The Supreme Court of Canada made a key privacy ruling Friday that will now require police to first obtain a warrant or court order to obtain the numbers making up a person or organization’s IP address.
The top court was asked to consider whether an IP address alone, without any of the personal information attached to it, was protected by an expectation of privacy under the Charter.
In a five-four split decision, the court said a reasonable expectation of privacy is attached to the numbers making up a person’s IP address, and just getting those numbers alone constitutes a search.
Writing for the majority, Justice Andromache Karakatsanis wrote that an IP address is “the crucial link between an internet user and their online activity.”
“Thus, the subject matter of this search was the information these IP addresses could reveal about specific internet users including, ultimately, their identity.”
Writing for the four dissenting judges, Justice Suzanne Côté disagreed with that central point, saying there should be no expectation of privacy around an IP address alone.
The court’s decision is based on the case of Andrei Bykovets, who was convicted of 14 online fraud for purchases from an Alberta liquor store.
In 2017, the Calgary Police Service investigating the alleged crime discovered that the store’s online sales were managed by Moneris, a third-party payment processing company.
Police contacted Moneris and asked for the IP address associated with the purchases, without providing a court order or warrant. Moneris gave two IP addresses to the police.
Appeal court dismissed privacy claim
Calgary police then went to the internet service provider with a court order to get the names and addresses associated with the IP addresses. One address belonged to Bykovets, the other belonged to his father.
Police used the names and addresses to get a warrant to search their residences. Bykovets was arrested and charged with possession of a third party’s credit card and identity documents.
At trial, Bykovets argued that he was the victim of an unreasonable search and seizure, a violation of Section 8 of the Charter of Rights and Freedoms, because he had an expectation of privacy with respect to his IP address.
The trial judge disagreed, saying there is no expectation of privacy related to an IP address and so the Charter was not violated.
The Alberta Court of Appeal majority decision sided with the trial judge, but one judge of the appeal court disagreed, saying there is an expectation of privacy associated with IP addresses.
Protecting online privacy in a digital world
In the Supreme Court majority decision, Karakatsanis said that only considering the information associated with an IP address to be protected by the Charter and not the IP address itself “reflects piecemeal reasoning” that ignores the broad purpose of the Charter.
The ruling said the privacy interests cannot be limited to what the IP address can reveal on its own “without consideration of what it can reveal in combination with other available information, particularly from third-party websites.”
It went on to say that because an IP address unlocks a user’s identity, it comes with a reasonable expectation of privacy and is therefore protected by the Charter.
“If [the Charter] is to meaningfully protect the online privacy of Canadians in today’s overwhelmingly digital world, it must protect their IP addresses,” the ruling said.
The dissenting opinion
Justice Côté, writing on behalf of dissenting justices Richard Wagner, Malcolm Rowe and Mary Moreau, acknowledged that IP addresses “are not sought for their own sake” but are “sought for the information they reveal.”
“However, the evidentiary record in this case establishes that an IP address, on its own, reveals only limited information,” she wrote.
Côté said the biographical personal information the law was designed to protect is not revealed through access to an IP address. Police must use that IP address to access personal information that is held by an internet service provider (ISP), or a website that tracks customers’ IP addresses to determine habits.
“On its own, an IP address does not even reveal browsing habits,” Côté wrote. “What it reveals is a user’s ISP — hardly a more private piece of information than electricity usage or heat emissions.”
Côté said placing a reasonable expectation of privacy on an IP address alone upsets the careful balance the Supreme Court has struck between Canadians’ privacy interests and the needs of law enforcement.
“It would be inconsistent with a functional approach to defining the subject matter of the search to effectively hold that any step taken in an investigation engages a reasonable expectation of privacy,” the dissenting opinion said.
