This is a critical time for privacy on the internet. Private entities, from the global, all-knowing Google to a local Internet Service Provider (ISP), retain sensitive and private information about their users. In Canada, privacy advocates are concerned about Bill C-13, the “Cyberbullying Act” and Bill S-4, the Digital Privacy Act, which are currently before Parliament and which can have serious privacy implications for Canadians. The Supreme Court of Canada’s landmark decision in R v. Spencer, which affirms anonymity as a key component of the right to privacy, comes at a much-needed time.
Mr. Spencer accessed and stored child pornography by way of the free peer-to-peer file-sharing program LimeWire. By using publicly available software, the Saskatoon Police Service was able to obtain the Internet Protocol address of the computer, but needed more information in order to identify the individual user. Police investigators made a written “law enforcement request” for the subscriber information pursuant to s.7(3)(c.1)(ii) of the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) to Shaw (the ISP), who complied with the request and released the name, address and telephone number of the customer using the IP address. The police used this information to obtain a search warrant, search Mr. Spencer’s home and seize his computer, which contained hundreds of child pornography images.
The Supreme Court of Canada was faced with a number of questions, including whether, in the circumstances, the police conduct violated Mr. Spencer’s s.8 Charter right to privacy.
The Court looked at the subject mater of the search, the nature of the privacy interest triggered by the search, and whether Mr. Spencer had a reasonable expectation of privacy in the personal information disclosed by Shaw. The Court found that Mr. Spencer’s name, address and telephone number did not simply provide the information of someone who had a contractual relationship with Shaw, but rather linked information about the identity of an internet subscriber to a particular internet usage, which could reveal intimate details of the lifestyle and personal choices of an individual.
In assessing the nature of the privacy interest, the Court recognized three understandings of informational privacy: privacy as secrecy (e.g. confidentiality of medical information provided by patients), privacy as control (the ability to choose what happens with one’s personal information), and privacy as anonymity (where information provided can be disseminated, but without disclosing the identity of its source).
Deciding whether Mr. Spencer had a reasonable expectation of privacy required the Court to look at the provisions of PIPEDA – the federal legislation that creates a general prohibition on the disclosure of personal information without consent. Section 7(3)(c.1)(ii) contains an exception to the requirement for consent when a government institution, for the purpose of law enforcement, makes a request that identifies “its lawful authority to obtain the information”.
The Court found that it is reasonable for an internet user to expect that a simple request by police would not amount to lawful authority, would not trigger an obligation to disclose personal information, and would not defeat PIPEDA’s general prohibition on the disclosure of personal information without consent. The requirement for lawful authority meant that the police could ask Shaw for information, but without a warrant, had no legal authority to compel Shaw to comply with their request.
In conclusion, the Court determined that the police conduct amounted to a “search”, triggering Mr. Spencer’s s.8 Charter right to privacy, that the search was conducted without lawful authority, but that the evidence of the electronic files containing child pornography could not be excluded from the record because of the serious nature of Mr. Spencer’s crime, and because excluding the evidence would undermine societal interests and put the administration of justice into disrepute.
The decision is a victory for privacy rights. It confirms that internet users have a reasonable expectation of privacy in their online activities, and that anonymity is a critical component of informational privacy. It also clarifies that where privacy statutes require “lawful authority”, organizations are empowered to deny warrantless investigative requests and prioritize their customer’s privacy interests. In an increasingly public internet space, the decision affirms that individuals have the right to preserve their freedom from identification and surveillance.