Police need search warrant to get IP address, rules Supreme Court of Canada in 5-4 split decision

Section 8 of the Charter must protect IP addresses to meaningfully protect Canadians’ online privacy in “today’s overwhelmingly digital world,” the Supreme Court of Canada ruled today.

In the split decision in R. v. Bykovets, 2024 SCC 6, the court’s majority found that Canadians have a reasonable expectation of privacy in their IP addresses, meaning police must obtain a search warrant before accessing them.  

The decision is an “unequivocal affirmation of how important privacy is in the digital era,” says Sarah Rankin, who represented the appellant. She says there was an unusual amount in common between the majority and dissent, with the two sides only diverging on “a very narrow set of issues and interpretation.”

“The majority decision is a robust defence and affirmation of privacy and trust in the digital space,” says Anil Kapoor, who acted for the Canadian Civil Liberties Association, an intervenor in the case.

Writing for the majority, Justice Andromache Karakatsanis said that the internet has “essentially altered the topography of privacy under the Charter” in a way that has bolstered state power by strengthening its “informational capacity.” By concentrating a mass of information with private third parties who have tools to aggregate and dissect the data, the internet “has added a third party to the constitutional ecosystem.” While these third parties are not subject to s. 8, she said “they mediate a relationship which is directly governed by the Charter.”

For a s. 8 argument to persuade a court, a claimant must demonstrate that there was a search or seizure, and that it was unreasonable. In Bykovets, the court only had to dealt with the first requirement. There is a “search” when the state intrudes on a reasonable expectation of privacy, and that expectation is reasonable if the privacy interest outweighs the government’s interest in invading that privacy to advance its law-enforcement objectives.

When assessing a reasonable expectation of privacy, courts consider four factors: the subject matter of the search, the claimant’s interest in the subject matter, their subjective expectation of privacy, and whether that expectation of privacy was objectively reasonable.

On the question of control over the subject matter, Karakatsanis said people can choose to divulge some information for a limited purpose, or to a limited number of people, and still retain a reasonable expectation of privacy. She said Canada diverges from the US where third-party possession negates reasonable expectation of privacy over information. Karakatsanis said the majority’s analysis views the control question as non-determinative, quoting prior SCC jurisprudence in adding that “Canadians are not required to become digital recluses in order to maintain some semblance of privacy in their lives.”

When discussing the place of the search, Karakatsanis said that “online spaces are qualitatively different from physical spaces” and can reveal much more about a subject. The lack of “physical intrusion,” which the trial judge highlighted, is not revelatory about the expectation of privacy’s reasonableness, she said.

Justice Suzanne Côté wrote the reasons for the dissenters, which included Richard Wagner, Malcolm Rowe, and Michelle O’Bonsawin.

While the dissenters found the police did not need judicial authorization before asking the payment processor for the IP addresses, Côté said this conclusion “does not foreclose the possibility that someone may have a reasonable expectation of privacy on different facts.”

She said the factors relevant to the reasonableness inquiry in Bykovets were the privacy of the subject matter, the control over the subject matter, and the place of the search.

The minority disagreed with the majority on its assessment of the subject matter. Côté said that the majority “includes in the subject matter every step leading up to the ultimate identification of the suspect,” though the police could not identify Bykovets by the IP address alone. She said the IP addresses were not private, did not reveal private information, and without more evidence, all an IP address tells police is a person’s internet service provider – “hardly a particularly private matter, let alone core biographical information.”

On the question of control, Côté said that Bykovets had little control over the IP addresses, which an ISP can change “at will and without notice.”

The place of the search was the credit card processor’s database, and not Bykovets’ home, which “does not enhance the objective reasonableness of [his] subjective expectation of privacy.”

An Alberta court convicted the appellant, Andrei Bykovets, of 14 offences related to fraudulent online purchases. The judge rejected Bykovets’ argument that the police’s request to obtain IP addresses from the third-party processing company he used to make the purchases violated his s. 8 Charter rights, which protect against unreasonable search and seizure. He was unsuccessful on appeal, but one judge dissented and would have allowed the appeal on the basis that there is a reasonable expectation of privacy attached to an IP address.

The majority also included Justices Sheilah Martin, Nicholas Kasirer, Mahmud Jamal and Mary Moreau.