It’s official – the Supreme Court ends the debate on privacy interests in IP addresses
In its recent decision in R. v. Bykovets, 2024 SCC 6, the Supreme Court of Canada held that internet protocol (“IP”) addresses attract a reasonable expectation of privacy under section 8 of the Canadian Charter of Rights and Freedoms (“Charter”). The decision has clear implications for law enforcement authorities conducting criminal investigations, but is also likely to cause ripples in Canadian privacy law and, in particular, for private organizations under the Personal Information and Protection of Electronic Data Act (“PIPEDA”) and similar provincial legislation.
Background
The case involved a police investigation of fraudulent online purchases from a liquor retailer. Police contacted the third-party payment processor that processed the liquor retailer’s online sales, seeking to obtain the IP addresses used for the fraudulent purchases. The payment processer provided two IP addresses to the police. In turn, the police obtained a production order from the court to compel the applicable Internet Service Providers to disclose the subscriber information for the two IP addresses. With the subscriber information in hand, the police obtained and executed search warrants for the residential addresses associated with the IP addresses, which belonged to the accused and his father.
At trial, the accused, Mr. Bykovets, argued that the payment processor’s provision of his IP address to the police was an unreasonable search and seizure that violated his rights under section 8 of the Charter. The trial judge rejected this argument and held that the request made by the police was not a search because the accused did not have a reasonable expectation of privacy in his IP address. On appeal, The Court of Appeal of Albert upheld the trial court’s decision on the basis that an IP address does not, on its own, provide personal information and therefore does not attract a reasonable expectation of privacy.
The Supreme Court of Canada’s decision
In its split decision, the majority of the Supreme Court of Canada overturned the trial court and appellate decisions and held that Mr. Bykovets had a reasonable expectation of privacy in his IP address. In its analysis, the Court focused on the potential of the IP addresses to reveal personal information and not the information that the IP addresses actually revealed. To this effect, the Court highlighted the real risk that an IP address in conjunction with the host of personal information that is discernable from a user’s other online internet activities has the potential to “shatter online anonymity completely”.
The Court offered the following observations about the potential for IP addresses to reveal deeply personal and revealing online information:
The unique and heightened privacy interests in personal computer data flows from its potential to expose deeply revealing information. […]
[…] First, as the link that connects specific Internet activity to a specific location, an IP address may betray deeply personal information, even before police try to link the address to the user’s identity. Second, activity associated with the IP address can be correlated with other online activity associated with that address available to the state — with particularly concerning consequences when coupled with access to third‑party‑held information. Finally, an IP address can set the state on a trail of Internet activity that leads directly to a user’s identity, even without a Spencer warrant. […]
Thus, to say that a Spencer warrant protects against the privacy concerns raised by IP addresses is simply not supported by modern technological realities. IP addresses play a crucial role in the inherent structure of the Internet. They are the means by which Internet-connected devices both send and receive data. As such, they are the key to unlocking an Internet user’s online activity — the first “digital breadcrumbs” on the user’s cybernetic trail (Jones, at para. 42, citing S. Magotiaux, “Out of Sync: Section 8 and Technological Advancement in Supreme Court Jurisprudence” (2015), 71 S.C.L.R. (2d) 501, at p. 502). Those breadcrumbs may establish an Internet user’s entire daily, weekly, or even monthly online activity, leading to an electronic roadmap of the user’s cybernetic peregrinations (Morelli, at para. 3). Like the computer in Reeves, an IP address provides the state with the means that can lead them to a trove of personal information.
Consequently, an IP address may betray an intensely private array of information, touching directly on the intimate details of the lifestyle and personal choices of an individual user (Marakah, at para. 32; Spencer, at para. 27).
The majority of the Court, in its analysis, also acknowledged that courts in foreign jurisdictions have already begun to treat (or are considering issues relating to) IP addresses as private information. For example, the European Court of Justice has concluded that an IP address is personal data relating to an identifiable person. Similarly, the Court of Appeal for England and Wales has found that the issue of whether IP addresses and other browser-generated information is “personal data” under the privacy legislation in that jurisdiction is a serious question to be tried on its merits.
Current treatment of IP Addresses in Canadian privacy law
The Supreme Court of Canada made its decision in R. v. Bykovets in the context of a public authority conducting a criminal investigation, and resolves a long-standing dispute in the jurisprudence regarding how IP addresses should be treated in that context. However, for private corporations concerned about how the Court’s decision could impact their obligations under federal and provincial privacy legislation, the decision also reinforces the approach to IP addresses previously taken by the Office of Privacy Commissioner of Canada. For example, the Privacy Commissioner has (since as early as 2009) found that IP addresses constitute “personal information” if they can be associated with or linked to an identifiable individual.
What is material about this decision, however, is that in the balancing of interests the Court valued privacy over safety and security of the public.
To date, it has been a general principle of privacy law that information can be obtained without consent where reasonably required for the purpose of an investigation.
The Supreme Court stated that, “intensely private nature of the information an IP address may betray strongly suggests that the public’s interest in being left alone should prevail over the government’s interest in advancing its law enforcement goals." The Court found that it was not too much of a burden to require law enforcement to obtain a court order.
Given the public commentary on the lack of judicial resources at this time, it is interesting that the Court is requiring further material use of said resources.
Key takeaways for businesses
- R v. Bykovets firmly establishes that IP addresses attract a reasonable expectation of privacy under section 8 of the Charter. Canadian organizations that collect and store IP addresses should be aware of this principle if and when they are asked to respond to requests from law enforcement agencies and/or regulators for disclosure of IP addresses, and require that the requester provide a court order before producing IP addresses to law enforcement.
- Despite the guidance of federal and provincial privacy commissioners, many organizations and public bodies state in their privacy policies that they collect IP addresses when individuals visit their website, but categorize IP addresses as not being personal information because there is no attempt to identify the individual. Any such statement in a privacy policy or other document should be reviewed in light of this decision.
