Supreme Court of Canada Rules on the Reasonable Expectation of Privacy Attached to an IP Address

In a decision released on March 1, 2024, the Supreme Court of Canada stated that an IP address, by its nature, creates a reasonable expectation of privacy.^[1]Canada’s highest court has ruled that a request by police to obtain an IP address from an Internet service provider constitutes a search protected by the Canadian Charter of Rights and Freedoms^[2] (hereafter the “Charter”) and must therefore be subject to prior judicial authorization. The Court reached its decision with a majority of only five judges. This close verdict demonstrates that this is a matter of interest that will generate further debate over the next years.

In order to better understand this Supreme Court ruling, we need to examine the focal point of this case, namely an IP address.

An IP address is a unique identification number for an Internet-connected activity, enabling information to be transferred online from one source to another. The IP address is required to access the Internet: it identifies the source of online activity and links the activity in question to a given physical location. This makes it possible to obtain certain information about a subscriber linked to a specific IP address.

Background

During an investigation into fraudulent online purchases from a liquor store, the Calgary Police Service contacted the payment processing company responsible for managing that store’s online sales (hereinafter the “Company”) to obtain the IP addresses used in the suspicious transactions. When the police requested the information from the Company, they had not obtained a search warrant. The Company voluntarily identified and provided two IP addresses to the police.

The police subsequently obtained a court order compelling the Internet service providers linked to these IP addresses to disclose the names and residential addresses of the customers associated with those IP addresses.

The appellant, who was convicted after trial and whose convictions were upheld on appeal, challenged the police request to obtain IP addresses from the Company on the basis that such a request interferes with the protection against unreasonable search or seizure under section 8 of the Charter.^[3]

Both the trial court and the Alberta Court of Appeal rejected this argument, finding that there is no reasonable expectation of privacy in an IP address. The Supreme Court agreed to hear the appeal.

SCC’s Decision

The right to be secure against unreasonable search or seizure is meant to protect the privacy of individuals by prohibiting unjustified state intrusions. This protection is “vital to individual dignity, autonomy and personal growth.”^[4]

A reasonable expectation of privacy is considered based on four main factors: (1) the subject matter of the search; (2) the claimant’s interest in the subject matter; (3) the claimant's subjective expectation of privacy; and (4) whether that subjective expectation of privacy was objectively reasonable.^[5] In its decision, the Supreme Court considered primarily the first and fourth factors with regard to an IP address.

With respect to the subject matter of the search, it is defined in terms of the information itself and the tendency of information sought to support inferences in relation to other personal information. The Court stresses the importance of adopting an approach that takes into account the technological reality , and describes an IP address as the “key” to obtaining more information about an Internet user, including their identity, lifestyle and personal choices.^[6]

The Court concluded that it is objectively reasonable to expect privacy on the Internet, even if the location searched in this case is “qualitatively different” from physical spaces.^[7] The Court relied on the fact that the Internet is an endless universe of data that is far more revealing than a physical location, both by the nature and quantity of the information present.

The Court recognized that the Internet has “altered the topography of privacy under the Charter” by adding “a third party to the constitutional ecosystem, making the horizontal relationship between the individual and the state tripartite.”^[8]While section 8 does not apply to third parties themselves, such as the Company or Internet service providers, “they mediat[e] a relationship which is directly governed by the Charter — that between the defendant and police.”^[9] These third parties make it easier for the government to obtain certain information.

Underscoring the crucial nature of the IP address as a link between an Internet user and their online activities, the Court stated that Canadians should expect this information to be disclosed to the State only on a constitutionally valid basis.^[10]

Finally, the Court concluded that the expectation of privacy is reasonable and is assessed on the basis of all the information that an IP address can reveal.

Conclusion

The Court therefore declared that an IP address is indeed covered by the right to privacy protected under the Charter. It therefore set aside the conviction and ordered a new trial.

The Court clarified that recognition of reasonable expectation of privacy in an IP address does not impede police investigations. The additional burden on them “pales compared to the substantial privacy concerns implicated in this case.”^[11]

This decision demonstrates the evolving nature of case law regarding the protection under section 8 of the Charter. With the “ever-increasing intrusion of the Internet into our private lives,”^[12]courts must address these issues with an approach that considers today's technological reality with an awareness of its impact.

Key Takeaways for Third Parties with Access to Canadians’ IP addresses

• Third parties, such as Internet service providers, can respond to law enforcement requests and voluntarily provide an IP address linked to certain online activities, without coming under the scope of the Charter. However, organizations should still be mindful of any internal policies and contractual obligations they may have with respect to privacy and disclosure of such information.
• On the other hand, a state request for an IP address is a search;
• Law enforcement agencies must therefore first obtain a production order for a suspicious IP address; otherwise obtaining the IP address could be considered a search in violation of section 8 of the Charter.