Privacy in the Digital Age: Canadian Supreme Court Affirms Charter Protection for IP Addresses

In a landmark ruling, the Supreme Court of Canada highlights the significant importance of safeguarding Canadians’ privacy rights in the digital age. The recent case of R v Bykovets, 2024 SCC 6 confirms that Canadians maintain a reasonable expectation of privacy concerning their IP addresses, mandating law enforcement to obtain judicial authorization before accessing them.

In a landmark ruling, the Supreme Court of Canada highlights the significant importance of safeguarding Canadians’ privacy rights in the digital age. The recent case of R v Bykovets, 2024 SCC 6 confirms that Canadians maintain a reasonable expectation of privacy concerning their IP addresses, mandating law enforcement to obtain judicial authorization before accessing them.

This important decision builds upon the precedent set in R v Spencer, 2014 SCC 43, in which the Court found that private organizations such as Internet service providers (“ISP”) have a duty to protect their clients' personal information and should not voluntarily disclose this information to law enforcement authorities requesting it (Personal Information Protection and Electronic Documents Act, SC 2000, c. 5). The Court thereby affirmed the need for police to obtain a warrant before asking an ISP to disclose the name and address of a client whose IP address was associated with an illegal online activity. The Spencer decision thus established that personal information held by an ISP such as names, addresses, and contact information, warrants protection against unreasonable search and seizures under Section 8 of the Canadian Charter of Rights and Freedoms (“Charter”).

Now, with Bykovets, this safeguard extends to the IP addresses themselves.

Background

The case revolved around the appellant, Andrei Bykovets, being convicted for using unauthorized credit card data to purchase gift cards online, subsequently using them for in-store transactions. During the investigation, the police obtained two IP addresses connected to the transactions from Moneris, the payment processing company handling the online sales for the store.

The appellant alleged that the police’s request to Moneris violated his rights under s.8 of the Charter.¹ The Court of Appeal of Alberta held that the police’s request to Moneris was not a search under s.8 of the Charter because the appellant did not have a reasonable expectation of privacy with respect to his IP address.

Supreme Court’s Decision

A search within the meaning of s.8 of the Charter occurs when the state invades a reasonable expectation of privacy. The expectation of privacy will be reasonable where the public’s interest in being left alone by the government outweighs the government’s interest in intruding on an individual’s privacy to advance public goals, such as law enforcement.

In a 5-4 decision, the Court overturned the lower court’s ruling, affirming that a request by the state for an IP address does constitute a search under s.8 of the Charter. Central to the Court’s decision were two crucial questions:

1. Was there an expectation of privacy?

To analyse the privacy interests at issue, courts notably consider the subject matter of the alleged search. When assessing the subject matter of a search, the Court’s task is to determine, “what was the police really after?”.

The Court’s majority adopted a holistic view, recognizing that IP addresses serve as gateways to a wealth of personal information about internet users.

Writing for the majority, Karakatsanis J. emphasized that these addresses enable the state to draw inferences about individuals' identities and online activities, thus constituting deeply personal information. The Court affirms that the object of the police’s alleged search in this context was not really the IP address, but rather the information that the IP address tends to reveal about a specific internet user.²

Conversely, the dissenting opinion adopted a narrower approach, viewing the subject matter of the search as the information revealed by the raw IP addresses alone. Based on the evidentiary records of the case, the dissent concluded that, on their own, IP addresses only reveal limited information: they can reveal a user’s ISP, but they do not reveal browsing habits or other private information without being combined with other information.³

2. Was the expectation of privacy reasonable?

The expectation of privacy will be reasonable where the public’s interest in being left alone by the government outweighs the government’s interest in intruding on an individual’s privacy to advance public goals, such as law enforcement, safety, security and the suppression of crime.

The Court re-affirms that search concerning an individual’s use of the internet has the potential of exposing deeply personal information capable of revealing an individual’s identity. As the Court states, “an IP address is the key to unlocking a user’s Internet activity and, ultimately, their identity, such that it attracts a reasonable expectation of privacy.⁴” The Court considers an IP address to be the first “digital breadcrumb that can lead the state on the trail of an individual’s Internet activity.⁵”

The Court held that while IP addresses may assist in advancing police investigations, obtaining prior judicial authorization, which are readily available with the advent of telewarrants, “is not onerous”.⁶ Accordingly, the intensely private nature of the information that an IP address may betray outweighs the government’s interest in advancing law enforcement goals.

As such, the Court deems that an access to IP addresses without judicial pre-authorization poses intense privacy risks and concludes that an IP address attracts a reasonable expectation of privacy. As a result, a request by the state for an IP address is to be considered as a search under s.8 of the Charter.
 
Key Takeaways

This decision is in line with the Court's reasoning in R. v. Spencer, which opened the door to an update of the biographical core doctrine. Developed in R. v. Plant, this doctrine asserted that Canadians can only have a reasonable expectation of privacy with respect to biographical information that reveals intimate details of their lifestyle and personal choices. The Spencer decision marked an evolution of this doctrine, abandoning the idea that, to be protected, information must immediately and directly reveal intimate details of an individual's lifestyle. With its decision in R. v. Bykovets, the majority of the Court followed the same reasoning for the analysis of the reasonable expectation of privacy, considering what information the subject matter of a search tends to reveal when combined with other information.

The decision also highlights the increasingly important role played by private sector organizations, and ISP in particular, in the context of such searches. While the Charter applies to state-individual relations, the Court's findings should also be of interest to private organizations that hold personal information and to which law enforcement authorities may present certain access requests.

¹ Section 8 of the Canadian Charter of Rights and Freedoms guarantees the right to be secure against unreasonable search or seizure.
² R. v. Bykovets, 2024 SCC 6, at para. 41-42.
³ Idem, at 128 to 130.
⁴ Idem, at para. 28.
⁵ Idem, at para. 9.
⁶ Idem, at para. 85.