Accessing subscriber data: Working around the Spencer ruling

By Justin Ling Web Only

Accessing subscriber data: Working around the Spencer ruling

Photo licensed under Creative Commons by Japanexperterna.se.

Many expected that last year’s ruling in R. v. Spencer would close the door on the warrantless requests that Canada’s police departments had grown quite reliant on. Canada’s police chiefs, however, aren’t so sure.

In a resolution adopted at the Canadian Association of Police Chiefs’ annual conference this month, the country’s police brass are calling for “the creation of a reasonable law designed to specifically provide law enforcement the ability to obtain, in real-time or near real-time, basic subscriber information (BSI) from telecommunications providers.”

In Spencer, the Supreme Court ruled against a long-standing practice of police agencies making informal, often undocumented, requests to Canada’s telecommunications providers, to share information on their subscribers.

Police, and lawyers from the Department of Justice, maintained that those requests were merely for that ‘basic subscriber information’ — connecting a name, phone number, and home address to an IP address that had been identified in the course of their investigations.

However, numerous cases and anecdotal stories from defence attorneys suggested that significantly more information was being disclosed through lawful access requests made under the authority of the Personal Information and Electronic Documents Act (PIPEDA), ranging from clients’ login information to GPS coordinates.

Ottawa had even moved to expand that power, in Bill C-13, by providing criminal and civil immunity to anyone who discloses information under that authority. In Spencer, the Supreme Court disputed that authority’s very existence.

“[PIPEDA] allows for disclosure without consent to a government institution where that institution has identified its lawful authority to obtain the information. But the issue is whether there was such lawful authority which in turn depends in part on whether there was a reasonable expectation of privacy with respect to the subscriber information,” writes Justice Thomas Cromwell, for the majority.

The court found that, in fact, there was a reasonable expectation of privacy.

“The disclosure of this information will often amount to the identification of a user with intimate or sensitive activities being carried out online, usually on the understanding that these activities would be anonymous,” writes Cromwell. “A request by a police officer that an ISP voluntarily disclose such information amounts to a search.”

As such, the court forbade future warrantless requests for this information, barring exigent circumstances.

That hasn’t stopped the CACP from asking that the process be reinstated and, in fact, expanded.

The association, in its resolution, argues that since Spencer, “the telecommunications companies refuse to provide any basic subscriber information (BSI) in the absence of an exigent circumstance, or a judicial warrant or order, even where there exists no reasonable expectation of privacy.”

As such, it is asking for the real-time transfer of Canadians’ subscriber information.

It’s unclear how the association expects such a proposal to survive judicial scrutiny, though the logic is perhaps rests on the assumption that, if subscribers are aware that their basic information will be automatically relayed to police, the expectation of privacy will cease to exist.

David Fraser, partner at McInnes Cooper and author of the Privacy Lawyer blog, calls the CACP proposal “quite troubling.”

He says reading Spencer and concluding that it could still authorize passing on subscriber data without a warrant is an exercise in “mental gymnastics.”

Fraser says that creating a more efficient system to provide this information to police is entirely advisable, but those requests still need a form of judicial oversight involving a judge or a justice of the peace. Police, he says, still need to prove that they have reasonable grounds to believe a crime has been, or is likely to be, committed.

“I cannot imagine any scenario that does not have a judge in the middle of it that complies with the Supreme Court decision and that complies with the Charter,” he told National.

“It’s pretty clear that you have the right to anonymity.”

Even so, the government appear to be considering different options.

The CACP proposal cites a working paper, led by the Department of Justice, that proposes three options to work around Spencer.

“Option 1: Create an administrative (non-judicial) scheme for access to Basic Subscriber Information (BSI),” the CACP paper reads, seemingly describing the system called for in their resolution.

“Option 2: Create a new judicial order (production order) for basic subscriber information and/or add BSI to existing production orders,” it reads. It’s not clear what level of evidentiary burden would be applied to such a production order.

“Option 3: Create a specific production order for some types of basic subscriber information with a greater expectation of privacy, and create a specific administrative (non-judicial) authority for access to other types of basic subscriber information,” reads the last option.

The third option, seemingly, would fit into Fraser’s scheme of having a justice of the peace review and approve simple subscriber data requests.

Filed Under:
Comments
No comments


Leave message



 
 Security code