Supreme Court of Canada Affirms Privacy Rights for IP Addresses

On March 1, 2024, the Supreme Court of Canada ruled that an IP should be considered private.

Police require judicial approval before asking for an IP address from an internet provider. This decision, made by a narrow majority of five judges, will likely spark more discussion in the future.

The decision’s importance should be assessed against the meaning of the IP address, which is compared to an online fingerprint insofar as it is “connected” and placed locationally and is an essential, perhaps, the most elementary aspects of the Internet that can nevertheless tell a lot about Internet users.

What Happened

The case began with an investigation into online fraud at a liquor store.

Initially, the police, lacking a warrant, requested the store’s payment processor to provide the IP addresses associated with the suspicious transactions. The company complied by supplying two IP addresses despite the absence of a warrant. Subsequently, a court order enabled the police to compel an internet provider to divulge the names and addresses linked to those IP addresses.

The convicted individual contended that the police’s action of requesting IP address information without a warrant breached their privacy rights, as stipulated by the Canadian Charter of Rights and Freedoms. Although lower appellate courts unanimously held that there is no reasonable expectation of privacy for an IP address, the Supreme Court agreed to review the case.

What the Supreme Court Said

The Supreme Court explained that privacy rights protect people from unjustified intrusions by the government. The four factors considered to decide if privacy expectations were reasonable were:

1. The subject matter of the search, including the information sought and its potential to infer other personal details.
2. The claimant’s interest in the subject matter.
3. The claimant’s subjective expectation of privacy.
4. The objective reasonableness of that expectation.

The court recognized the appropriateness of expecting privacy on the internet, despite its difference from physical spaces, underscoring the vast amount of revealing information available online. It also addressed how the internet has impacted privacy rights under the Charter; while third parties such as internet service providers (ISPs) are not directly governed by the Charter, they influence the relationship between individuals and the police.

Ultimately, the court stated that Canadians should expect their IP addresses to be shared with the police only when it is legally justified.

Conclusion

The Court agreed that IP addresses should be protected on privacy grounds by the Charter, leading to the quashing of the initial conviction and the direction for a new trial. They added that this decision would not overly impede police investigations, given the substantial privacy concerns.

This ruling marks a significant change in how third parties should address privacy laws concerning IP addresses when sharing information. It also underscores the necessity for law enforcement leaders to ensure that any electronic communications received from others are authorized, to protect privacy under the Charter.