Power imbalance online should compel the law to recognize reasonable expectation of privacy: BCCLA
On Tuesday, the Supreme Court of Canada heard a case determining whether police must obtain a search warrant before accessing a person’s IP address.
The question before the court in the appeal, Andrei Bykovets v. His Majesty the King, is whether Canadians have a reasonable expectation of privacy in their internet protocol (IP) addresses. The British Columbia Civil Liberties Association has intervened in the case and argues that while an IP address appears to be a “string of meaningless numbers,” it can reveal a person’s identity, “tracing a history of exploration, contemplation, and rejection,” that helped form it.
“Our argument is that IP addresses contain information that tends to reveal a person's identity and that they can be used to track your movements online and create a personal profile that would reveal your personal and private online behaviour,” says Vibert Jack, litigation director at the BCCLA. “For those reasons, we ought to have an expectation of privacy in all of that type of information.”
As an intervenor, the BCCLA does not take a position on the outcome of the case but suggests three points that favour a finding that an IP address does attract a reasonable expectation of privacy. One, because IP addresses can “indirectly” expose a person’s identity, the European Union has classified them as personal data, “which is consistent with our normative approach to privacy,” the BCCLA said.
Two, Canadians must use the internet to participate in our modern, virtual society. “If our ability to maintain control over access to our personal information is a facet of privacy linked to personal autonomy, then the normative approach requires courts to accept that disclosing one’s IP address while surfing the internet is not truly voluntary,” said the BCCLA. Despite choosing to access services through the internet, the group argued that Canadians should, therefore, still decide whether their IP addresses can be shared with others.
The BCCLA’s third point was that companies operating online have the discretion to share IP addresses with police, which allows “corporate interests to augment police power and delineate the boundaries of privacy.”
“The corporations that run the websites that we visit are able to unilaterally set the conditions of how we use their websites and how they use the data that they collect about us,” says Jack. “It's really impossible to participate in society today without going online. That means that you have to give your IP addresses to these corporations and give them the power to do what they want with them.”
“Our concern, ultimately, is that if the police are able to go to those corporations and get this information, without judicial oversight, that represents an expansion of police powers. It really gives these corporations the power to decide exactly what information police have access to.”
In Bykovets, the trial judge had found it was “not objectively reasonable to recognize a subjective expectation of privacy in an IP address used by an individual,” said the SCC case summary. The majority of the Alberta Court of Appeal confirmed the ruling. To the majority, “an IP address is an abstract string of numbers that don’t actually tell you anything about a person’s identity or their core biographical information,” says Jack. But an IP address can identify a geographical location, creating a profile about the user that can link to more sensitive information. Therefore, he says the expectation of privacy should come at the beginning of the process.
The court’s view was that the police obtaining the IP address was “one step in the process” to eventually get a person’s identity and address, which will require judicial oversight, says Jack. But BCCLA’s position is that, because of all the information third-party companies collect and store, there is a risk that police can access that information if they are free to interact with those companies, he says.
Bykovets originated with a police investigation into gift cards purchased with fraudulent credit card information. Police tracked the transactions to a couple of IP addresses, obtained search warrants for two associated addresses and arrested and charged Bykovets for the scheme. Bykovets argued that connecting him to the transactions through his IP addresses was a breach of his rights under s. 8 of the Charter, which protects against unreasonable search or seizure.
