R v Spencer: Supreme Court rules internet users have a reasonable expectation of privacy and anonymity online

[Note: this post is a work in progress, and will be updated as I digest the decision.]

This morning, the Supreme Court of Canada released its decision in R v Spencer, 2014 SCC 43.

The case, on appeal from the Saskatchewan Court of Appeal, has finally provided some certainty regarding the expectation of privacy that all Canadians enjoy in their online activities. All internet users expose their IP addresses to the sites they visit and the computers they connect to, but generally it is only the internet service provider who can connect that innocuous string of digits to a real identity.

In this case, the police had obtained information about an internet user from his internet service provider without a warrant. The police asked for it using a "PIPEDA request" and the ISP simply provided it, relying on a broad provision in PIPEDA which -- in its view -- permits certain disclosures to law enforcement.

I am still digesting the decision, but some very important conclusions from the case:

• Internet users have a reasonable expectation of anonymity in their online activities
  

  Contrary to the views of most police agencies and the government of Canada, this information is not innocuous "phone book information" but "Rather, it was the identity of an Internet subscriber which corresponded to particular Internet usage."
  

• A police request to the ISP for customer information amounts to a "search" for Charter purposes
  
• The fact that an ISP may be able to disclose information pursuant to s. 7(3)(c.1) of PIPEDA or the terms of use is relevant to the expectation of privacy, but not determinative of it
  
• The request by the police had no "lawful authority" since they had no authority to compel the production of the information
  

There has been much controversy surrounding the term "lawful authority" in PIPEDA, which permits an organization to disclose personal information without consent in connection with an investigation where the police have identified their "lawful authority" to obtain the information. The police have generally argued that an investigation is sufficient to satisfy that. The Court disagreed:

[62] Section 7(3)(c.1)(ii) allows for disclosure without consent to a government institution where that institution has identified its lawful authority to obtain the information. But the issue is whether there was such lawful authority which in turn depends in part on whether there was a reasonable expectation of privacy with respect to the subscriber information. PIPEDA thus cannot be used as a factor to weigh against the existence of a reasonable expectation of privacy since the proper interpretation of the relevant provision itself depends on whether such a reasonable expectation of privacy exists. Given that the purpose of PIPEDA is to establish rules governing, among other things, disclosure “of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information” (s. 3), it would be reasonable for an Internet user to expect that a simple request by police would not trigger an obligation to disclose personal information or defeat PIPEDA’s general prohibition on the disclosure of personal information without consent.

[63] I am aware that I have reached a different result from that reached in similar circumstances by the Ontario Court of Appeal in Ward, where the court held that the provisions of PIPEDA were a factor which weighed against finding a reasonable expectation of privacy in subscriber information. This conclusion was based on two main considerations. The first was that an ISP has a legitimate interest in assisting in law enforcement relating to crimes committed using its services: para. 99. The second was the grave nature of child pornography offences, which made it reasonable to expect that an ISP would cooperate with a police investigation: paras. 102-3. While these considerations are certainly relevant from a policy perspective, they cannot override the clear statutory language of s. 7(3)(c.1)(ii) of PIPEDA, which permits disclosure only if a request is made by a government institution with “lawful authority” to request the disclosure. It is reasonable to expect that an organization bound by PIPEDA will respect its statutory obligations with respect to personal information. The Court of Appeal in Ward held that s. 7(3)(c.1)(ii) must be read in light of s. 5(3), which states that “[a]n organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances”. This rule of “reasonable disclosure” was used as a basis to invoke considerations such as allowing ISPs to cooperate with the police and preventing serious crimes in the interpretation of PIPEDA. Section 5(3) is a guiding principle that underpins the interpretation of the various provisions of PIPEDA. It does not allow for a departure from the clear requirement that a requesting government institution possess “lawful authority” and so does not resolve the essential circularity of using s. 7(3)(c.1)(ii) as a factor in determining whether a reasonable expectation of privacy exists.

[64] I also note with respect to an ISP’s legitimate interest in preventing crimes committed through its services that entirely different considerations may apply where an ISP itself detects illegal activity and of its own motion wishes to report this activity to the police. Such a situation falls under a separate, broader exemption in PIPEDA, namely s. 7(3)(d). The investigation in this case was begun as a police investigation and the disclosure of the subscriber information arose out of the request letter sent by the police to Shaw.

[65] The overall impression created by these terms is that disclosure at the request of the police would be made only where required or permitted by law. Such disclosure is only permitted by PIPEDA in accordance with the exception in s. 7, which in this case would require the requesting police to have “lawful authority” to request the disclosure. For reasons that I will set out in the next section, this request had no lawful authority in the sense that while the police could ask, they had no authority to compel compliance with that request. I conclude that, if anything, the contractual provisions in this case support the existence of a reasonable expectation of privacy, since the Privacy Policy narrowly circumscribes Shaw’s right to disclose the personal information of subscribers.

[66] In my view, in the totality of the circumstances of this case, there is a reasonable expectation of privacy in the subscriber information. The disclosure of this information will often amount to the identification of a user with intimate or sensitive activities being carried out online, usually on the understanding that these activities would be anonymous. A request by a police officer that an ISP voluntarily disclose such information amounts to a search.

Here is the headnote summary of the decision:

Constitutional law — Charter of Rights — Search and seizure — Privacy — Police having information that IP address used to access or download child pornography — Police asking Internet service provider to voluntarily provide name and address of subscriber assigned to IP address — Police using information to obtain search warrant for accused’s residence — Whether police conducted unconstitutional search by obtaining subscriber information matching IP address — Whether evidence obtained as a result should be excluded — Whether fault element of making child pornography available requires proof of positive facilitation — Criminal Code, R.S.C. 1985, c. C‑46, ss. 163.1(3), 163.1(4), 487.014(1) — Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, s. 7(3)(c.1)(ii) — Charter of Rights and Freedoms, s. 8.

The police identified the Internet Protocol (IP) address of a computer that someone had been using to access and store child pornography through an Internet file sharing program. They then obtained from the Internet Service Provider (ISP), without prior judicial authorization, the subscriber information associated with that IP address. The request was purportedly made pursuant to s. 7(3)(c.1)(ii) of the Personal Information Protection and Electronic Documents Act (PIPEDA). This led them to the accused. He had downloaded child pornography into a folder that was accessible to other Internet users using the same file sharing program. He was charged and convicted at trial of possession of child pornography and acquitted on a charge of making it available. The Court of Appeal upheld the conviction, however set aside the acquittal on the making available charge and ordered a new trial.

Held: The appeal should be dismissed.

Whether there is a reasonable expectation of privacy in the totality of the circumstances is assessed by considering and weighing a large number of interrelated factors. The main dispute in this case turns on the subject matter of the search and whether the accused’s subjective expectation of privacy was reasonable. The two circumstances relevant to determining the reasonableness of his expectation of privacy in this case are the nature of the privacy interest at stake and the statutory and contractual framework governing the ISP’s disclosure of subscriber information.

When defining the subject matter of a search, courts have looked not only at the nature of the precise information sought, but also at the nature of the information that it reveals. In this case, the subject matter of the search was not simply a name and address of someone in a contractual relationship with the ISP. Rather, it was the identity of an Internet subscriber which corresponded to particular Internet usage.

The nature of the privacy interest engaged by the state conduct turns on the privacy of the area or the thing being searched and the impact of the search on its target, not the legal or illegal nature of the items sought. In this case, the primary concern is with informational privacy. Informational privacy is often equated with secrecy or confidentiality, and also includes the related but wider notion of control over, access to and use of information. However, particularly important in the context of Internet usage is the understanding of privacy as anonymity. The identity of a person linked to their use of the Internet must be recognized as giving rise to a privacy interest beyond that inherent in the person’s name, address and telephone number found in the subscriber information. Subscriber information, by tending to link particular kinds of information to identifiable individuals may implicate privacy interests relating to an individual’s identity as the source, possessor or user of that information. Some degree of anonymity is a feature of much Internet activity and depending on the totality of the circumstances, anonymity may be the foundation of a privacy interest that engages constitutional protection against unreasonable search and seizure. In this case, the police request to link a given IP address to subscriber information was in effect a request to link a specific person to specific online activities. This sort of request engages the anonymity aspect of the informational privacy interest by attempting to link the suspect with anonymously undertaken online activities, activities which have been recognized in other circumstances as engaging significant privacy interests.

There is no doubt that the contractual and statutory framework may be relevant to, but not necessarily determinative of whether there is a reasonable expectation of privacy. In this case, the contractual and regulatory frameworks overlap and the relevant provisions provide little assistance in evaluating the reasonableness of the accused’s expectation of privacy. Section 7(3)(c.1)(ii) of PIPEDA cannot be used as a factor to weigh against the existence of a reasonable expectation of privacy since the proper interpretation of the relevant provision itself depends on whether such a reasonable expectation of privacy exists. It would be reasonable for an Internet user to expect that a simple request by police would not trigger an obligation to disclose personal information or defeat PIPEDA’s general prohibition on the disclosure of personal information without consent. The contractual provisions in this case support the existence of a reasonable expectation of privacy. The request by the police had no lawful authority in the sense that while the police could ask, they had no authority to compel compliance with that request. In the totality of the circumstances of this case, there is a reasonable expectation of privacy in the subscriber information. Therefore, the request by the police that the ISP voluntarily disclose such information amounts to a search.

Whether the search in this case was lawful will be dependent on whether the search was authorized by law. Neither s. 487.014(1) of the Criminal Code, nor PIPEDA creates any police search and seizure powers. Section 487.014(1) is a declaratory provision that confirms the existing common law powers of police officers to make enquiries. PIPEDA is a statute whose purpose is to increase the protection of personal information. Since in the circumstances of this case the police do not have the power to conduct a search for subscriber information in the absence of exigent circumstances or a reasonable law, the police do not gain a new search power through the combination of a declaratory provision and a provision enacted to promote the protection of personal information. The conduct of the search in this case therefore violated the Charter. Without the subscriber information obtained by the police, the warrant could not have been obtained. It follows that if that information is excluded from consideration as it must be because it was unconstitutionally obtained, there were not adequate grounds to sustain the issuance of the warrant and the search of the residence was therefore unlawful and violated the Charter.

The police, however, were acting by what they reasonably thought were lawful means to pursue an important law enforcement purpose. The nature of the police conduct in this case would not tend to bring the administration of justice into disrepute. While the impact of the Charter‑infringing conduct on the Charter protected interests of the accused weighs in favour of excluding the evidence, the offences here are serious. Society has a strong interest in the adjudication of the case and also in ensuring the justice system remains above reproach in its treatment of those charged with these serious offences. Balancing the three factors, the exclusion of the evidence rather than its admission would bring the administration of justice into disrepute. The admission of the evidence is therefore upheld.

There is no dispute that the accused in a prosecution under s. 163.1(3) of the Criminal Code must be proved to have had knowledge that the pornographic material was being made available. This does not require however, that the accused must knowingly, by some positive act, facilitate the availability of the material. The offence is complete once the accused knowingly makes pornography available to others. Given that wilful blindness was a live issue and that the trial judge’s error in holding that a positive act was required to meet the mens rea component of the making available offence resulted in his not considering the wilful blindness issue, the error could reasonably be thought to have had a bearing on the trial judge’s decision to acquit. The order for a new trial is affirmed.

For some background on "PIPEDA requests", check out the blog posts tagged with "PIPEDA requests".

Why Friday's decision in R v Spencer will be a BIG DEAL for privacy

As I blogged yesterday, the Supreme Court of Canada has announced that it will release its decision in the appeal from Saskatchewan Court of Appeal in R v Spencer, 2011 SKCA 144. This decision, regardless of how the Court rules, will likely be a very big deal for privacy rights of customers of telecommunications service providers in Canada. It will hopefully decide whether Canadians have a reasonable expectation of privacy in information that is attached to an IP address.

Here's some background (mainly drawn from the Court of Appeal decision) and why this is a big deal.

The police detected somebody -- at that time unknown -- using the the file sharing program and protocol LimeWire to share child pornography. At that stage, all they had was the IP address of the computer or network connection being used. Using publicly available tools, they determined the IP address was allocated by the internet service provider, Shaw Communications. The police officer, though he likely had sufficient grounds to get a production order under the Criminal Code simply wrote to the ISP with the following request:

Constable Darren Parisien … is investigating a criminal code offence pertaining to child pornography and the internet. We have opened [sic] file investigation in relation to this investigation.

Pursuant to the Personal Information Protection and Electronic Documents Act (PIPEDA), we request the disclosure of customer identifying information including but not limited to name, internet service provider records, address of service, current service status and phone number relevant to the following:

1. Internet Protocol Address 70.64.12.102 on 2007-August-31 at 1246 hours (Local Saskatchewan time)

This information is being requested to assist in an ongoing investigation. We declare that Constable Darren Parisien of the Saskatoon Police Service Organized Crime Unit – Vice Section [sic] has the lawful authority to obtain the information and that the following section of PIPEDA is satisfied for this request: [full text of s. 7(3)(c.1) omitted]

This request specifically satisfies Paragraph 7(3)(c.1)(ii).

And, with that, the police got the customer name and address from the ISP. That information was used to get a search warrant of Spencer's house and he was subsequently arrested. At the trial, Spencer argued that the warrantless disclosure of his information by Shaw was a violation of his Charter rights. This motion was denied and he appealed to the Court of Appeal on this issue.

The Court of Appeal agreed, finding that any objective expectation of privacy was effectively gutted by the Shaw privacy policy and acceptable use policy which reserves to Shaw a very broad discretion to disclose personal information to the police. There was no real discussion about whether such terms of use are ever read by customers and whether they really should temper the expectation of privacy that most of us have about our internet usage.

[42] In summary, neither its contractual relationship with Mr. Spencer’s sister, as set out in the Services Agreement, nor PIPEDA prohibited Shaw from disclosing the Disclosed Information in the circumstances of this case; rather, each clearly provided Shaw with the discretion to disclose information to the police in these exact circumstances, and Shaw had Mr. Spencer’s sister’s express, informed consent to do so. The sum of these factors militates very strongly against a finding that Mr. Spencer’s privacy expectation was reasonable.

In short, the police can ask for and, under the Court's reading of PIPEDA, the internet service provider can provide the customer's personal information.

So what's the big deal? This is not an exceptional case; what's exceptional is that the Supreme Court of Canada is going to weigh in on whether a Canadian has an expectation of privacy in his or her internet activities. We know that thousands of times a year the police go to internet service providers asking for information about their customers and thousands of times a year, this information is provided. Just a quick search of CanLII shows this. Just search for "pipeda request" and you'll get a dozen reported cases. They show voluntary cooperation by such internet service providers as Uniserve, Shaw, Bell Sympatico, Northwestel, and Rogers. (Recently, Rogers and Teksavvy disclosed in their respective transparency reports a high level of providing customer information in similar circumstances withou a warrant. For Rogers, it provided customer information 711 times in 2012/2013.)

As I understand it, the form of letter was a result of the coordinated effort of law enforcement and a group of internet service providers who have agreed to provide warrantless access to customer account information in connection with child exploitation investigations. They are designed to satisfy the requirements of Section 7(3)(c.1)(ii) of PIPEDA which permits disclosures of personal information to the police where they have the "lawful authority" to obtain the information and the information relates to "enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law".

It was exactly this sort of disclosure that was so controversial in Vic Toews' Bill C-30. That bill, if passed, would have permitted police officers to demand customer names and addresses connected to a known IP address. ISPs would have been required to hand over the information. The controversy stemmed from the fact that these demands are unaccountable and are not subject to ANY supervision by the courts. The "request" at issue in R v Spencer is the same: made without a warrant based on reasonable grounds, completely unaccountable and with no judicial oversight. In addition, the relevant individual is NEVER informed of the fact that the request was made or that the information was disclosed. To top it off, there is no information under oath so there is no disincentive to lie in these PIPEDA requests. (I find it to be telling that nowhere near 711 charges resulted from the requests made of Rogers.)

So what's the big deal with having an ISP connect an IP address with a customer's name and address? There has been some suggestion by the law enforcement community that a customer's name and address is just "phone book information" and there's no expectation of privacy in that. That misses the point and shows contempt for the right to privacy. A customer’s name and address, when connected with an IP address is never used in isolation. It is always connected with other information relating to that individual’s behaviours or activities. An individual citizen can carry on their "offline" life in relative anonymity without having to produce identification every time they visit a store or look at a particular book in a library. The realities of network communications mean that every activity undertaken by an individual on the internet, lawful or not, leaves a record of that IP address that can often be traced back to an individual or a small group of people. The only protection for that individual’s anonymity is that the connection between the IP address and other identifiers can only be made by the telecommunications service provider. Connecting the identity of an individual to his or her online activities pierces the reasonable expectation of anonymity and amounts to a collection of personal information that should only be done by law enforcement where the circumstances are sufficiently compelling to tilt the balance in favour of law enforcement/public safety. This is why, in my view, judicial supervision should be required. We'll see whether the Supreme Court of Canada agrees with this view ...

At the very least, I expect the Supreme Court of Canada will provide some clear guidance on whether -- under the Charter of Rights and Freedoms -- there is a reasonable expectation of privacy and anonymity on the internet that can only be pierced by an order from a judge, who is satisfied on information under oath that there are reasonable grounds to believe a crime has been committed and that the order is necessary to uncover evidence of the offender. Stay tuned ...

Police "PIPEDA requests" for customer information

As a follow-up to my previous post 'Dealing with police "Letters of Request for Information"', I thought I'd discuss a particular species of request letters, commonly referred to as "PIPEDA Requests".

The names are a bit misleading, since in many cases the recipient is led to believe that the authority to obtain the information is found in PIPEDA (the Personal Information Protection and Electronic Documents Act).

Here is an example letter, taken from R. v. Ward, 2008 ONCJ 355:

I, Constable Jason Tree of the National Child Exploitation Coordination Centre, am a law enforcement officer with the Royal Canadian Mounted Police.

I am conducting an investigation in relation to child sexual exploitation offences under the Criminal Code and I am requesting account information pursuant only to that investigation.

I request this disclosure in accordance with s. 7(3)(c.1) of the Personal Information Protection Electronic Documents Act. My authority to request and obtain this information derives from the Royal Canadian Mounted Police Act and the Royal Canadian Mounted Police Regulations as well as common law.

I am requesting the last known customer name and address of the account holder associated with IP address [number] used [date and time].

Should you agree to this request, please provide the information in the section below and reply via e-mail to Jason.tree@rcmp-grc.gc.ca.

As I understand it, the form of letter was a result of the coordinated effort of law enforcement and a group of internet service providers who have agreed to provide warrantless access to customer account information in connection with child exploitation investigations. They are designed to satisfy the requirements of Section 7(3)(c.1)(ii) of PIPEDA which permits disclosures of personal information to the police where they have the "lawful authority" to obtain the information and the information relates to "enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law".

While I generally have a dim view of disclosing customer information without a warrant, I can certainly understand why internet service providers have worked with law enforcement to address these particularly grim crimes.

Paper on Canadian ISP cooperation with law enforcement

An interesting read:

Updated: Business disclosure of personal information to law enforcement agencies: PIPEDA and the CNA letter of request protocol (PDF):

By Suzanne Morin with the assistance of Amy Awad and Dee Pham

Canadian Internet Service Providers (“ISPs”) are continuing their strategy to deal with a subset of requests for customer information from law enforcement agencies requests that is of particular concern to them – those pertaining to online child exploitation investigations.

The initiative, where participating ISPs voluntarily disclose customer name and address linked to an IP address at a particular date and time to law enforcement at the pre-warrant stage of child exploitation investigations, remains interesting at a number of levels.

It touches on privacy issues pertaining to the proper interpretation of PIPEDA and the reasonable privacy expectations of ISPs’ customers. It also provides an ongoing example of a relatively successful voluntary collaboration between private business, law enforcement and privacy regulators aimed at tackling legal uncertainties where they may most negatively affect the public good.

Dealing with police "Letters of Request for Information"

(This post is not intended to be legal advice. If you find yourself in a situation like those described below, seek competent legal advice. This post is principally meant to serve as a resource for lawyers who may have to deal with these issues from time to time. -- And I should emphasize that this relates to Canadian law only.)

As part of my practice, I often deal with business clients who call when the police or national security folks are knocking on the door and are looking for information about customers. When faced with a cop or a CSIS agent with a badge, particularly when they are pushy and use words like "obstruction", the natural inclination may be to hand over the information.

When the police show up and start asking for customer information, unless they have a search warrant and unless they say it is a matter of life and death, the business should request that they put their request in writing. This provides a clear record of what the police asked for and what they assert as the legal basis for their request. In conversation, what appears to be a compulsory process translates into a voluntary one once put in writing.

(If the police clearly say it's a matter of imminent life or death, the business is probably justified in providing the information and any risk of liability for the disclosure would likely be minimal. Still, try to get it in writing.)

Oftentimes, what will arrive next will be a "Letter of Request for Information".

It is important to carefully read and thoroughly understand what the letter says. Here's an example based on one that recently crossed my desk.

[Police letterhead]
LETTER OF REQUEST FOR INFORMATION

Business Name

Bus Address

Bus Fax #

Date of Request: *** Our file: ***

[1] I, Detective/Constable *** of the ***, am a peace officer within the *** Unit. I am involved in the ongoing investigation *** and am requesting *** information pursuant to Section 487.014 of the Criminal Code for this investigation. In accordance with my duty to investigate contraventions of the Criminal Code, I am requesting the following information from you which is necessary for my investigation:

• [2]***

[3]The information I am providing you relates to a criminal investigation. This information and the existence of this query should not be further disseminated or divulged outside the purpose for which it is provided to you; any attempt to further disseminate or divulge the information outside this purpose may be construed as obstructing, perverting or defeating the course of justice possibly resulting in criminal sanctions under s. 139(2) of the Criminal Code.

Please provide the information requested to myself, ***, by means of email to *** or by phone ***.

Peace Office rank and name Peace Officer Badge # Peace Officer Telephone Number Supervisor’s rank and name Supervisor’s Telephone Number

To begin with, it must be clearly understood that nothing in such a letter requires the business to provide any information whatsoever to the police. Unless it is a search warrant, a production order or a subpoena, any information to be provided is voluntary on the part of the business.

Let's parse the letter.

[1] This section sets out some of the background facts to the investigation and is presumably there set the foundation for "lawful authority" to request the information as is required under Section 7(3)(c.1) of PIPEDA:

(3) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is

. . .

(c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority (emphasis added) to obtain the information and indicated that . . .

(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or...

The paragraph continues that the request is pursuant to Section 487.014 of the Criminal Code. This makes it sound like the recipient of the letter has to provide the information, but that's far from the case. This section only says that the police can ask for information to be provided voluntarily.

Power of peace officer

487.014 (1) For greater certainty, no production order is necessary for a peace officer or public officer enforcing or administering this or any other Act of Parliament to ask a person to voluntarily provide to the officer documents, data or information that the person is not prohibited by law from disclosing.

[2] This paragraph or list sets out the information requested.

[3] This paragraph suggests a gag order and implicitly threatens that if the recipient tells anyone, they could be obstructing justice. One has to be very careful with this. Telling the subject of the investigation of the existence of the request would perhaps constitute obstruction, but the business should be free to seek legal advice without fear of this supposed gag order.

So what's a business to do? It is up to the business at this stage to decide whether it wants to comply, but it has to be mindful of any other legal obligations that it might have that would prevent it from making the disclosure. There is some question as to whether Section 7(3)(c.1) of PIPEDA is intended to permit businesses to hand over information without a warrant in connection with a criminal investigation. There is some legal authority either way, but none of the published decisions address any liability for the business. At the very least, the business needs to ask itself if it wants to make the disclosure and whether it's prepared to take the risk of some liability to the subject of the investigation.

Part of the examination of potential liability should involve an examination of any privacy policies or privacy statements that the business uses. For example, if the policy has language that suggests information will only be provided to third parties where "required by law", this written request does not constitute "required by law". Again, it's only voluntary.

If information is provided, the business should keep a copy.

My personal preference is to require a warrant or a production order in all circumstances, since it is not the job of any business to act as a deputy of the police. If the police can convince a judge that they need to have it, then that's good enough for me. Anything less is something less.

---

A final word about subpoenas: a subpoena is not an order to provide particular information to the police, but an order to appear in court with the information. Just because they have a subpoena about the information doesn't mean the recipient can -- or should -- just hand it over.

Ontario Court considers warrantless requests for subscriber information

There's been a lot of debate over whether PIPEDA permits a commercial entity, such as an ISP, to provide certain identifying information to law enforcement without a warrant. Most of the debate centers around section 7(3)(c.1) of PIPEDA, which reads:

(3) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is ...

(c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that

(i) it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs,

(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or

(iii) the disclosure is requested for the purpose of administering any law of Canada or a province;

Some are of the view that "lawful authority" means a lawful investigation and that an organization is able to disclose certain information without consent under PIPEDA. Some take the erroneous view that PIPEDA actually authorizes the disclosure, which is not the case at all. This error is compounded by law enforcement who refer to "PIPEDA letters" demanding information from internet service providers in connection with child exploitation investigations.

The Ontario Court of Justice, in an unpublished decision that I understand is under appeal, recently considered the impact of a request by law enforcement for ISP subscriber information. In R. v. Kwok, police officers went online and convinced an unidentified person to provide child pornography to the undercover officer. Using usual techniques, the cops determined the IP address of the suspect and sent a letter to the ISP requesting the billing information associated with the account. The officer testified that he had not read PIPEDA, but understood from an e-mail from the RCMP Commissioner that PIPEDA authorizes such disclosures and these letters should be used to facilitate access to information. Prior to PIPEDA, the officer testified, they routinely sought warrants for this sort of information. The letter used in this case, not surprisingly, cited PIPEDA. The ISP provided the information and an arrest was subsequently made.

The defendant made an application to have the evidence thrown out as it was unlawfully obtained and the Court agreed. The Court held that even if PIPEDA permits access to this information by law enforcement, it is contrary to the Charter for the police to obtain it in this manner.

From Paragraph 35 of the decision:

"The subscriber, in this case, in my view, and based on my reading of the authorities, has an expectation of privacy in respect of this personal information [name and address]. The investigation of these types of crimes is essential and important, but there must always be the proper balancing of the procedures used by the police and the right of citizens to be free from unreasonable search and seizure. Shortcuts, such as set out in s. 7(3)(c) of PIPEDA in the circumstances of this case must be used with great caution, given the notions of freedom and democracy we come to expect in our community. In my view, the police should have procured a warrant to obtain the subscriber information, that is the name and address of the Applicant, in this case, as I have found the name and address is information from which intimate personal details of lifestyle and choices can be obtained. I therefore find there has been a s. 8 violation."

The copy of the decision that I've obtained (R. v. Kwok) is marked "draft" and I haven't been able to find it online. I understand it is under appeal and hopefully the Court of Appeal can clarify what s. 7(3)(c) actually means and whether companies can provide the police with customer information without a warrant. I also hope that the Court will clarify that PIPEDA does not give anyone -- agents of the state in particular -- increased access to personal information, but the reverse.

Note: I've blogged about this topic on a number of occasions. For some background, see http://www.privacylawyer.ca/blog/labels/warrants.html.

Blogging about a PIPEDA access request

An employee of a Canadian company with a LiveJournal nickname of Vivace ma con Grazia is writing about his experience dealing with a request for access to personal information under PIPEDA. He's not happy.

Vivace ma con Grazia - The PIPEDA Saga, Part 1

In January 2004, some absolutely lovely Canadian legislation came into effect, known as The Personal Information Protection and Electronic Documents Act (or, more concisely PIPEDA). The whole thing is maddeningly complex from my point of view, but in short it serves to both prevent the sharing of an individual's personal information by corporations, and to allow individuals to request of Canadian corporations a complete disclosure of all personal information held by that corporation about the individual in question. At work, I am currently working on my share of a response to one of these information requests. And let me tell you, it's one royal pain in the ass....

Over the course of a few postings here, I'm going to try to share some of the techniques we develop for handling this search. I'll likely skip over how we manage the search of our paper records, since I'm not very involved with that, but I will try to provide some technical details of our electronic searches, and hopefully (when I can get approval to do so) some of the details of our decision making process. I'm hoping this will be useful to some poor sysadmin in the future.

Privacy PIPEDA Access to Information