By Alex Boutilier
Canada’s top court will soon rule on whether warrantless sharing of telecom customer data with police is legal.
It has become commonplace for police to obtain identifying information on Canadians from Internet service providers. But some lawyers argue this is a perversion of a law that was supposed to beef up privacy.
Now the Supreme Court of Canada is set to rule on whether the practice is constitutional.
“This is the equivalent of the state standing over your shoulder and essentially watching what you’re doing,” said Ronald Piche of Saskatchewan law firm Piche & Co.
“Now, they don’t know who you are at the time, but they’re just one letter away.”
Piche took on the case of Matthew David Spencer, a man who was charged with possessing child pornography at the age of 19.
Police laid charges after Spencer’s Internet service provider, Shaw, turned over his identity voluntarily. Spencer was convicted, but appealed his case up to the Supreme Court.
Before 2001, police had to prove reasonable grounds to believe a crime was committed and obtain a warrant before accessing private information. But that year Parliament passed PIPEDA, the Personal Information Protection and Electronic Documents Act. It was billed as safeguarding Canadians’ digital privacy.
PIPEDA allowed telecoms to voluntarily hand over customer data to police if it is “requested for the purpose of enforcing any law in Canada, a province or a foreign jurisdiction.”
This opened the door for warrantless access to personal data, said Richard Fedorowicz of Toronto-based law firm Robinson, Chartier, Taraniuk, Owoh & Fedorowicz.
“I can tell you there’s nothing stopping police from pursuing search warrants. The troubling thing is it almost became just a matter of convenience. It’s just easier to send this form email,” said Fedorowicz, who has litigated similar cases.
Here’s how it works, according to four lawyers interviewed: police witness online behaviour that they suspect to be illegal. They do not know who is behind it, but trace the Internet protocol (IP) address to a Canadian telecom.
They then go to the company and get the name, address and phone number tied to that IP address. There is no warrant involved and the disclosure is not revealed to the individual.
Most telecoms have reworded their customer contracts in recent years to allow for this disclosure, said Fedorowicz.
Lower courts have consistently ruled that “tombstone data” such as names, addresses and phone numbers do not carry an expectation of privacy, even if they are tied to someone’s online activity.
But if the Supreme Court sides with Spencer, all of that will change. Spencer’s legal team argues the way police have been using PIPEDA is an unconstitutional breach of privacy.
“The purpose of PIPEDA is not to enhance police powers but rather to protect privacy rights,” says the legal argument written by Aaron Fox and Darren Kraushaar, lawyers with McDougall Gauley LLP.
They argue that police should be able to trace an IP address, but only with the sign-off of a judge. They say police currently are using the “power to collect intimate and revealing personal information without any judicial oversight.”
The court is considering the Spencer case now and could render its decision at any time.
Law enforcement agencies requested data from nine Internet, telecommunications and web companies approximately 1.2 million times in 2011. It’s not known how many times the companies complied with police requests.
Police argue they need their powers strengthened to catch up with modern criminals.
Speaking at a House of Commons committee studying Bill C-13, the Conservatives’ so-called cyberbullying bill, members of the RCMP, the Ontario Provincial Police and the Halifax Regional Police said they need quick access to data in order to address crimes in the digital world.
“Under the current legislation, police can only access the very basics of subscriber information,” said Carson Pardy, the OPP’s director of eastern region operations.
“The outcome (of C-13) will be that police can quickly and consistently gain access to information that makes a difference to our effectiveness in investigating and preventing criminal activity and victimization.”
Both the Conservatives and police agencies have stressed that C-13 does not explicitly expand authorities’ warrantless access to Canadians personal data. But the bill does remove a disincentive for telecoms to co-operate. The legislation includes a clause that shields from prosecution anyone who voluntarily hands over information to authorities.
The Canadian Civil Liberties Association is also challenging warrantless access through PIPEDA in the Ontario Superior Court. A court date has not been set for that case.