

Among the non-exhaustive considerations that courts take into account when assessing the reasonableness of an expectation of privacy are: (1) the claimant’s control over the subject matter; (2) the place of the search; and (3) the private nature of the subject matter.^[25]

The majority in R. v. Bykovets held that, in light of technological realities in the informational privacy context, neither a lack of control over the subject matter nor a lack of physical intrusion on the place where the search occurred is determinative of or detrimental to the existence of a reasonable expectation of privacy.^[26] Notably, the majority found that the only way to control information over the internet is to make no use of the service at all – which was held not to be a “meaningful” choice as “Canadians are not required to become digital recluses in order to maintain some semblance of privacy in their lives.”^[27]

While the dissent agreed that the idea of the place of the search is a territorial rather than informational privacy concept, it found that internet users lacked control over their IP addresses, which ISPs can change at will and without notice, tending against a finding of a reasonable expectation of privacy in IP addresses.^[28]

On the private nature of the subject matter, the majority found that the “biographical core of personal information” is not limited to identity but includes information that tends to reveal the intimate details of one’s life and personal choices.^[29] In requesting the IP addresses, the subject matter of the Police’s search included not only the numbers making up the IP address but also all of the personal information that an IP address may tend to uncover, which constitutes part of the “biographical core.”^[30]

Ultimately, when weighing internet users’ privacy concerns against the state’s interest in safety and security, the majority concluded that, on balance, requiring police to secure judicial authorization before requesting an IP address is not an onerous investigative step and will not unduly interfere with law enforcement’s ability to address online crime, particularly in the age of telewarrants.^[31] Furthermore, the Court noted that judicial oversight in the disclosure of IP addresses would remove the decision to disclose information – and how much to disclose – from private corporations, returning it to the purview of the Charter as between government and citizen.^[32]

By way of contrast, Justice Côté expressed concern that, given the evolution of online crime, requiring police to seek authorization to obtain an IP address in every case risks exacerbating challenges facing law enforcement and the criminal justice system.^[33]

Key Takeaways

Given the decision outlined above, the following holds true:

• A government agency’s request for an internet user’s IP address is a “search” which may violate Canadians’ section 8 Charter rights, if sought without judicial authorization.
• An individual’s privacy interest in their IP address includes not only the numbers comprising the IP address but also all of the information that an IP address can reveal.
• In the technological age, traditional concepts in the privacy interest analysis may fall out of relevance, including the “place” of an impugned search and even an individual’s control of the information over which they assert a privacy interest.

The Litigation & Dispute Resolution Group at Aird & Berlis has broad experience representing large technology companies in civil litigation and regulatory proceedings involving issues concerning privacy and data protection, cybersecurity, defamation and intermediary liability. The firm also advises technology companies with navigating Canadian privacy and data production laws as they apply to new and existing products, and in developing policies and tailored programs for the evolving Canadian market.