In R v. Bykovets,[1] a 5-4 majority of the Supreme Court of Canada (“SCC”) found that individuals have a reasonable expectation of privacy in their IP addresses and, as such, law enforcement require judicial pre-authorization (such as a search warrant or production order) to obtain access to them.[2]
The SCC’s decision has obvious impact on law enforcement, but its effects are likely to be seen by businesses, who may receive a decrease in voluntary disclosure requests and an increase in formal production orders seeking personal information about their customers’ internet activity.
In this article, we provide a brief overview of the SCC’s decision and discuss important considerations under Canadian privacy law when determining the extent to which a business may disclose personal information to law enforcement without consent.
Facts
At the heart of the case was a credit card fraud involving the use of unauthorized credit card data to purchase gift cards. During its investigation, the Cybercrimes unit of the Calgary police learned that the credit card payments were managed by a third-party payment processor. The police asked for and the payment processor voluntarily provided the IP addresses associated with the fraudulent purchases.[3] With the IP addresses in hand the police were able to identify the defendant’s internet service provider (“ISP”) through publicly accessible sources and then obtain a production order to compel the ISP to disclose the name and address of the customers associated with each IP address.[4] This ultimately led to the arrest of the defendant, and eventual appeal before the SCC.
The appellant alleged that the police’s original request for the IP addresses to the payment processor violated his right against unreasonable search and seizure under section 8 of the Canadian Charter of Rights and Freedoms (the “Charter”).[5]
Please log in to read the full article.