In a recent 5:4 decision, the Supreme Court of Canada ruled that IP addresses carry a reasonable expectation of privacy and should be considered personal information. This landmark decision means that requests for IP addresses by law enforcement now constitute a "search" under Section 8 of the Charter. The ruling has significant implications for Canadian businesses and public-sector organizations that collect and store IP addresses, requiring them to review their practices and policies to ensure compliance.
In a split 5:4 decision, the Supreme Court of Canada ("SCC") recently decided that an IP address carries a reasonable expectation of privacy and should be considered personal information.
In its decision, Canada's top court waxed poetic in describing the internet as "the most expansive cultural artifact our species has ever created", where humans go to fetch recipes, get directions, and find love. In R. v. Bykovets, 2024 SCC 6, the Court had to grapple with the question of whether privacy rights attach to an Internet Protocol (IP) address.
An IP address is a unique identification number, used in the technical administration of traffic through the internet, enabling the transfer of information from one node to another. From the perspective of Internet Service Providers (ISPs), each IP address is associated with certain subscriber information. Earlier decisions concluded that a reasonable expectation of privacy attaches to this subscriber information — including the name, address, and contact information — associated with an individual IP address. But what about the IP address itself?
An IP address is really just a collection of numbers to identify a node within the network (akin to a civic street address) which is assigned or allocated by an administrator, and which is connected in some sense to a specific location, device, or could be associated with a specific individual. Unlike civic addresses, an IP address usually can be – and often is – changed by an ISP without notice.
Background
Bykovets was convicted of fourteen offences, including online fraud, using unauthorized credit card data to buy gift cards online, using those gift cards to make purchases in store, and possessing material related to credit card fraud. To track down the individual in question, Calgary police followed the IP address information which was used in the credit card processing data, and this trail led them to Bykovets.
Police then used this subscriber information to execute search warrants for the residential addresses of the individual – he was arrested, convicted after a trial, and his convictions were confirmed on appeal.
From a privacy point of view, the question was whether the police's initial request to Moneris (the credit card payment processor) violated the accused's right against unreasonable search and seizure under s. 8 of the Charter. In other words, did the accused have a reasonable expectation of privacy in his IP address?
In its analysis, the SCC tells us that the right against unreasonable search and seizure, like all Charter rights, must receive a broad and purposive interpretation. Then the majority concluded that there is a reasonable expectation of privacy in an IP address. That means a request by the police for an IP address constitutes a "search" and in the circumstances of this case.
Implications
Outside of the criminal law context, the SCC's decision in R v. Bykovets has other implications for privacy law in Canada. With the confirmation that IP addresses attract a reasonable expectation of privacy, which means two things:
- Many Canadian businesses and public-sector organizations collect and store IP addresses as a matter of course (it's a way, for example, of monitoring web traffic), and should be aware of the privacy implications in the unlikely event of a request for disclosure of IP addresses from government or law enforcement agencies.
- Tracking cookies are commonly used to monitor website visitor activity, and to market products or services, and cookies may collect IP address information. For your own organization, it's worth reviewing current cookie functions, and your organization's privacy policies, to ensure that the collection, use and disclosure of this information is appropriately covered.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.