Great [Privacy] Expectations: Supreme Court Rules On Privacy Rights In IP Addresses In R. v. Bykovets

• Published date: 21 March 2024
• Law Firm: Aird & Berlis LLP
• Author: Roula Khairalla (Articling Student), Josh Suttner, Ian Aversa and Miranda Spence

Introduction

In a recent 5-4 split decision, the Supreme Court of Canada (the "Court") held that internet users have a reasonable expectation of privacy in the subject matter of their internet protocol ("IP") addresses. Accordingly, requests from government agencies to internet third parties for users' IP addresses is a "search" within the meaning of section 8 of the Canadian Charter of Rights and Freedoms¹ and may be a violation of the right against unreasonable search and seizure.

Background

The appellant in R. v. Bykovets,² Andrei Bykovets, was convicted of 14 offences related to using unauthorized credit card data to buy gift cards and possessing material related to credit card fraud.³

In its investigation of allegedly fraudulent online purchases from a liquor store, the Calgary Police Service (the "Police") contacted Moneris, a third-party payment processing company, to obtain the IP addresses used for certain transactions, which Moneris voluntarily provided.⁴ The Police then obtained production orders compelling the internet service providers ("ISPs") identified through the IP addresses to disclose subscriber information, thereby identifying Bykovets.⁵

At trial, the Court of the Queen's Bench of Alberta held that the Police's request to Moneris was not a search within the meaning of section 8 of the Charter because Bykovets did not have a reasonable expectation of privacy in his IP address.⁶ The Court of Appeal of Alberta upheld the trial judge's finding, holding that an IP address, standing alone, reveals nothing of a person's "core biographical information" and therefore does not give rise to a reasonable expectation of privacy.⁷

There Is a Reasonable Expectation of Privacy in an IP Address

Justice Karakatsanis, writing for the majority of the Court, concluded that there is a reasonable expectation of privacy in an IP address. A request by the state for an IP address, without judicial authorization through a warrant, therefore constitutes a search that violates Canadians' section 8 rights.⁸

To establish a section 8 violation, a claimant must demonstrate that: (1) there was a search or a seizure; and (2) the search or seizure was unreasonable.⁹ At issue in this case was the definition of a search, which occurs where the state invades an individual's reasonable expectation of privacy.¹⁰ An expectation of privacy is reasonable where the public's interest in being left alone outweighs the government's interest in intruding on the individual's privacy...