In a recent decision from the Supreme Court of Canada ("SCC"), R. v. Bykovets, 2024 SCC 6, the majority of the Court concluded that police must obtain a search warrant to access Internet Protocol ("IP") addresses.
The majority held that failing to obtain a search warrant prior to acquiring an IP address from a third-party service provider is a breach of the Canadian Charter of Rights and Freedoms (the "Charter") right to be secure from unreasonable search and seizure.
The Bykovets decision expands on the 2014 decision of R. v. Spencer, 2014 SCC 43, in which the SCC established that there is a reasonable expectation of privacy in an Internet Service Provider's "subscriber information" (which includes the name, address and contact information attaching to an IP address) and that a request for subscriber information in that context amounted to a search. Following Spencer, police cannot obtain subscriber information from Internet Service Providers – or internet activity associated with IP addresses from third-party websites – without prior judicial authorization (often referred to as a "Spencer warrant").
The Bykovets decision broadens the scope of what digital information attracts a reasonable expectation of privacy to include not only the subscriber information attaching to an IP address, as decided in Spencer, but the IP address itself. The majority reasoned that as the link that connects specific internet activity to a specific location, an IP address may betray deeply personal information. Therefore, access to IP addresses without judicial pre-authorization poses intense privacy risks.
Background
In the course of an investigation into fraudulent online purchases, police contacted the third-party processing company that managed the retailer's online sales, and requested and obtained the IP addresses used to make the purchases. With this information the police then obtained a Production Order compelling the Internet Service Provider to disclose the subscriber information attaching to the IP addresses. Police used the subscriber information to obtain and execute search warrants, resulting in Bykovets being arrested and charged with numerous criminal offences.
Bykovets challenged the police request to obtain the IP addresses from the processing company, alleging the IP address disclosure violated his right to be secure against unreasonable search and seizure under section 8 of the Charter.
The Trial Judge concluded that the police request of the processing company for the IP address did not amount to a "search" under s. 8 of the Charter because Bykovets did not have a reasonable expectation of privacy in his IP address (a requirement for section 8 Charter rights to be engaged). Bykovets was convicted of 14 of the 33 offences with which he had been charged. He appealed his conviction to the Alberta Court of Appeal.
The majority of the Alberta Court of Appeal agreed with the Trial Judge that Bykovets had no reasonable expectation of privacy in his IP addresses and dismissed his conviction appeal. The dissenting judge would have allowed the appeal on the basis that a reasonable expectation of privacy attached to the IP addresses.
Bykovets appealed to the SCC.
Supreme Court decision
The SCC, by a narrow 5-4 margin, agreed that the police obtaining the IP addresses from the processing company without a search warrant amounted to an unlawful search in violation of Bykovets' section 8 Charter rights.
The majority reasoned that an IP address, as subject matter for a search, cannot be characterized as an "abstract string of numbers." Rather, the door to private personal information is opened where an IP address links to other correlated online information collected and analyzed by third parties. The majority stated:
"Viewed normatively and in context, an IP address is the first digital breadcrumb that can lead the state on the trail of an individual's internet activity."
The majority further reasoned that requiring a search warrant to obtain an IP address is a burden that could be easily overcome by the state. Achieving the goals of law enforcement while preventing free access to information irrelevant to an investigation is made possible via section 8 Charter protections.
Importantly, the majority recognized that the internet has introduced third-party private corporations into the "constitutional ecosystem." While these third parties are not subject to section 8 of the Charter, they mediate the relationship between defendant and state and, as such, expand the state's potential access to private information.
The majority reasoned that judicial oversight, through the search warrant process, necessarily narrows the state's online reach and takes control over disclosure of personal information out of the hands of private corporations.
Conversely, the minority would have held that Bykovets' IP addresses did not attract a reasonable expectation of privacy because the search revealed nothing more than the IP addresses and the associated Internet Service Providers. The minority also found that the requirement to obtain a Spencer warrant provided adequate protection to individuals as it ensures police cannot obtain subscriber information from Internet Service Providers without prior judicial authorization.
The appeal was allowed and a new trial ordered.
Main takeaways
- The SCC reaffirmed the principle of law that government authorities requesting private data from third parties can constitute a search under section 8 of the Charter.
- The SCC recognized the expanding role of third-party corporations in the relationship between the state and the individual, made possible via the internet.
- This decision may have broader implications in terms of how we consider digital information and information over which one has a reasonable expectation of privacy.
- This decision opens the door to potential Charter challenges where the police have obtained an IP address without judicial authorization.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
