In the Supreme Court of Canada’s March 2024 decision R. v. Bykovets, 2024 SCC 6, Internet protocol (“IP”) addresses were found to attract a reasonable expectation of privacy under section 8 of the Canadian Charter of Rights and Freedoms (“Charter”). In addition to the clear implications for law enforcement authorities conducting criminal investigations, this decision is also likely to have an impact on Canadian privacy law and, in particular, for private organizations under the Personal Information and Protection of Electronic Data Act (“PIPEDA”) and similar provincial laws.
Background
The case involved a police investigation of fraudulent online purchases from a liquor retailer. Police contacted the third-party payment processor that processed the retailer’s online sales, seeking to obtain the IP addresses used for the fraudulent purchases. The payment processor provided two IP addresses to the police. In turn, the police obtained a production order from the court to compel the applicable Internet Service Providers to disclose the subscriber information for the two IP addresses. With the subscriber information in hand, the police obtained and executed search warrants for the residential addresses associated with the IP addresses, which belonged to the accused and his father.
At trial, the accused, Mr. Bykovets, argued that the payment processor’s provision of his IP address to the police was an unreasonable search and seizure that violated his rights under section 8 of the Charter. The trial judge rejected this argument and held that the request made by the police was not a search because the accused did not have a reasonable expectation of privacy in his IP address. On appeal, the British Columbia Court of Appeal upheld the trial court’s decision on the basis that an IP address does not, on its own, provide personal information and therefore does not attract a reasonable expectation of privacy.
The Supreme Court of Canada Decision
In its split decision, the majority of the Supreme Court of Canada overturned the trial court and appellate decisions and held that Mr. Bykovets had a reasonable expectation of privacy in his IP address. In its analysis, the Court focused on the potential of the IP addresses to reveal personal information and not the information that the IP addresses actually revealed. The Court highlighted the real risk that an IP address in conjunction with the host of personal information that is discernible from a user’s other online activities has the potential to “shatter online anonymity completely”.
The Court offered the following observations about the potential for IP addresses to reveal deeply personal and revealing online information:
“An IP address provides the state with the means that can lead them to a trove of personal information. Consequently, an IP address may betray an intensely private array of information, touching directly on the intimate details of the lifestyle and personal choices of an individual user.”
The majority of the Court, in its analysis, also acknowledged that courts in foreign jurisdictions have already begun to treat (or are considering issues relating to) IP addresses as private information. For example, the European Court of Justice has concluded that an IP address is personal data relating to an identifiable person. Similarly, the Court of Appeal for England and Wales has found that the issue of whether IP addresses and other browser-generated information is “personal data” under the privacy legislation in that jurisdiction is a serious question to be tried on its merits.
Current treatment of IP Addresses in Canadian privacy law
The Supreme Court of Canada made its decision in R. v. Bykovets in the context of a public authority conducting a criminal investigation, and resolves a long-standing dispute in the jurisprudence regarding how IP addresses should be treated in that context. However, for private corporations concerned about how the Court’s decision could impact their obligations under federal and provincial privacy legislation, the decision also reinforces the approach to IP addresses that has been taken by the Office of Privacy Commissioner of Canada since 2009 – i.e. an IP address constitutes “personal information” if it can be associated with or linked to an identifiable individual.
What is material about this decision, however, is that in the balancing of interests the Court valued privacy over safety and security of the public. To date, it has been a general principle of privacy law that information can be obtained without consent where reasonably required for the purpose of an investigation. The Court stated that, “intensely private nature of the information an IP address may betray strongly suggests that the public’s interest in being left alone should prevail over the government’s interest in advancing its law enforcement goals.” The Court also found that it was not too much of a burden to require law enforcement to obtain a court order.
Key takeaways for businesses
- Despite the guidance of federal and provincial privacy commissioners, many organizations state in their privacy policies that they collect IP addresses when individuals visit their website, but categorize IP addresses as not being personal information because there is no attempt to identify the individual. Any such statement in a privacy policy or other document should be reviewed in light of this decision.
- R v. Bykovets firmly establishes that IP addresses attract a reasonable expectation of privacy under section 8 of the Charter. Canadian organizations that collect and store IP addresses should be aware of this principle if and when they are asked to respond to requests from law enforcement agencies and/or regulators for disclosure of IP addresses, and require that the requester provide a court order before producing IP addresses to law enforcement.
Contact PRIVATECH to discuss how the Court’s decision in R v. Bykovets may affect your organization. For in-depth training on Canadian privacy law, including other recent regulator and court decisions, join us for CIPP/C training in May!