Privacy in Subscriber Data
On Friday, June 13, 2014, the Supreme Court of Canada ("SCC") released R v Spencer, 2014 SCC 43, a unanimous decision with significant implications for online privacy. The court made two important findings:
Online privacy includes the ability to use the internet
anonymously; and
Users can have a reasonable expectation of privacy in their
subscriber data.
By drawing a link between users' subscriber information and
internet usage data like browsing patterns or downloads, the SCC
found "a privacy interest beyond that inherent in the person's
name, address and telephone number." In order to attribute
particular online activities to an individual, police and government
agencies or departments will now have to obtain a warrant or
production order before requesting subscriber information from
Internet Service Providers ("ISP").
Background
Matthew Spencer downloaded child pornography into a folder in a
file sharing program. Using the Internet Protocol ("IP") address
associated with Spencer's computer, police requested subscriber
information from Spencer's ISP, Shaw Communications. The police
did not have a warrant or production order to obtain the name,
address and telephone number associated with Spencer's IP. Using
the subscriber information, the police charged Spencer with
possession of child pornography; he was convicted at trial.
Appealing his conviction, Spencer argued that the police request
for subscriber information was an illegal search and seizure under
section 8 of the Charter. The Saskatchewan Court of Appeal found
Page 2
McMillan LLP mcmillan.ca
that the request and receipt of the information was not a search
under section 8.
The Supreme Court assessed three factors to determine whether
Spencer had a reasonable expectation of privacy in his subscriber
data: 1) the subject matter of the alleged search; 2) the nature of
the privacy interest; and 3) the reasonableness of Spencer's
expectation given the contractual and statutory framework.
1. Subject matter of the search: a privacy interest in subscriber
data
It appears that internet users possess a privacy interest in their
subscriber information when its use would reveal their internet
usage habits. In defining the privacy interests at stake, the Court
looked first at the subject matter of the police search. The Court
emphasized a prior decision which defined the type of information
covered by section 8 as "information which tends to reveal intimate
details of the lifestyle and personal choices of the individual"
[emphasis in original].1 The ability to reveal an individual's online
activity was enough to find a privacy interest in a user's subscriber
information.
2. Online anonymity and the nature of the privacy interest
The Court's discussion of the nature of the privacy interest
introduced a new concept in Canadian cases: anonymity. The SCC
found that informational privacy includes online anonymity:
The user cannot fully control or even necessarily be aware of
who may observe a pattern of online activity, but by remaining
anonymous — by guarding the link between the information
and the identity of the person to whom it relates — the user
can in large measure be assured that the activity remains
private.2
1 Para 27, citing R. v. Plant, 1993 CanLII 70 (SCC).
2 Para 46.
Page 3
McMillan LLP mcmillan.ca
However, the Court was careful to clarify that there is no right to
anonymity online. The privacy interest in anonymous internet use
is simply one factor in assessing an individual's reasonable
expectation of privacy on the facts of a case.
3. The reasonableness of Spencer's expectation of privacy
The reasonableness of an internet user's expectation of privacy will
depend on the particular circumstances in a case; statutory and
contractual provisions are just one factor in the analysis. However,
the SCC's decision in Spencer found that the language in the
Personal Information Protection and Electronic Documents Act
("PIPEDA") is not a relevant consideration in determining the
reasonableness of a user's expectation of privacy. Since most ISPs'
use standard form terms and policies, users will likely have a
reasonable expectation of privacy when using a private computer
in the home.
The Court looked to the PIPEDA and the contract with Shaw to
determine whether Spencer's expectation of privacy was
reasonable in the circumstances. Section 7(3)(c.1)(ii) of the
PIPEDA allows disclosure of information to a government institution
when that body has identified its "lawful authority to obtain the
information"; Shaw's privacy policy permits the company to
disclose information when "required by law". By relying on those
provisions, the SCC found that a warrant or production order was
necessary to give a request for information lawful authority. The
Court used Shaw's "confusing and unclear" privacy policy to find
support for a reasonable expectation of privacy, since it narrows
the circumstances in which the company could disclose subscriber
information. The Court also adopted a "cautious" approach when
determining the impact of a provision in a standard form contract
like Shaw's terms of use and privacy policy.3
3 Para 54.
Page 4
McMillan LLP mcmillan.ca
Final comments
It is important to note that police retain the ability to request
information without a warrant in pressing circumstances; for
example, where the information is required to prevent imminent
bodily harm.
The Spencer decision will likely have a significant impact on Bills C-
13 and S-4, which would permit further warrantless government
access to information about internet users. Those bills, which the
government had previously claimed were compatible with privacy
Page 5
McMillan LLP mcmillan.ca
laws, may conflict with the SCC's June 13th decision. Since the Bills
are both in committee, it will be interesting to watch the discussion
and changes which take place in Parliament and the Senate over
the next weeks and months. Though R v Spencer was a criminal
case, the Court's discussion of the principles of online privacy and
the importance of anonymity will have an impact in other contexts
as discussions of online privacy continue.
by Éloïse Gratton, Sandra Sbrocchi and Nicholas Howard, Studentat-
Law
For more information on this topic please contact:
Montréal Éloïse Gratton 514.987.5093 [email protected]
Ottawa Sandra Sbrocchi 613.232.7171 Ext. 101 [email protected]
a cautionary note
The foregoing provides only an overview and does not constitute legal advice. Readers are
cautioned against making any decisions based on this material alone. Rather, specific legal
advice should be obtained.
© McMillan LLP 2014
Nicholas Howard
