In May I blogged that the 2012 decision of the Court of Appeal for Ontario in R. v. Ward provided a good explanation of how police services could obtain information from Internet Service Providers (ISPs) about their customers without the need of a warrant or other court order.  No need to read that now. On June 13 the Supreme Court in R. v. Spencer effectively reversed Ward, finding that an Internet customer had a reasonable expectation of privacy in relation to information in the possession of an ISP, specifically his name, address and contact number, meaning that, absent a warrant or court order, this information could not be disclosed to police.

Just as in Ward, the facts in Spencer related to a police request for information from an ISP in the context of an investigation into child pornography offences.  Having identified that a personal computer was connected to a specific Internet site which at the time hosted child pornographic images, the police requested the customer’s name, address and telephone number from the ISP which it required in order to obtain a search warrant authorizing the search of the address and the seizure of the personal computer.  Unlike in Ward, however, the Court in Spencer decided that the accused, in light of all of the circumstances, had a reasonable expectation of privacy in the requested information, meaning that the police required a warrant or court order.

What is important about Spencer is how, within the context of Internet use and access, the Court determined the accused had a reasonable expectation of privacy in the requested information that was protected by section 8 of the Charter. The Court found that the request was really for more than a name, address and contact number in that it was intended to link a specific person to specific online activities.  It therefore engaged the anonymity aspect of the informational privacy interest. Note that in both Ward and Spencer the Courts are in agreement that you have to look beyond the obvious detail of what has been requested and determine whether the subject matter has the potential to reveal the user’s personal or lifestyle choices. In Ward, however, the Court concluded that the requested information was really just a snapshot that could not reveal anything about the accused’s biographical core.  In Spencer, the Supreme Court effectively disagreed , finding that informational privacy contains a component of anonymity.

The Court also found that, read in its entirety, the Personal Information Protection and Electronic Documents Act (PIPEDA) does not erode an individual’s reasonable expectation that his/her personal information will be not be disclosed to the police when requested. This finding conflicts with Ward. In it the court held that, at least in the context of a child pornography investigation,  the provisions of PIPEDA were a factor which weighed against finding a reasonable expectation of privacy in subscriber information:  (1) because ISPs have a legitimate interest in assisting in law enforcement relating to crimes committed using its services; and, (2) because of the grave nature of child pornography offences, which made it reasonable to expect that an ISP would cooperate with a police investigation.In Spencer, the Court found that while these factors were relevant from a policy perspective, they could not override what it found was the clear statutory language of the PIPEDA to the contrary.

Another important issue addressed in Spencer is the role contractual information can play in diminishing the customer’s reasonable expectation of privacy. In Ward the Court concluded that the agreement between the ISP and the customer provided notice of the potential for disclosure without a warrant and was therefore a factor supporting it. In Spencer, the Supreme Court found that the service agreement contained a provision that indicated that disclosure could occur in response to a law enforcement request, but the relevant provision conflicted with the ISP’s privacy policy that provided otherwise. The agreement was therefore confusing and did not diminish the accused’s reasonable expectation that, absent a warrant or court order, his information was protected from disclosure.

Note that in Spencer the Court did not say that the customer cannot contract out of its reasonable privacy expectations with the ISP.  The Court reiterated that the contractual information is but one part of the totality of the circumstances that must be considered when weighing the reasonableness of a privacy expectation. To have the intended effect, however, presumably the contractual language must be clear, unequivocal and specific to the types of disclosures that are “permitted”.

Here is a link to the decision in Spencer.