The Supreme Court of Canada ruled 5-4 on Friday that Canada’s Constitution protects Canadians’ internet protocol (IP) addresses from unreasonable search. The police are required to obtain prior judicial authorization before obtaining an IP address for criminal investigations, provided by Section 8 of the Canadian Charter of Rights and Freedoms.
Writing for the majority, Justice Karakatsanis reasoned that IP addresses must be protected if Canadians’ online privacy is to be protected meaningfully by the charter. An internet user’s identity and activities could be viewed with their IP address. Therefore, Canadians’ IP addresses attract a reasonable expectation of privacy and are therefore constitutionally protected from unreasonable search.
In terms of the subject matter, the dissenting opinion, penned by Justice Côté, argued that the majority had unnecessarily expanded what IP addresses could reveal. The dissent believed that the subject matter is simply the IP addresses and the internet service providers revealed. IP addresses alone could not reveal the ultimate identification of the suspect and therefore afford no reasonable expectation of privacy.
The dissent also questioned how IP addresses can hardly be considered a private matter because the claimant has little control over them. The majority addressed that the traditional approach to assessing whether a Canadian has an objectively reasonable expectation of privacy over a subject is highly dependent on control over the subject matter, the place of the search and the private nature of the subject matter. However, it is also the majority’s opinion that these factors are not determinative in online spaces. If the traditional approach is to be adopted, the lack of physical intrusion would render the informational privacy of Canadians unprotected unless they become digital recluses.
The majority also observed that the internet has allowed private corporations to collect their users’ information and build profiles. It augments the state’s surveillance power. Judicial oversight is therefore essential, but not onerous, to narrow the state’s online reach and ensure that the decision to disclose information is consistent with the Charter.
The claimant in this case asserted that the police violated their constitutional rights by obtaining their IP addresses from the processing company without judicial authorisation. The police sought and executed search warrants by compelling the internet service provider to disclose the claimant’s name and address for each IP address.
Similarly, Article 8 of the European Convention on Human Rights protects the right to private and family life. In 2018, the European Court of Justice was similarly tasked with considering whether IP addresses constitute personal data in Benedik v Slovenia. The court ruled that the legal provision used by the police to obtain the subscriber information associated with the dynamic IP address is subject to the Convention’s scrutiny. In that case, the court further held that the relevant laws violated the Convention by providing no protection to arbitrary interference and abuse of the police power.
