Canada's new proposed law to outlaw explicit deepfakes: Bill C-16

A number of years ago, the Parliament of Canada amended our Criminal Code to create a criminal offense related to the non-consensual distribution of intimate images. Last month, the Government of Canada proposed to further amend the Criminal Code to include so-called deepfake intimate images, and to create an offence of threatening to disclose intimate images, deepfake or not.

Section 162.1, which was added to the Criminal Code in 2014, makes it an offence to publish, distribute, transmit, sell, make available or advertising an intimate image without the consent of the individual depicted in the image. 

And a number of provinces have put in place laws that create civil remedies for the non-consensual distribution of intimate images. 

With some variation, they generally have the same definition of “intimate image”, but they really haven’t kept up with an explosion of synthetic, AI-generated intimate imagery. Synthetic images are created by generative AI systems that can “learns” what a person looks like and can use that information to create new images that resemble that person. 

If you look at the definition of what is an intimate image, it clearly presupposes that it is a recording of an actual person and that the actual person was involved, or at least present at its recording.

Criminal Code – 2014 Amendments Definition of intimate image (2) In this section, intimate image means a visual recording of a person made by any means including a photographic, film or video recording, (a) in which the person is nude, is exposing his or her genital organs or anal region or her breasts or is engaged in explicit sexual activity; (b) in respect of which, at the time of the recording, there were circumstances that gave rise to a reasonable expectation of privacy; and (c) in respect of which the person depicted retains a reasonable expectation of privacy at the time the offence is committed.

It refers to an image or recording where the person “is exposing” certain body parts or “is engaging” in explicit sexual activity. It talks about “reasonable expectations of privacy” at the time the image is recorded and at the time the offence is created. 

This definition would not capture synthetic, “deep fake” intimate images.

The province of British Columbia has the newest provincial statute to create a civil framework to provide civil remedies for the non-consensual distribution of intimate images. The definition there is clearly modeled on the definition from the Criminal Code of Canada, but does include images where the person is depicted as engaged in a particular activity, also regardless of whether the image has been altered. So the BC law would cover a situation where an actual image of a person has been altered, in any way, to depict the person as engaging in certain acts or nude. 

Intimate Images Protection Act (British Columbia) “intimate image” means a visual recording or visual simultaneous representation of an individual, whether or not the individual is identifiable and whether or not the image has been altered in any way, in which the individual is or is depicted as (a) engaging in a sexual act, (b) nude or nearly nude, or (c) exposing the individual's genital organs, anal region or breasts, and in relation to which the individual had a reasonable expectation of privacy at, (d) in the case of a recording, the time the recording was made and, if distributed, the time of the distribution, and (e) in the case of a simultaneous representation, the time the simultaneous representation occurred;

But this updated definition does not cover purely synthetic images, meaning images that are original and are not simply alterations of existing images. You may recall a little while ago when AI generated sexualized images of superstar Taylor Swift were posted online. If I recall correctly, these were images that were not alterations of existing images but were rather the result of the AI image generator having ingested many, many images of Taylor Swift and “knowing” what she looks like. Those images would not have been captured by the current Criminal Code or even the newer definition in the British Columbia intimate images law. 

In December, the Government of Canada introduced Bill C-16, called the “Protecting Victims Act”, that makes a number of amendments to Canadian criminal and related laws. Included in Bill C-16 are proposed amendments that will expand the existing definition of “intimate image” to include synthetic deepfakes. 

So here’s the new definition from Bill C-16, but it’s more helpful to compare it to the existing language of the Criminal Code. I’ve crossed out what’s being removed and underlined what’s being added. So we see in subsection (2)(a)(i), where it deals with what has to be in an image or recording to be considered an “intimate image” – they’ve removed “his or her genital organs or anal region or her breasts” and have replaced it with “their sexual organs”. 

Bill C-16 Proposed amendments (redline)

Definition of intimate image

(2) In this section, intimate image means

(a) a visual recording of a person made by any means including a photographic, film or video recording,

(i) in which the person is nude, is exposing his or her genital organs or anal region or her breasts their sexual organs or is engaged in explicit sexual activity,

(ii) in respect of which, at the time of the recording, there were circumstances that gave rise to a reasonable expectation of privacy, and

(iii) in respect of which the person depicted retains a reasonable expectation of privacy at the time the offence is committed; or

(b) a visual representation that is made by any electronic or mechanical means and that shows an identifiable person who is depicted as nude, as exposing their sexual organs or as engaged in explicit sexual activity, if the depiction is likely to be mistaken for a visual recording of that person.

That change doesn’t really do what it appears it will do because they’ve added a new defined term in section 150 of the Code, which defines specific terms for Part V of the Code which deals with sexual offences. 

“sexual organs” include breasts that are or appear to be female breasts and the anal region; 

So this isn’t really a material change, as far as I can see. 

Subsection (2)(b) is where they scope in deepfakes:

(b) a visual representation that is made by any electronic or mechanical means and that shows an identifiable person who is depicted as nude, as exposing their sexual organs or as engaged in explicit sexual activity, if the depiction is likely to be mistaken for a visual recording of that person.

So this part doesn’t depend on the reasonable expectation of privacy in the image or recording. Which makes sense. An actual image of an actual person will be associated with that actual person’s expectations of what would happen with that image. A purely made-up image doesn’t have that. 

The key parts are that it is a visual representation that depicts the same sorts of body parts or conduct as in subsection (2)(a)(i), and that it has to be sufficiently realistic that the depiction “is likely to be mistaken for a visual recording of that person.”

It can’t be cartoon-ish or of such poor quality that you’d know immediately that it is not really that person. 

The scope of what could be an intimate image could be broader, but we have to be mindful of freedom of expression. Unfortunately, as of January 10 when I’m recording this, no Charter statement related to Bill C-16 has been released by the Canadian Department of Justice. (It’s been more than a month since the Bill was tabled in Parliament, so should have been released by now.)

The creation and distribution of intimate images is an expressive act and would be protected by the freedom of expression provision in section 2(b) of the Charter of Rights and Freedoms. But protected expression can be subject to “reasonable limits prescribed by law as can be demonstrably justified in a free and democratic society”. In order to justify the limitation, the goal of the legislature has to be pressing and substantial. i.e., is the objective sufficiently important to justify limiting a Charter right? And then there has to be proportionality between the objective and the means used to achieve it. 

This has three parts: first, the limit must be rationally connected to the objective. There must be a causal link between the measure and the pressing and substantial objective.

Second, the limit must impair the right or freedom no more than is reasonably necessary to accomplish the objective. The government will be required to show that there are no less rights-impairing means of achieving the objective “in a real and substantial manner”. 

Third, there must be proportionality between the deleterious and salutary effects of the law.

I think there is some risk that this expanded definition of “intimate images” may be vulnerable to being struck down as an unjustified infringement of freedom of expression. The law doesn’t create an offence of creating explicit deepfakes for “personal use”, so that’s not an issue. Though there is a defence related to “serving the public good” in section 162.1(3), I don’t think it’s broad enough to address the potential use of deepfakes in political satire and commentary.

Whether you like it or not, and regardless of whether you think it’s tasteful, AI generated imagery is being used to produce political commentary and satire. And yes, some of it does veer into depicting body parts and activities that can be captured in the new definition of “intimate image.” And you generally can’t outlaw expression just because it’s tasteless. At the end of the day, I don’t think the existing defence of “serving the public good” shields such political expression and leaves this provision vulnerable to a successful Charter challenge. 

Before I wrap up, I should note that the Protecting Victims Act also proposes to create an offence of threatening to publish or distribute an intimate image. This is the new section 162.1(1.1):

Everyone who, with the intent to intimidate or to be taken seriously, knowingly threatens to publish, distribute, transmit, sell, make available or advertise an intimate image of a person knowing that the person depicted in the image would not give their consent to that conduct, or being reckless as to whether or not that person would give their consent to that conduct, is guilty of an offence.

This goes beyond what is typically described as “sextortion”, where a bad guy threatens to release intimate images in exchange for more such images or money. “Sextortion” is captured in the general offence of extortion. This new offence would capture a threat even where the person making the threat doesn't expect or demand anything in return. It’s a reasonable addition to the criminal law.

Federal Court concludes that a “virtual presence” in Canada is enough to be ordered to assist CSIS

Decision follows trend starting in BC that a virtual presence in Canada is enough to be ordered to produce records

The Federal Court of Canada, in connection with an application for a warrant and an assistance order under the Canadian Security Intelligence Service Act, was required to consider whether an assistance order under s. 22.3(1) of that Act could be issued to order a legal person with no physical presence in Canada to assist CSIS with giving effect to a warrant. The order would have extra-territorial effect.

In a redacted decision, Re Canadian Security Intelligence Service Act (Can), the court concluded that it can, provided that the subject of the assistance order has a “virtual presence” in Canada. The decision notes that the foreign company involved was willing to assist, but needed to see a court order to manage their possible legal liability:

[3]       The affiant explained that [REDACTED] is incorporated and headquartered in [REDACTED] does not have physical offices or employees in Canada. It has a virtual presence in Canada that consists of [_some physical presence in Canada_]. It solicits business from Canadians and [REDACTED].

 

[4]       The affiant also explained that [REDACTED] has been fully cooperative in providing assistance to CSIS to date, but has advised CSIS that it requires a judicial authorization from a Canadian court to minimize its legal risk in the event that CSIS uses the collected intelligence beyond analysis; [REDACTED]. [REDACTED] advised that it would continue to be cooperative pending and upon receipt of an Assistance Order.

The company’s willingness to comply wasn’t particularly material to the Court’s decision.

At the urging of the government and largely supported by a court-appointed amicus, the Court followed a trend of cases that have dealt with similar questions but involving production orders under the Criminal Code. The first of these cases is British Columbia (Attorney General) v. Brecknell, where the Royal Canadian Mounted Police were seeking to obtain a production order naming Craigslist. As with this CSIS case, Craigslist said they’d cooperate but needed to see a court order. The British Columbia Court of Appeal, influenced by the Equustek case from the Supreme  Court of Canada, concluded that a court has jurisdiction to issue a production order naming an entity physically beyond the court’s jurisdiction provided they had a “virtual presence” within the jurisdiction.

The Court concluded:

[49]     I find that the jurisprudence in the context of production orders issued pursuant to section 487.014 of the Criminal Code provides a good analogy and support for finding that this Court has the jurisdiction to issue an Assistance Order where in personam jurisdiction can be established. The two provisions are similar in purpose, albeit in different contexts, both are directed to a person, which includes an organization or entity that is a legal person, and similar considerations arise in determining whether the order should be issued where the subject has only a virtual presence in Canada.

[50]     The considerations noted by the SCC in Equustek lend further support to taking an approach that reflects the realities of the internet dominated storage and transmission of documents and information. As noted in Brecknell, document control may exist in one jurisdiction, and the documents in another or in several others and “formalistic distinctions” between virtual and physical presence defeat the purpose of the legislation.

[51]     Whether an organization or entity with only a virtual presence in Canada can establish a real and substantial connection with Canada sufficient to constitute presence in Canada will be a case-by-case determination. Where such in personam jurisdiction is established, the organization or entity that is subject to the Assistance Order and required to provide documents in their possession or control is considered to be in Canada although the documents may be stored elsewhere.

As with a number of the cases following Brecknell, the Court concluded that its ability to issue the order does not turn on whether it would be able to enforce the order, though that is a relevant consideration:

[53]      I have considered the issue of enforcement of the Assistance Order on [REDACTED]. I note that they have been cooperative to date and indicate their ongoing intention to cooperate. However, I also agree with the submissions of the AGC and amicus and the jurisprudence, that the enforcement of the Order is a separate issue from whether the Court has jurisdiction to issue the Order, but remains a relevant consideration with respect to whether the Order should be issued based on the particular circumstances.

Consistent with the previous production order cases cited, the intended recipient was not a party to the hearing. All were ex parte, but some included amici.

Note: I believe that Brecknell was wrongly-decided, but because all of these orders have not been ex parte and unopposed, it'll be some time before these arguments will be made in court.   See: David T Fraser, "British Columbia (Attorney General) v. Brecknell", Case Comment, (2020) 18:1 CJLT 135.

What a CLOUD Act agreement will look like for Canada

The United States Department of Justice and the United Kingdom Home Office have announced that the two countries have signed a bilateral agreement “On Access to Electronic Data for the Purpose of Countering Serious Crime”. The Agreement is intended to be a bilateral agreement of the type anticipated under the CLOUD Act. Passed in March 2018, partially to address the litigation against Microsoft related to evidence in Ireland, the CLOUD Act authorizes the United States to enter into executive agreements with other countries that meet specific criteria related to rule of law, civil rights and privacy. Once laid before Congress and approved, the result is to lift each party’s legal barriers that prevent one country’s legal processes from being recognized in the other. Many countries have been seeking an alternative to the traditional channels of mutual legal assistance, which are seen as time consuming and cumbersome.

When it comes to orders directed at US custodians of information, the main barrier to be overcome is the American Stored Communications Act that prohibits most US service providers from providing the content of communications except in response to a US court order. These can be obtained via the mutual legal assistance system, but all the steps required to obtain these orders are seen by law enforcement and cumbersome and time consuming. Under a CLOUD Act executive agreement, US service providers will no longer be prohibited from providing such content in response to an appropriate foreign order. It is very important to note that the CLOUD Act does not make foreign orders enforceable (with full force of a domestic court order) in the United States, but merely removes this barrier.

On the UK side of the equation, changes were made in UK law to permit this under the Crime (Overseas Production Orders) Act 2019, which received Royal Assent in February 2019. The Agreement will enter into force following a six-month Congressional review period mandated by the CLOUD Act, and the related review by UK’s Parliament.

Australia has already announced that it is seeking its own CLOUD Act executive agreement, and Canada is rumoured to be in similar discussions.

The Canadian Association of Chiefs of Police have been lobbying pretty hard for an executive agreement between Canada and the US, and called for it in their 2018 Annual Resolutions:

BE IT FURTHER RESOLVED that the Canadian Association of Chiefs of Police urges the Government of Canada to negotiate a bilateral data-sharing agreement with the United States of America who are authorized to do so pursuant to the CLOUD Act, and;

BE IT FURTHER RESOLVED that the Canadian Association of Chiefs of Police seeks a commitment from the Government of Canada for meaningful consultation with the CACP during the development of these instruments.

So what would this look like for Canada? The CLOUD Act and executive agreements are based on reciprocity, meaning that not only can Canadian law enforcement obtain information from US-based service providers, but American law enforcement can obtain information from Canadian-based information custodians. Currently, that’s mostly a no-go except through the MLAT.

In order for Canada to sign an executive agreement and give it effect, it would have to amend the Criminal Code and other statutes to give Canadian production orders extraterritorial effect or to create a new class of production orders, in a manner that is similar to the UK Crime (Overseas Production Orders) Act 2019. Notwithstanding the wishful thinking of many in Canada’s law enforcement community (relying, in part, on the wrongly-decided Brecknell decision from BC), Canadian production orders to not operate extraterritorially.

Removing Canadian legal barriers to foreign court orders that are subject to the bilateral executive agreement will likely be the most controversial part of the process. Canadians likely do not mind if Canadian law enforcement are able to obtain data about Canadian suspects in Canadian criminal investigations from foreign service providers. They likely will care about whether US law enforcement can obtain access to information from Canadian service providers.

Currently, all Canadian privacy laws prevent disclosure to foreign law enforcement under foreign orders. That includes private sector privacy laws, like the federal Personal Information Protection and Electronic Documents Act and provincial equivalents. The list would also include the health privacy laws in effect in most Canadian provinces, and each public sector privacy law. Currently, the public sector laws in British Columbia and Nova Scotia specifically prohibit disclosures in response to “foreign demands for disclosure”. This will either have to be removed or Canada will need to negotiate an exception in its executive agreement with the US to carve out information that is subject to public sector privacy laws.

What will likely be lost in the discussion and debate is the fact that CLOUD Act agreements are not intended to simply give effect to all orders from the other state. They are intended to create a form of passing lane in the MLAT for certain kinds of orders where the requesting state has a strong interest in the data and the receiving state has a minimal interest. For example, Canadian authorities can’t use a qualifying order to get information about a US suspect from a US service provider. Those would still have to go through the MLAT, subject to close scrutiny by American authorities. Likewise, US authorities should not be able to obtain information about Canadians from a Canadian service provider under this arrangement.

What also needs to be emphasised is that any Canadian amendments should not go any further than mirroring the changes made in the US law. The CLOUD Act does not make foreign orders enforceable (with full force of a domestic court order) in the United States, but merely removes certain barriers. Canadian amendments should do the same and make sure that a Canadian service provider has resort to Canadian courts and the Charter to review any foreign demands. And these orders should be limited to serious crimes.

I expect it will be an interesting discussion when it is finally announced. I would hope there is meaningful discussion, rather than just unveiling it as a fait accompli.

Presentation: What’s new in cross-border digital evidence gathering for criminal investigations?

I was invited to present at the High Technology Crime Investigation Association's first annual Canadian Cyber Summit.

I spoke about recent issues and trends in cross-border criminal investigations originating in Canada, starting with the current state of affairs and the Mutual Legal Assistance Treaty regime, issues caused by blocking statutes and what the CLOUD Act will mean for Canadian investigators.

In case it's of broader interest, here's the presentation:

Ontario court refuses to order accused to unlock his smartphone

Not sure how I missed this one when it came out in January ...

The Ontario Court of Justice has refused to order an accused to unlock his smartphone or to provide the crown with the password for the device. In R v Shergill, 2019 ONCJ 54, the Crown made an application for a search warrant for a phone seized from the accused. The interesting part is that the Crown also sought an assistance order under s. 487.02 of the Criminal Code. Notably, the application was not made ex parte so the accused was able to make submissions.

The Crown argued that the accused's Charter rights were not engaged.

[3] The Crown says that basic principles of statutory interpretation allow for an accused to be the subject of an assistance order in relation to his or her own investigation. The Crown further submits that this request for an assistance order does not raise Charter concerns, but is instead a matter of mere practicality. The Crown’s factum focusses entirely on the principle against self-incrimination, submitting that the proposed assistance order does not engage that principle because it only compels Mr. Shergill to provide access to, and not create, material the police are judicially authorized to examine, and because any self-incrimination concerns are met by the grant of use immunity over Mr. Shergill’s knowledge of the password.

The Court decided in favour of the accused, finding that this order would engage the accused's right to silence and the protection against self-incrimination. The Court wrote:

(e) The Right to Silence

[21] In my view, the more significant principle of fundamental justice at stake is the right to silence. This right emerged as a component of the protection against self-incrimination in R. v. Hebert in which McLachlin J. (as she then was), held:

If the Charter guarantees against self-incrimination at trial are to be given their full effect, an effective right of choice as to whether to make a statement must exist at the pre-trial stage… the right to silence of a detained person under s. 7 of the Charter must be broad enough to accord to the detained person a free choice on the matter of whether to speak to the authorities or to remain silent.

McLachlin J. also reaffirmed the Court’s prior holding that the right to silence was “a well-settled principle that has for generations been part of the basic tenets of our law.”

[22] The “common theme” underlying the right to silence is “the idea that a person in the power of the state in the course of the criminal process has the right to choose whether to speak to the police or remain silent.” In tracing the history of the right, McLachlin J. referred to an “array of distinguished Canadian jurists who recognized the importance of the suspect’s freedom to choose whether to give a statement to the police or not” and described the essence of the right to silence as the “notion that the person whose freedom is placed in question by the judicial process must be given the choice of whether to speak to the authorities or not.”[21] Finally, Hebert held that s. 7 provides “a positive right to make a free choice as to whether to remain silent or speak to the authorities.”

[23] The pre-trial right to silence is a concept which, as Iacobucci held in R.J.S., has been “elevated to the status of a constitutional right.”[footnotes omitted]

The Court then discussed some of the challenges that law enforcement are facing in light of new technology and encryption in particular. Though there is always a compelling public interest in the investigation and prosecution of crimes, the final balancing came down on the side of the accused's liberty interests under s. 7 of the Charter.

[51] I accept that the current digital landscape as it relates to effective law enforcement and the protection of privacy presents many challenges. It may be that a different approach to this issue is warranted, whether through legislative initiatives or modifications to what I see as jurisprudence which is binding on me. But on my best application of controlling authority, I am simply not persuaded that the order sought can issue without fundamentally breaching Mr. Shergill’s s. 7 liberty interests, a breach which would not be in accordance with the principle of fundamental justice which says that he has the right to remain silent in the investigative context.

The search warrant was issued, but the assistance order was denied.

Supreme Court of Canada lays down a very nuanced, contextual understanding of "expectation of privacy"

Today the Supreme Court of Canada issued a very important privacy decision in R v Jarvis. I say it’s important for a number of reasons. First, it’s an important decision that strongly defines expectation of privacy for the Canadian Criminal Code offence of voyeurism. Second, I expect it will have serious knock-on effects on considering privacy in the regulatory and common-law contexts. Finally, it will inform other instances in our Criminal Code where an expectation of privacy is relevant. The decision has a very highly nuanced and contextual test for determining where there is a reasonable expectation of privacy.

The case is largely about a teacher in a high school who used a covert, miniature camera to take videos of young women’s cleavage over more than a year. It was discovered and he was charged under the relatively new voyeurism offence in the Code. Two essential elements of the offence are that there have to be circumstances that give rise to a reasonable expectation of privacy and the recording has to be done for a sexual purpose.* In R v Jarvis, the recording took place in otherwise “public areas” of the school, so not in washrooms or changing rooms. It also has to be "surreptitious", but the observation itself was not surreptitious. What was being recorded was largely observed in real-time by the teacher. The recording was surreptitious.

The trial judge found that there was a reasonable expectation of privacy but the crown had not proven the sexual purpose beyond a reasonable doubt. It’s hard to get one’s head around that, as the teacher had many, many recordings spanning more than a year of students’ cleavage and chest areas. I’m not sure what other purpose he could have had.

The crown appealed to the Ontario Court of Appeal, which had little difficulty concluding that there was a sexual purpose but split on the reasonable expectation of privacy in a "public place" where the young women could generally be observed by teachers and other students.

On appeal to the Supreme Court of Canada, the Court found the accused to be guilty of the offence and provided a very nuanced and contextual framework for determining where and when there is a reasonable expectation of privacy. What is particularly notable for technology lawyers is the role that the covert recording device plays in this analysis. It is not simply a matter that what was recorded could have been observed with one’s bare eyes. The tech plays a role in a couple of ways. Recording is more intrusive than mere observation and awareness of (or the lack of awareness) the observation also plays an important role.

The Court provided a non-exhaustive list of nine factors that courts should consider in deciding the question:

[29] The following non-exhaustive list of considerations may assist a court in determining whether a person who was observed or recorded was in circumstances that give rise to a reasonable expectation of privacy:

(1) The location the person was in when she was observed or recorded. The fact that the location was one from which the person had sought to exclude all others, in which she felt confident that she was not being observed, or in which she expected to be observed only by a select group of people may inform whether there was a reasonable expectation of privacy in a particular case.

(2) The nature of the impugned conduct, that is, whether it consisted of observation or recording. Given that recording is more intrusive on privacy than mere observation, a person’s expectation regarding whether she will be observed may reasonably be different than her expectation regarding whether she will be recorded in any particular situation. The heightened impact of recording on privacy has been recognized by this Court in other contexts, as will be discussed further at para. 62 of these reasons.

(3) Awareness of or consent to potential observation or recording. I will discuss further how awareness of observation or recording may inform the reasonable expectation of privacy inquiry at para. 33 of these reasons.

(4) The manner in which the observation or recording was done. Relevant considerations may include whether the observation or recording was fleeting or sustained, whether it was aided or enhanced by technology and, if so, what type of technology was used. The potential impact of evolving technologies on privacy has been recognized by the courts, as I will discuss further at para. 63 of these reasons.

(5) The subject matter or content of the observation or recording. Relevant considerations may include whether the observation or recording targeted a specific person or persons, what activity the person who was observed or recorded was engaged in at the relevant time, and whether the focus of the observation or recording was on intimate parts of a person’s body. This Court has recognized, in other contexts, that the nature and quality of the information at issue are relevant to assessing reasonable expectations of privacy in that information. As I will discuss further at paras. 65-67 of these reasons, this principle is relevant in the present context as well.

(6) Any rules, regulations or policies that governed the observation or recording in question. However, formal rules, regulations or policies will not necessarily be determinative, and the weight they are to be accorded will vary with the context.

(7) The relationship between the person who was observed or recorded and the person who did the observing or recording. Relevant considerations may include whether the relationship was one of trust or authority and whether the observation or recording constituted a breach or abuse of the trust or authority that characterized the relationship. This circumstance is relevant because it would be reasonable for a person to expect that another person who is in a position of trust or authority toward her will not abuse this position by engaging in unconsented, unauthorized, unwanted or otherwise inappropriate observation or recording.

(8) The purpose for which the observation or recording was done. I will explain why this may be a relevant consideration at paras. 31-32 of these reasons.

(9) The personal attributes of the person who was observed or recorded. Considerations such as whether the person was a child or a young person may be relevant in some contexts.

[30] I emphasize that the list of considerations that can reasonably inform the inquiry into whether a person who was observed or recorded had a reasonable expectation of privacy is not exhaustive. Nor will every consideration listed above be relevant in every case. For example, recordings made using a camera hidden inside a washroom will breach reasonable expectations of privacy regardless of the purpose for which they are made, the age of the person recorded, or the relationship between the person recorded and the person who did the recording. In another context, however, these latter considerations may play a more significant role. The inquiry is a contextual one, and the question in each case is whether there was a reasonable expectation of privacy in the totality of the circumstances.

While anyone could have observed these young women in a relatively public place, what made it particularly problematic was the person who did the observing, in their position of power as a teacher, the victim of the offence, what was focused on and the manner of the observing. Not all of the factors weigh strongly in favour of a finding reasonable expectation of privacy in this case, but the vast majority of them do.

So what does this mean? I expect that we'll be able to see more charges and convictions for similar practices, including "upskirting". We'll also have to see a more nuanced discussion about what is an expectation of privacy in generally public places and I'm confident this will inform judicial decision-making in the context of the privacy torts, which largely hinge on reasonable expectations of privacy, and what it unreasonable. We'll also have to think hard about what role technology plays in privacy, particularly where CCTV cameras are said to be largely equivalent to real-time supervision by managers.

One aspect that I haven't really turned my mind to at this point is the impact of this analysis on expectations of privacy vis-a-vis the state, where section 8 of the Charter is concerned.

---

* There are other permutations that can give rise to the offence, which do require an expectation of privacy and are largely place-based:

Voyeurism

162 (1) Every one commits an offence who, surreptitiously, observes — including by mechanical or electronic means — or makes a visual recording of a person who is in circumstances that give rise to a reasonable expectation of privacy, if

(a) the person is in a place in which a person can reasonably be expected to be nude, to expose his or her genital organs or anal region or her breasts, or to be engaged in explicit sexual activity;

(b) the person is nude, is exposing his or her genital organs or anal region or her breasts, or is engaged in explicit sexual activity, and the observation or recording is done for the purpose of observing or recording a person in such a state or engaged in such an activity; or

(c) the observation or recording is done for a sexual purpose.

At least in a school, subsections (a) and (b) would generally be found in washrooms and change rooms.

Canadian Appeal Court decides “Virtual Presence” is enough for production order for user information against non-Canadian company

The British Columbia Court of Appeal has whipped the door open for the greater use of production orders requiring non-Canadian companies to provide user information. Here's the summary I prepared for my firm (also available here):

The Legal Reality: Canadian Appeal Court decides “Virtual Presence” is enough for production order for user information against non-Canadian company in British Columbia (Attorney General) v. Brecknell

January 12, 2018

By David Fraser, at McInnes Cooper

Whether a provincial court will grant police a “production order” under the Criminal Code of Canada requiring a non-Canadian company to produce any of its records has, to date, depended on the province in which police seek it. Some courts refuse an order where the company is wholly outside of Canada; some require an address in Canada for service to grant the order; and others grant the order, apparently unconcerned about the company’s Canadian “presence”. That could however change with the B.C. Court of Appeal’s January 9, 2018, decision in British Columbia (Attorney General) v. Brecknell. The Court’s decision that Craigslist is “present” in B.C. and can be subject to a Criminal Code production order issued from its provincial court might lead to greater national uniformity – and more exposure to foreign companies doing only virtual business in Canada:

The Legal Trend. The decision lines up with the Supreme Court of Canada’s increasing awareness of the Internet’s inherently global nature, willingness to take jurisdiction in cases that cross borders, and readiness to apply existing legal principles to online business – all as illustrated in the Court’s June 2017 decisions in Google Inc. v. Equustek Solutions Inc. and Douez v. Facebook, Inc. There’s every reason to believe this trend is here to stay – and foreign companies doing business in Canada, even if only virtually, should be prepared for the increased legal exposure it entails.

Broader Implications. The Court’s conclusion that the distinction between a virtual-only presence and a “physical” presence is effectively a distinction without a difference could carry implications far beyond the availability of production orders. Whether its reasoning vis-a-vis an internet-based company’s “presence” in Canada will have application to, for example, tax laws, remains to be seen.

More Production Orders & More Content. Non-Canadian companies will likely see more production orders from Canadian courts. Canadian courts will more willingly assume jurisdiction over companies where the only contacts with Canada are virtual (i.e. over the internet), and more readily available to police to obtain production orders against such companies – no matter where they are “physically” present. And this route is much preferred by police compared to proceeding under mutual legal assistance procedures. In addition to more Canadian production orders against internet companies, more of those orders will likely be for “content”, not just identifying information and metadata. And this decision will likely lead Canadian police to conclude that compliance is no longer a question of voluntariness: many internet companies “voluntarily” comply with Canadian orders for non-content data but require Mutual Legal Assistance Treaties (MLAT) processes for content such as email and other communications.

In 2016, the Royal Canadian Mounted Police (R.C.M.P.) applied to the B.C. Provincial Court for a production order requiring Craigslist to produce certain information about one of its users. In particular, R.C.M.P. sought the user’s name or physical address, its email address, the IP address assigned to the user when the post was created, the phone numbers used to verify the user account, the dates and times the post was created post and the record of the posting. The court refused on the basis Craigslist had only a “virtual presence in B.C.” The R.C.M.P. appealed and on January 9, 2018, the B.C. Court of Appeal agreed: Craigslist is “present” in the province of B.C. and police can obtain a production order naming it, even though it has no “physical” presence in Canada or an address in Canada to effect service:

Virtual Presence = Physical Presence. Under Canadian law, a Canadian court has jurisdiction where there is a “real and substantial connection” between Canada (or a Canadian province) and the activity in issue. There’s no “bright line” rule, but courts have consistently decided that actively doing business over the internet with residents of a particular Canadian province is enough to create that connection. This in turn gives the court jurisdiction over the specific subject matter and parties (a.k.a “in personam” jurisdiction), a proposition about which the Supreme Court of Canada most recently pronounced in its June 2017 decision in Google v. Equustek Solutions Inc. Here, the Court of Appeal interpreted the Criminal Code provisions as limiting courts’ ability to issue a production order “…only against a person in Canada”, making the question whether Craigslist – a U.S. company with no physical presence in Canada – is “a person in Canada” for this purpose. The Court concluded the distinction between a virtual-only presence and a “physical” presence is effectively a distinction without a difference (at para. 40):

“… [I]n the Internet era it is formalistic and artificial to draw a distinction between physical and virtual presence. Corporate persons … can exist in more than one place at the same time. … I do not think anything turns on whether the corporate person in the jurisdiction has a physical or only a virtual presence. To draw on and rely on such a distinction would defeat the purpose of the legislation and ignore the realities of modern day electronic commerce…”

The Test is Canadian Presence – not Canadian Possession. The Court was clear that the test for a production order is only the presence of the recipient – and not the information sought to be produced – in Canada. Once the Court of Appeal concluded Craigslist was “a person in Canada”, the test was met (at para. 39):

“In the first instance, the [Criminal Code] section, properly interpreted, stipulates only that the person subject to the order must be a person in the jurisdiction. In my view, Craigslist is such a person. Second, the person must be a person who has possession or control of a document. The section says nothing expressly about where that possession or control exists. Indeed, it may not even be sensible to pose the question in terms of the location of control. A person either does or does not have possession of a document. The question is one of control, not where the control is exercised. In this case, Craigslist has possession or control of the relevant records and the provision requires nothing further. In other words, there is nothing in the section that requires the person in the jurisdiction to be a custodian of the documents in the jurisdiction. In my view, it is sufficient that the person is present within the jurisdiction. I do not think that there is anything extraterritorial in such an interpretation. To conclude that Craigslist is a person within the jurisdiction who has possession or control of documents does not give the section an impermissibly extraterritorial interpretation.”

No Other Barriers. The Court of Appeal rejected the argument that a production order against a foreign company effectively intrudes into another country’s sovereignty, essentially deputizing a non-Canadian company to carry out a search in a foreign country that Canadian police could never carry out themselves. The Court concluded the weight of U.S. legal authority doesn’t treat subpoenas in this manner, noting it appears instead to recognize the U.S. validity of subpoenas directed to persons in the U.S. over whom there is personal jurisdiction to disclose documents in the U.S. even where they must be obtained from outside the U.S. The Court also considered – and rejected – the arguments that enforcement difficulties or the existence of Mutual Legal Assistance Treaties (MLAT) militate against the use of production orders in cases like this.

Ontario Court of Appeal confirms online harassment conviction where threatening website was “about” the complainant but not a threat directed "to" the complainant

At a time when the courts and the rest of the justice system are grappling with how traditional Criminal Code offences and online misconduct intersect, the Ontario Court of Appeal has issued an important decision in R v. Sim on how criminal harassment can take place online. Often, police and others are stuck in an analog paradigm of traditional stalking and menacing.

In this case, the accused created an incredibly offensive website that was not directed at the complainant but was about her, and directed to a select audience that appears to have been intended to exclude her.

The accused used to work in the same building as the complainant lived. They became friends and when the accused showed a romantic interest in the complainant, the complainant made it clear that the feelings were not reciprocated. They went their separate ways, each married other people and started families. They communicated by email from time to time, apparently just to catch up on what the other was doing.

In the meantime, the accused created a Yahoo! Groups website that, according to a statement on the homepage, was dedicated to “the degradation and online spreading” of the complainant. He recruited at least 150 others to join the site. According to the Court:

[9] Sim posted extensive biographical details and photos of the complainant on the website. He authored false, degrading, vile, and grotesque sexualized commentary about her on the website’s messaging forum. He encouraged group members to post their own vile comments about the complainant, to author and share crude sexual fantasies involving her, and to alter photographs of her in a sexually degrading way and share those as well. …

The complainant became aware of the site in 2013 and, with the help of a friend, she created a username and password to get full access to the site.

The accused was charged with criminal harassment and publishing a defamatory libel. He was convicted of harassment and acquitted of defamatory libel. The accused appealed his conviction to the Ontario Court of Appeal, arguing that the necessary actus rea of harassment had been made out.

The accused had been convicted under paragraph 2(d) of section 264 of the Criminal Code:

(1) Criminal harassment – No person shall, without lawful authority and knowing that another person is harassed or recklessly as to whether the other person is harassed, engage in conduct referred to in subsection (2) that causes that other person reasonably, in all the circumstances, to fear for their safety or the safety of anyone known to them.

(2) Prohibited conduct – The conduct mentioned in subsection (1) consists of …

(d) engaging in threatening conduct directed at the other person or any member of their family.

The trial judge acknowledged that if “threatening conduct” required a subjective intention to threaten the complainant, the accused should be acquitted for lack of evidence. But the judge decided that there was no such requirement; rather the question is whether the conduct is objectively threatening.

In 2008, the Ontario Court of Appeal in R. v. Burns determined that an objective standard was required for the actus rea of criminal harassment under paragraph 2(d):

To establish harassment under s. 264(2)(d) of the Criminal Code, the Crown had to establish that the appellant engaged in “threatening conduct”. We accept the definition of threatening conduct given in R. v. George at para. 39 that, in order to meet the objectives of s. 264, the threatening conduct must amount to a “tool of intimidation which is designed to instill a sense of fear in the recipient”. The impugned conduct is to be viewed objectively, with due consideration for the circumstances in which they took place, and with regards to the effects those acts had on the recipient. [Citation omitted.]

With regard to the accused’s specific arguments, Laskin JA, on behalf of a unanimous Court, wrote:

[18] First, Sim’s submission is inconsistent with s. 264(1) of the Code and thus is contrary to Parliament’s express intent. Subsection 264(1) specifies that the mens rea component of criminal harassment can be met by an accused’s knowledge or recklessness. To suggest that the actus reus of threatening conduct requires a specific intent to instil fear is contrary to the plain language of s. 264(1).

[19] Second, as this court said in Burns, under s. 264(2)(d) the conduct in question must be viewed objectively. In other words, would the accused’s threatening conduct cause a reasonable person in the complainant’s situation to fear for her safety? The word “designed” does not require the Crown to prove the accused’s subjective intention. And, in assessing whether an accused’s conduct is threatening under s. 264(2)(d), a judge is not required to get into the accused’s mind.

[20] Instead, the word “designed” is meant to focus on the effect of the accused’s conduct on a reasonable person in the shoes of the target of the conduct. In Burns, this court clarified that the objective assessment must consider the circumstances in which the conduct took place, and the effects that the conduct actually had on the complainant. Although an accused's threatening conduct may not affect every target of that conduct, in every conceivable situation, it could well instill fear in a reasonable person in the complainant’s specific situation, particularly when the actual effects of the conduct on the complaint are considered. That is the case here. The trial judge did not err in finding that the Crown had established the actus reus of the offence.

While the site at issue was clearly about the complainant, there was no evidence that it was directed at the complainant in order to threaten her. This decision will hopefully reinforce the notion that the criminal harassment offence may be made out in cases where the accused creates “threatening” content about the victim, rather than directed to the victim.

[An earlier version of this case summary was written for the Canadian Technology Law Association’s newsletter.]

Cyberbullying and lawful access Bill C-13 in the home stretch

The Protecting Canadians from Online Crime Act, also known as the controversial cyberbullying and lawful access ("law adjacent" access?) bill is in the home stretch, about to be passed by the House of Commons. From the CBC: Cyberbullying bill inches closer to law despite privacy concerns - Politics - CBC News.

I have had a lot to say about it, so for background, please check out the Bill C-13 Tag.

R v Spencer: Supreme Court rules internet users have a reasonable expectation of privacy and anonymity online

[Note: this post is a work in progress, and will be updated as I digest the decision.]

This morning, the Supreme Court of Canada released its decision in R v Spencer, 2014 SCC 43.

The case, on appeal from the Saskatchewan Court of Appeal, has finally provided some certainty regarding the expectation of privacy that all Canadians enjoy in their online activities. All internet users expose their IP addresses to the sites they visit and the computers they connect to, but generally it is only the internet service provider who can connect that innocuous string of digits to a real identity.

In this case, the police had obtained information about an internet user from his internet service provider without a warrant. The police asked for it using a "PIPEDA request" and the ISP simply provided it, relying on a broad provision in PIPEDA which -- in its view -- permits certain disclosures to law enforcement.

I am still digesting the decision, but some very important conclusions from the case:

• Internet users have a reasonable expectation of anonymity in their online activities
  

  Contrary to the views of most police agencies and the government of Canada, this information is not innocuous "phone book information" but "Rather, it was the identity of an Internet subscriber which corresponded to particular Internet usage."
  

• A police request to the ISP for customer information amounts to a "search" for Charter purposes
  
• The fact that an ISP may be able to disclose information pursuant to s. 7(3)(c.1) of PIPEDA or the terms of use is relevant to the expectation of privacy, but not determinative of it
  
• The request by the police had no "lawful authority" since they had no authority to compel the production of the information
  

There has been much controversy surrounding the term "lawful authority" in PIPEDA, which permits an organization to disclose personal information without consent in connection with an investigation where the police have identified their "lawful authority" to obtain the information. The police have generally argued that an investigation is sufficient to satisfy that. The Court disagreed:

[62] Section 7(3)(c.1)(ii) allows for disclosure without consent to a government institution where that institution has identified its lawful authority to obtain the information. But the issue is whether there was such lawful authority which in turn depends in part on whether there was a reasonable expectation of privacy with respect to the subscriber information. PIPEDA thus cannot be used as a factor to weigh against the existence of a reasonable expectation of privacy since the proper interpretation of the relevant provision itself depends on whether such a reasonable expectation of privacy exists. Given that the purpose of PIPEDA is to establish rules governing, among other things, disclosure “of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information” (s. 3), it would be reasonable for an Internet user to expect that a simple request by police would not trigger an obligation to disclose personal information or defeat PIPEDA’s general prohibition on the disclosure of personal information without consent.

[63] I am aware that I have reached a different result from that reached in similar circumstances by the Ontario Court of Appeal in Ward, where the court held that the provisions of PIPEDA were a factor which weighed against finding a reasonable expectation of privacy in subscriber information. This conclusion was based on two main considerations. The first was that an ISP has a legitimate interest in assisting in law enforcement relating to crimes committed using its services: para. 99. The second was the grave nature of child pornography offences, which made it reasonable to expect that an ISP would cooperate with a police investigation: paras. 102-3. While these considerations are certainly relevant from a policy perspective, they cannot override the clear statutory language of s. 7(3)(c.1)(ii) of PIPEDA, which permits disclosure only if a request is made by a government institution with “lawful authority” to request the disclosure. It is reasonable to expect that an organization bound by PIPEDA will respect its statutory obligations with respect to personal information. The Court of Appeal in Ward held that s. 7(3)(c.1)(ii) must be read in light of s. 5(3), which states that “[a]n organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances”. This rule of “reasonable disclosure” was used as a basis to invoke considerations such as allowing ISPs to cooperate with the police and preventing serious crimes in the interpretation of PIPEDA. Section 5(3) is a guiding principle that underpins the interpretation of the various provisions of PIPEDA. It does not allow for a departure from the clear requirement that a requesting government institution possess “lawful authority” and so does not resolve the essential circularity of using s. 7(3)(c.1)(ii) as a factor in determining whether a reasonable expectation of privacy exists.

[64] I also note with respect to an ISP’s legitimate interest in preventing crimes committed through its services that entirely different considerations may apply where an ISP itself detects illegal activity and of its own motion wishes to report this activity to the police. Such a situation falls under a separate, broader exemption in PIPEDA, namely s. 7(3)(d). The investigation in this case was begun as a police investigation and the disclosure of the subscriber information arose out of the request letter sent by the police to Shaw.

[65] The overall impression created by these terms is that disclosure at the request of the police would be made only where required or permitted by law. Such disclosure is only permitted by PIPEDA in accordance with the exception in s. 7, which in this case would require the requesting police to have “lawful authority” to request the disclosure. For reasons that I will set out in the next section, this request had no lawful authority in the sense that while the police could ask, they had no authority to compel compliance with that request. I conclude that, if anything, the contractual provisions in this case support the existence of a reasonable expectation of privacy, since the Privacy Policy narrowly circumscribes Shaw’s right to disclose the personal information of subscribers.

[66] In my view, in the totality of the circumstances of this case, there is a reasonable expectation of privacy in the subscriber information. The disclosure of this information will often amount to the identification of a user with intimate or sensitive activities being carried out online, usually on the understanding that these activities would be anonymous. A request by a police officer that an ISP voluntarily disclose such information amounts to a search.

Here is the headnote summary of the decision:

Constitutional law — Charter of Rights — Search and seizure — Privacy — Police having information that IP address used to access or download child pornography — Police asking Internet service provider to voluntarily provide name and address of subscriber assigned to IP address — Police using information to obtain search warrant for accused’s residence — Whether police conducted unconstitutional search by obtaining subscriber information matching IP address — Whether evidence obtained as a result should be excluded — Whether fault element of making child pornography available requires proof of positive facilitation — Criminal Code, R.S.C. 1985, c. C‑46, ss. 163.1(3), 163.1(4), 487.014(1) — Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, s. 7(3)(c.1)(ii) — Charter of Rights and Freedoms, s. 8.

The police identified the Internet Protocol (IP) address of a computer that someone had been using to access and store child pornography through an Internet file sharing program. They then obtained from the Internet Service Provider (ISP), without prior judicial authorization, the subscriber information associated with that IP address. The request was purportedly made pursuant to s. 7(3)(c.1)(ii) of the Personal Information Protection and Electronic Documents Act (PIPEDA). This led them to the accused. He had downloaded child pornography into a folder that was accessible to other Internet users using the same file sharing program. He was charged and convicted at trial of possession of child pornography and acquitted on a charge of making it available. The Court of Appeal upheld the conviction, however set aside the acquittal on the making available charge and ordered a new trial.

Held: The appeal should be dismissed.

Whether there is a reasonable expectation of privacy in the totality of the circumstances is assessed by considering and weighing a large number of interrelated factors. The main dispute in this case turns on the subject matter of the search and whether the accused’s subjective expectation of privacy was reasonable. The two circumstances relevant to determining the reasonableness of his expectation of privacy in this case are the nature of the privacy interest at stake and the statutory and contractual framework governing the ISP’s disclosure of subscriber information.

When defining the subject matter of a search, courts have looked not only at the nature of the precise information sought, but also at the nature of the information that it reveals. In this case, the subject matter of the search was not simply a name and address of someone in a contractual relationship with the ISP. Rather, it was the identity of an Internet subscriber which corresponded to particular Internet usage.

The nature of the privacy interest engaged by the state conduct turns on the privacy of the area or the thing being searched and the impact of the search on its target, not the legal or illegal nature of the items sought. In this case, the primary concern is with informational privacy. Informational privacy is often equated with secrecy or confidentiality, and also includes the related but wider notion of control over, access to and use of information. However, particularly important in the context of Internet usage is the understanding of privacy as anonymity. The identity of a person linked to their use of the Internet must be recognized as giving rise to a privacy interest beyond that inherent in the person’s name, address and telephone number found in the subscriber information. Subscriber information, by tending to link particular kinds of information to identifiable individuals may implicate privacy interests relating to an individual’s identity as the source, possessor or user of that information. Some degree of anonymity is a feature of much Internet activity and depending on the totality of the circumstances, anonymity may be the foundation of a privacy interest that engages constitutional protection against unreasonable search and seizure. In this case, the police request to link a given IP address to subscriber information was in effect a request to link a specific person to specific online activities. This sort of request engages the anonymity aspect of the informational privacy interest by attempting to link the suspect with anonymously undertaken online activities, activities which have been recognized in other circumstances as engaging significant privacy interests.

There is no doubt that the contractual and statutory framework may be relevant to, but not necessarily determinative of whether there is a reasonable expectation of privacy. In this case, the contractual and regulatory frameworks overlap and the relevant provisions provide little assistance in evaluating the reasonableness of the accused’s expectation of privacy. Section 7(3)(c.1)(ii) of PIPEDA cannot be used as a factor to weigh against the existence of a reasonable expectation of privacy since the proper interpretation of the relevant provision itself depends on whether such a reasonable expectation of privacy exists. It would be reasonable for an Internet user to expect that a simple request by police would not trigger an obligation to disclose personal information or defeat PIPEDA’s general prohibition on the disclosure of personal information without consent. The contractual provisions in this case support the existence of a reasonable expectation of privacy. The request by the police had no lawful authority in the sense that while the police could ask, they had no authority to compel compliance with that request. In the totality of the circumstances of this case, there is a reasonable expectation of privacy in the subscriber information. Therefore, the request by the police that the ISP voluntarily disclose such information amounts to a search.

Whether the search in this case was lawful will be dependent on whether the search was authorized by law. Neither s. 487.014(1) of the Criminal Code, nor PIPEDA creates any police search and seizure powers. Section 487.014(1) is a declaratory provision that confirms the existing common law powers of police officers to make enquiries. PIPEDA is a statute whose purpose is to increase the protection of personal information. Since in the circumstances of this case the police do not have the power to conduct a search for subscriber information in the absence of exigent circumstances or a reasonable law, the police do not gain a new search power through the combination of a declaratory provision and a provision enacted to promote the protection of personal information. The conduct of the search in this case therefore violated the Charter. Without the subscriber information obtained by the police, the warrant could not have been obtained. It follows that if that information is excluded from consideration as it must be because it was unconstitutionally obtained, there were not adequate grounds to sustain the issuance of the warrant and the search of the residence was therefore unlawful and violated the Charter.

The police, however, were acting by what they reasonably thought were lawful means to pursue an important law enforcement purpose. The nature of the police conduct in this case would not tend to bring the administration of justice into disrepute. While the impact of the Charter‑infringing conduct on the Charter protected interests of the accused weighs in favour of excluding the evidence, the offences here are serious. Society has a strong interest in the adjudication of the case and also in ensuring the justice system remains above reproach in its treatment of those charged with these serious offences. Balancing the three factors, the exclusion of the evidence rather than its admission would bring the administration of justice into disrepute. The admission of the evidence is therefore upheld.

There is no dispute that the accused in a prosecution under s. 163.1(3) of the Criminal Code must be proved to have had knowledge that the pornographic material was being made available. This does not require however, that the accused must knowingly, by some positive act, facilitate the availability of the material. The offence is complete once the accused knowingly makes pornography available to others. Given that wilful blindness was a live issue and that the trial judge’s error in holding that a positive act was required to meet the mens rea component of the making available offence resulted in his not considering the wilful blindness issue, the error could reasonably be thought to have had a bearing on the trial judge’s decision to acquit. The order for a new trial is affirmed.

For some background on "PIPEDA requests", check out the blog posts tagged with "PIPEDA requests".

Why Friday's decision in R v Spencer will be a BIG DEAL for privacy

As I blogged yesterday, the Supreme Court of Canada has announced that it will release its decision in the appeal from Saskatchewan Court of Appeal in R v Spencer, 2011 SKCA 144. This decision, regardless of how the Court rules, will likely be a very big deal for privacy rights of customers of telecommunications service providers in Canada. It will hopefully decide whether Canadians have a reasonable expectation of privacy in information that is attached to an IP address.

Here's some background (mainly drawn from the Court of Appeal decision) and why this is a big deal.

The police detected somebody -- at that time unknown -- using the the file sharing program and protocol LimeWire to share child pornography. At that stage, all they had was the IP address of the computer or network connection being used. Using publicly available tools, they determined the IP address was allocated by the internet service provider, Shaw Communications. The police officer, though he likely had sufficient grounds to get a production order under the Criminal Code simply wrote to the ISP with the following request:

Constable Darren Parisien … is investigating a criminal code offence pertaining to child pornography and the internet. We have opened [sic] file investigation in relation to this investigation.

Pursuant to the Personal Information Protection and Electronic Documents Act (PIPEDA), we request the disclosure of customer identifying information including but not limited to name, internet service provider records, address of service, current service status and phone number relevant to the following:

1. Internet Protocol Address 70.64.12.102 on 2007-August-31 at 1246 hours (Local Saskatchewan time)

This information is being requested to assist in an ongoing investigation. We declare that Constable Darren Parisien of the Saskatoon Police Service Organized Crime Unit – Vice Section [sic] has the lawful authority to obtain the information and that the following section of PIPEDA is satisfied for this request: [full text of s. 7(3)(c.1) omitted]

This request specifically satisfies Paragraph 7(3)(c.1)(ii).

And, with that, the police got the customer name and address from the ISP. That information was used to get a search warrant of Spencer's house and he was subsequently arrested. At the trial, Spencer argued that the warrantless disclosure of his information by Shaw was a violation of his Charter rights. This motion was denied and he appealed to the Court of Appeal on this issue.

The Court of Appeal agreed, finding that any objective expectation of privacy was effectively gutted by the Shaw privacy policy and acceptable use policy which reserves to Shaw a very broad discretion to disclose personal information to the police. There was no real discussion about whether such terms of use are ever read by customers and whether they really should temper the expectation of privacy that most of us have about our internet usage.

[42] In summary, neither its contractual relationship with Mr. Spencer’s sister, as set out in the Services Agreement, nor PIPEDA prohibited Shaw from disclosing the Disclosed Information in the circumstances of this case; rather, each clearly provided Shaw with the discretion to disclose information to the police in these exact circumstances, and Shaw had Mr. Spencer’s sister’s express, informed consent to do so. The sum of these factors militates very strongly against a finding that Mr. Spencer’s privacy expectation was reasonable.

In short, the police can ask for and, under the Court's reading of PIPEDA, the internet service provider can provide the customer's personal information.

So what's the big deal? This is not an exceptional case; what's exceptional is that the Supreme Court of Canada is going to weigh in on whether a Canadian has an expectation of privacy in his or her internet activities. We know that thousands of times a year the police go to internet service providers asking for information about their customers and thousands of times a year, this information is provided. Just a quick search of CanLII shows this. Just search for "pipeda request" and you'll get a dozen reported cases. They show voluntary cooperation by such internet service providers as Uniserve, Shaw, Bell Sympatico, Northwestel, and Rogers. (Recently, Rogers and Teksavvy disclosed in their respective transparency reports a high level of providing customer information in similar circumstances withou a warrant. For Rogers, it provided customer information 711 times in 2012/2013.)

As I understand it, the form of letter was a result of the coordinated effort of law enforcement and a group of internet service providers who have agreed to provide warrantless access to customer account information in connection with child exploitation investigations. They are designed to satisfy the requirements of Section 7(3)(c.1)(ii) of PIPEDA which permits disclosures of personal information to the police where they have the "lawful authority" to obtain the information and the information relates to "enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law".

It was exactly this sort of disclosure that was so controversial in Vic Toews' Bill C-30. That bill, if passed, would have permitted police officers to demand customer names and addresses connected to a known IP address. ISPs would have been required to hand over the information. The controversy stemmed from the fact that these demands are unaccountable and are not subject to ANY supervision by the courts. The "request" at issue in R v Spencer is the same: made without a warrant based on reasonable grounds, completely unaccountable and with no judicial oversight. In addition, the relevant individual is NEVER informed of the fact that the request was made or that the information was disclosed. To top it off, there is no information under oath so there is no disincentive to lie in these PIPEDA requests. (I find it to be telling that nowhere near 711 charges resulted from the requests made of Rogers.)

So what's the big deal with having an ISP connect an IP address with a customer's name and address? There has been some suggestion by the law enforcement community that a customer's name and address is just "phone book information" and there's no expectation of privacy in that. That misses the point and shows contempt for the right to privacy. A customer’s name and address, when connected with an IP address is never used in isolation. It is always connected with other information relating to that individual’s behaviours or activities. An individual citizen can carry on their "offline" life in relative anonymity without having to produce identification every time they visit a store or look at a particular book in a library. The realities of network communications mean that every activity undertaken by an individual on the internet, lawful or not, leaves a record of that IP address that can often be traced back to an individual or a small group of people. The only protection for that individual’s anonymity is that the connection between the IP address and other identifiers can only be made by the telecommunications service provider. Connecting the identity of an individual to his or her online activities pierces the reasonable expectation of anonymity and amounts to a collection of personal information that should only be done by law enforcement where the circumstances are sufficiently compelling to tilt the balance in favour of law enforcement/public safety. This is why, in my view, judicial supervision should be required. We'll see whether the Supreme Court of Canada agrees with this view ...

At the very least, I expect the Supreme Court of Canada will provide some clear guidance on whether -- under the Charter of Rights and Freedoms -- there is a reasonable expectation of privacy and anonymity on the internet that can only be pierced by an order from a judge, who is satisfied on information under oath that there are reasonable grounds to believe a crime has been committed and that the order is necessary to uncover evidence of the offender. Stay tuned ...