Law Enforcement Wins at the Expense of Internet Privacy in R v Ward

Yesterday, after weeks of incessant prodding by Apple, I finally decided to upgrade to the latest version of iTunes. Before doing so, however, a window emerged before me with a dizzying and seemingly endless block of text. Like most people faced with an ominous set of “Terms and Conditions,” I scrolled directly to the bottom of the page, clicked “Agree,” and carried on with my day. Digital consumers are faced with these non-negotiable “contracts of adhesion” on a regular basis, which take their namesake from the fact that the customer has two choices: adhere to its terms or take your business elsewhere. As the Ontario Court of Appeal’s recent decision in R v Ward, 2012 ONCA 660 [Ward] confirms, these pesky agreements have consequences, even if it does not always seem like it.

Factual Background

Carookee.com is an Internet forum operated in Germany where individuals can post, share, and discuss content on a diverse array of topics. In 2006, the owner of the website noticed that a number of pages on the forum were being used to share child pornography, so he filed a criminal complaint and handed over the IP addresses that had downloaded the content to German police.

Some of the IP addresses—which are unique numerical identifiers assigned to a customer by the internet service provider (“ISP”)—emanated from Canadian ISPs and German police informed the RCMP accordingly. After further investigation, the RCMP linked the IP addresses that had accessed the child pornography to Bell Sympatico in Sudbury. At this point, without judicial authorization, the RCMP submitted a request to Bell Sympatico for the personal information of the individual(s) associated with the IP addresses. Bell Sympatico voluntarily complied with the request, identified the subscriber as the appellant, and provided his address to police.

Using this information, Sudbury Police obtained a search warrant. A forensic analysis of the appellant’s computer, which was ultimately seized during the search, revealed over 30,000 images and 373 videos of child pornography.

In defending the resulting child pornography charges, the appellant argued that the search of his residence and computer—made possible by the information provided to police by Bell Sympatico—violated his right to be secure against unreasonable search and seizure. Accordingly, the appellant argued, the fruits of the search should have been excluded at trial pursuant to s. 24(2) of the Charter.

What is Section 8 and What Does it Protect?

Section 8 of the Charter provides that:

everyone has the right to be secure against unreasonable search and seizure.

Instead of being simply a narrow protection against police officers acting outside the scope of their authority, the courts have interpreted s. 8 as a broad right against state intrusions on personal privacy (R v Kang-Brown, [2008] 1 SCR 456, para 8). More specifically, in R v Tessling, [2004] 3 SCR 432, the Supreme Court confirmed that “personal privacy” includes physical privacy (ie., control over the body), territorial privacy (ie., control over certain locations), and informational privacy (ie., control over personal data).

That said, s. 8 only protects the individual from unreasonable search and seizure. To put it into privacy terms, then, section 8 protects against state intrusions upon an individual’s reasonable expectation of privacy.

How do the courts determine what is and is not a reasonable expectation of privacy? The inquiry asks first, whether the individual had a subjective expectation of privacy (which is almost always the case); and second, whether that individual’s expectation was, considering the totality of the circumstances, objectively reasonable. In summarizing the case law on this point in Ward, Doherty JA put it this way:

the ultimate question is whether the personal privacy claim advanced in a particular case…[should] be recognized as beyond state intrusion absent constitutional justification if Canadian society is to remain a free, democratic and open society.

Hence, it can be said that s. 8 claims are as much about the individual claimant’s privacy as they are about society’s interest in guarding against excessive state intrusion into private lives.

The s. 8 Argument in Ward

Returning to the facts at hand, the argument put forth by the appellant was that he had a “reasonable expectation that he could access and use the Internet anonymously and that s. 8 protects him against state access to information in the hands of third parties that would allow the state to identify [his] activities on the Internet” (para 70).

While there was no doubt that the appellant himself had a subjective expectation of privacy over his subscriber information, the court ultimately found that that expectation was not objectively reasonable. For the Court of Appeal, the most prescient factors among the “totality of the circumstances” were the service agreement between Bell Sympatico and the appellant, and certain provisions of the Personal Information Protection and Electronic Documents Act, SC 2000, c 5 [PIPEDA] and of the Criminal Code, RSC, 1985, c C-46 [Criminal Code].

First of all, the appellant’s Internet usage and the collection and use of his personal information was governed by a service agreement—a contract of adhesion not unlike the one I had to agree to when I upgraded to the newest version of iTunes. While the agreement clearly privileges the appellant’s privacy, there are the following large (and common) carve outs:

[Bell Sympatico will] offer full co-operation with law enforcement agencies in connection with any investigation arising from a breach of this [Acceptable Use Policy].

Among other things, the Acceptable Use Policy prohibits:

Transmitting, posting, receiving, retrieving, storing, or otherwise reproducing…any program or information constituting…a criminal offence (paras 54-56).

Additionally, the Court of Appeal placed considerable weight on the terms of PIPEDA. PIPEDA is federal legislation governing the collection, use and disclosure of customers’ personal information in the private sector. Hence, PIPEDA governs the relationship between the appellant and Bell Sympatico and permits organizations like Bell Sympatico to disclose personal information to police “for the purposes of enforcing any law in Canada” (para 43).

Finally, s. 487.014(1) of the Criminal Code provides that:

no production order is necessary for a peace officer…to ask a person to voluntarily provide the officer documents, data or information that the person is not prohibited by law from disclosing. [Emphasis added]

Taken together, the Court of Appeal held that the reasonable and informed person would view a customer’s reasonable expectation of privacy to subscriber information as being greatly circumscribed by Bell Sympatico’s discretion to disclose the subscriber information in certain circumstances; discretion that, in the final analysis, the appellant agreed to give to Bell Sympatico.

While Doherty JA made clear that the decision should not be read to hold that an individual never has a reasonable expectation of privacy in their subscriber information, one is left scratching their head for a hypothetical circumstance in which his caveat (offered at para 109) would be given effect. 

Conclusion: Two Steps Forward for Law Enforcement, Two Steps Back for Internet Privacy

As it stands, the law requires and provides no judicial oversight of the police practice of requesting subscriber information from ISPs in the investigation of a crime. PIPEDA requires that police, in making requests like the one featured here, provide only minimal information to the ISP. In this case, the request letter indicated that the request was being made pursuant to PIPEDA and the officer identified their authority to make the request, but the letter included no details of the specific investigation. Rightly or wrongly, the Court of Appeal has sent a clear message: the police and the ISPs are capable of regulating their own affairs when it comes to the transfer of subscriber information.

Child pornography aside for a moment, the power to connect an individual to an IP address can afford police a sweeping glimpse into that individual’s private life. Indeed, police could learn that an individual was researching the symptoms of a sexually transmitted infection, or was seeking help for drug addiction, or was carrying on an affair through a chat room—indisputably private information no one expects will find its way into the hands of law enforcement.

This leaves one questioning whether the court’s analysis in determining if the appellant’s expectation of privacy was objectively reasonable was too formalistic and too contractual in nature. Regardless of what one does or does not agree to in a service agreement, if reasonable and prudent Canadians are not fussed about ISPs divulging personal information to police where there is no warrant, why was there such visceral opposition to Bill C-30 (the Protecting Children From Internet Predators Act)? Should Bill C-30 become law, police would be given the power to demand subscriber information from ISPs without a warrant.

Notwithstanding one’s persuasion on the balance between the interests of law enforcement and of privacy, Ward offers as ripe an opportunity as ever for the Supreme Court of Canada to pronounce on this critically important issue.