Is a new warrantless access program in the works?
March 31, 201731 March 2017
In its landmark search and seizure ruling in R. v. Spencer, the Supreme Court was unanimous that real-time requests made by police to link Canadians’ IP addresses with basic subscriber information required a warrant, except in exigent circumstances. At least that appeared to be the obvious conclusion.
“Some degree of anonymity is a feature of much internet activity and depending on the totality of the circumstances, anonymity may be the foundation of a privacy interest that engages constitutional protection against unreasonable search and seizure,” the court wrote, in declaring a warrantless access regime being used by Canadian police to be unconstitutional.
But new documents suggest that Ottawa is entertaining a somewhat different read of that court decision.
A background document, obtained under access to information laws from Public Safety Canada, reads that “the Court stated that where [basic subscriber information] can reveal a person’s ‘personal choices or lifestyles,’ which may be compared to the ‘biographical core information’ protected under s.8 of the Charter, a reasonable law, warrant, or exigent circumstances are required for that information to be obtained lawfully.”
The use of “or” is critical, because Ottawa seems set to draft legislation that will create a new production order for exactly this kind of information, but that will also create an administrative scheme outside of the courts. It’s unclear where the threshold will be.
According to consultation documents prepared by the federal government, the two-tiered scheme will authorize police to obtain Canadians’ data that has “a low expectation of privacy” without a warrant on an “on-demand” basis, albeit with some safeguards.
For information that has a “higher expectation of privacy associated with it, such as the type of information that was at issue in Spencer,” a production order should be required.
And yet, one of the questions asked in the consultation document is: “Should an IP address form part of the [basic subscriber information] data (i.e. name, address, phone number and email address)? Should it be treated different from other BSI access? If so, how?”
In the background documents prepared last May, Public Safety posits that the administrative scheme, which would not require judicial authorization, could include requests for “name, address, telephone number, internet address, or whether records for an individual subscriber exists at all.”
Indeed, an “internet address” is exactly what the court said would require a warrant in Spencer.
As a part of this process, the federal government and their provincial and territorial counterparts have prepared a report with recommendations on what this legislation should look like, but have yet to disclose it.
And while law enforcement have complained that their investigations have been hindered and hampered by losing the ability to issue these real-time requests, the government is taking its time with new legislation.
This Monday, the government met with dozens of police, privacy, and legal stakeholders to solicit their views on the issue of warrantless access.
David Fraser, partner at McInnes Cooper and one of the more vocal critics of the warrantless access system, was at that consultation and told CBA National that there was a lot of divergent viewpoints — although he says he’s “impressed” that the government decided welcome those critical views.
“It was clear to me that there was not consensus on the meaning of Spencer, more broadly, and there was not consensus on, at least he way I saw it, a clear understanding that Spencer has two parts,” he said.
Fraser is referring to an oft-overlooked section of the Spencer ruling that the government background documents ignore almost entirely. It relates not to how police can request the information, but how the information-holder can disclose it under the Personal Information Protection and Electronic Documents Act.
“It would be reasonable for an internet user to expect that a simple request by police would not trigger an obligation to disclose personal information or defeat PIPEDA’s general prohibition on the disclosure of personal information without consent,” the court found. It goes on to say, “PIPEDA prohibits disclosure of the information unless the requirements of the law enforcement provision are met, including that the government institution discloses a lawful authority to obtain, not simply to ask for the information.”
Where the police service doesn’t have the authority — which, to be clear, Fraser takes to mean judicial authority — the company cannot disclose it.
It’s that part of the Spencer ruling that has really put the brakes on disclosure.
On the other side, whether an IP address is “basic” information or whether it engages a higher level of privacy, Fraser said there was no real agreement.
“I think they’re struggling with that,” he says.
He adds that the government is also hand-wringing over whether this system should be expanded beyond traditional law enforcement — to the CBSA, CSIS, CRA, and others — and whether it should be permitted in non-criminal cases, like for a lost phone or a missing person.
Fraser said the exercise was useful, but what remains to be seen is which recommendations the government will follow. To help them, he’s even written a full spate of recommendations for Ottawa to look at.
“This is all about balancing. It’s about balancing an individual’s privacy rights against wider societal interest.”