Mr. Matthew David Spencer won the battle but lost the war in the recent ruling of the Supreme Court of Canada of R. v. Spencer, 2014 SCC 43. The unanimous 8 member panel has made it very clear that persons using the Internet have a reasonable expectation of privacy, including a reasonable expectation that their anonymity will be respected. While the Court allowed the admission of evidence obtained in this case through the police’s warrantless acquisition of Mr. Spencer’s identity from the internet service provider (“ISP”), from this point on, police in Canada must understand that they will need authorized searches through the use of properly issued warrants in order to overcome this presumption of preservation of anonymity.

Mr. Spencer had been using a common filing-sharing program, LimeWire, to download to his computer hundreds of child pornography videos. He did so from his sister’s home in Saskatoon, Saskatchewan. She had a contract with an Internet Service Provider (“ISP”), Shaw, to provide an Internet connection, which Internet connection Mr. Spencer used for his file downloading. A feature of LimeWire is that once you have downloaded a file, other users can download that same file from your computer.
The police were monitoring the downloading of child pornography and determined that certain computers with certain IP addresses were involved. They identified that one of these IP addresses was associated with Shaw and was in the general area of Saskatoon. They made a “law enforcement request” of Shaw, purportedly pursuant to s. 7(3)(c.1)(ii) of the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (PIPEDA), seeking the subscriber information of the IP address in question. Shaw voluntarily complied (as have many other ISP’s over the years). Armed with this information, the police then obtained a warrant to search Mr. Spencer’s sister’s home, where they seized his computer containing hundreds of child pornography files.
Mr. Spencer was charged with possessing child pornography and also, because of the fact that others were able to access his computer and download these same files using LimeWire, with the charge of making available child pornography. Both of these offences involve minimum prison sentences.
The trial judge found that Mr. Spencer did not have a reasonable expectation of privacy and, therefore, that there had been no violation of s. 8 of the Charter. He did hold, however, that the offence of making available child pornography required some positive facilitation of making available the files which he held Mr. Spencer had not done. As well he concluded that Mr. Spencer did not know that others could download the files from his computer and so the mens rea element of the offence was not made out. He therefore acquitted Mr. Spencer of the making available charge. The Court of Appeal upheld the conviction of possession of child pornography but held that the trial judge had misdirected himself on the making available charge, noting that being wilfully blind could be sufficient to constitute the mens rea and a positive facilitation was not required. The Court of Appeal ordered a new trial for the making available charge.
In the Supreme Court, Justice Cromwell gave reasons for the Court. After emphasizing that s. 8 had to be interpreted in a purposive manner and after noting that the Court had long underscored “the protection of privacy as [being] a prerequisite to individual security, self-fulfilment and autonomy as well as to the maintenance of a thriving democratic society” [para. 15], he turned to an analysis of four factors in determining whether there was a reasonable expectation of privacy: (1) the subject matter of the alleged search; (2) the claimant’s interest in subject matter; (3) the claimant’s subjective expectation of privacy in the subject matter; and (4) whether the claimant’s subjective expectation of privacy was objectively reasonable, having regard to the totality of the circumstances [para. 18]. Cromwell J. disposed of two of these factors, namely, Mr. Spencer’s subjective expectation was that his use of the Internet and LimeWire was private and that he had a direct interest in the subject matter. The real issues in this matter were what was the subject matter of the alleged search and whether the subjective expectation of privacy was objectively reasonable.
On the first of these two issues, the trial judge had simply equated the disclosure of the IP address to a name and an address of someone with a contract with Shaw. But Justice Caldwell of the Court of Appeal noted that the disclosure of the identity of the person behind the IP address disclose much more than mere subscriber identity. That information can provide details as to the lifestyle and choices of the subscriber or the persons using that subscriber’s Internet connection. Cromwell J. agreed with Cromwell JA:
[32] Applying this approach to the case at hand, I substantially agree with the conclusion reached by Cameron J.A. in Trapp and adopted by Caldwell J.A. in this case. The subject matter of the search was not simply a name and address of someone in a contractual relationship with Shaw. Rather, it was the identity of an Internet subscriber which corresponded to particular Internet usage. As Cameron J.A. put it, at para. 35 of Trapp:

To label information of this kind as mere “subscriber information” or “customer information”, or nothing but “name, address, and telephone number information”, tends to obscure its true nature. I say this because these characterizations gloss over the significance of an IP address and what such an address, once identified with a particular individual, is capable of revealing about that individual, including the individual’s online activity in the home.

[33] Here, the subject matter of the search is the identity of a subscriber whose Internet connection is linked to particular, monitored Internet activity.

Cromwell J. turned then to the issue as to whether Mr. Spencer’s expectation of privacy was reasonable. One of the factors he considered was the nature of the privacy interest. He noted that the Court had identified three types of privacy interest – territorial, personal and informational [para. 35]. He noted that, when speaking of use of the Internet in the context of this case, the interest was primarily informational [para. 37]:
We are concerned here primarily with informational privacy. … Internet users do not expect their online anonymity to cease when they access the Internet outside their homes, via smartphones, or portable devices.
He then looked at informational privacy and noted that it could be understood as privacy as secrecy, privacy as control and privacy as anonymity [para. 38]. He stated that the third conception of informational privacy, that of anonymity, was “particularly important in the context of Internet usage” and that s. 8 must be understood as protecting this form of privacy. He stated at paras. 47-48:
[47] In my view, the identity of a person linked to their use of the Internet must be recognized as giving rise to a privacy interest beyond that inherent in the person’s name, address and telephone number found in the subscriber information. A sniffer dog provides information about the contents of the bag and therefore engages the privacy interests relating to its contents. DRA readings provide information about what is going on inside a home and therefore may engage the privacy interests relating to those activities. Similarly, subscriber information, by tending to link particular kinds of information to identifiable individuals, may implicate privacy interests relating not simply to the person’s name or address but to his or her identity as the source, possessor or user of that information.

[48] Doherty J.A. made this point with his usual insight and clarity in Ward. “Personal privacy” he wrote “protects an individual’s ability to function on a day-to-day basis within society while enjoying a degree of anonymity that is essential to the individual’s personal growth and the flourishing of an open and democratic society”: para. 71. He concluded that some degree of anonymity is a feature of much Internet activity and that, “depending on the totality of the circumstances, . . . anonymity may enjoy constitutional protection under s. 8”: para. 75. I agree. Thus, anonymity may, depending on the totality of the circumstances, be the foundation of a privacy interest that engages constitutional protection against unreasonable search and seizure.
Cromwell J. concluded that the police request to Shaw for information “corresponding to specifically observed, anonymous Internet activity engages a high degree of informational privacy” [para. 51].
The next question that Cromwell J. addressed was whether Mr. Spencer’s expectation of privacy was reasonable. He then undertook an analysis of the provisions of Shaw’s contract with Mr. Spencer’s sister and the provisions of PIPEDA to determine whether that expectation was reasonable. While he determined that an assessment of those provisions presented a confusing picture. He noted that Internet users would have a reasonable expectation that PIPEDA would be to protect against incursions into private matters [para. 62]:
….Given that the purpose of PIPEDA is to establish rules governing, among other things, disclosure “of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information” (s. 3), it would be reasonable for an Internet user to expect that a simple request by police would not trigger an obligation to disclose personal information or defeat PIPEDA’s general prohibition on the disclosure of personal information without consent.
Shaw’s terms and conditions of use stated that it would comply with police requests for information where required or permitted by law. Since there was no legal provision in PIPEDA or elsewhere authorizing the police request for information, Shaw’s contractual conditions could only be understood as supporting the expectation of privacy.
He held, therefore, that Mr. Spencer’s expectation of privacy was, in the totality of the circumstances, reasonable. He concluded that “A request by a police officer that an ISP voluntarily disclose such information amounts to a search.” [para. 66]

Because in this case, the police request to Shaw was without a warrant, he determined that the information obtained in this matter was done in a manner that was in breach of the Charter [para. 74]:

The subscriber information obtained by police was used in support of the Information to Obtain which led to the issuance of a warrant to search Ms. Spencer’s residence. Without that information, the warrant could not have been obtained. It follows that if that information is excluded from consideration as it must be because it was unconstitutionally obtained, there were not adequate grounds to sustain the issuance of the warrant, and the search of the residence was therefore unlawful. I conclude, therefore, that the conduct of the search of Ms. Spencer’s residence violated the Charter: Plant, at p. 296; Hunter v. Southam, at p. 161. Nothing in these reasons addresses or diminishes any existing powers of the police to obtain subscriber information in exigent circumstances such as, for example, where the information is required to prevent imminent bodily harm. There were no such circumstances here.

Cromwell J. nonetheless noted that the police officer in question did believe that he had lawful authority in this case. This was one of the factors he considered in determining that, notwithstanding the decision that the evidence against Mr. Spencer was obtained in a manner which contravened s. 8 of the Charter, the exclusion of the evidence in this case would tend to bring the administration of justice into disrepute and he therefore upheld its admission.

On the issue respecting the making available charge, he agreed with the Court of Appeal and ordered a new trial.

While I applaud the Court’s ruling in this case, I question the wisdom of assessing the reasonableness of the claimant’s subjective expectation of privacy through an analysis of ISP terms and conditions of use. Frankly, and as Cromwell J. noted, the agreements with ISP’s are contracts of adhesion. Not only is there no negotiation as to terms and conditions, but no one ever reads them, never mind persons using Internet connections of others. In my view, the reasonableness of a claimant’s expectation of privacy in fact has no relationship whatsoever with terms of use outlined in ISP agreements that are rarely, if ever, read or understood.

This ruling also appears to fly in the face of some of the provisions contained in the federal government’s Bill C-13, Protecting Canadians Against Online Crime Act, which would seek to allow police to make such warrantless requests. One can only hope that the federal government will consider this decision before pushing forward with the enactment of bill C-13.

I remain

Constitutionally yours