Supreme Court Of Canada Rules IP Addresses Attract A Reasonable Expectation Of Privacy

• Published date: 14 March 2024
• Law Firm: McCarthy Tétrault LLP
• Author: TechLex Blog, Daniel Glover, Andrew Matheson, Barry Sookman, Connor Bildfell, Greer Hope, Natalie Kolos and Nico Rullmann (Summer Student)

In a 5:4 split, a majority of the Supreme Court of Canada recently held in R. v. Bykovets that internet protocol ("IP") addresses¹ attract a reasonable expectation of privacy protected by section 8 of the Charter. This decision will have practical implications for law enforcement authorities who will need prior judicial authorization before requesting IP addresses and for private organizations such as internet service providers, search engines, generative AI providers, and online advertising companies if the majority's reasons also influence the development and interpretation of Canadian privacy laws. The decision could be especially impactful on the interpretation of PIPEDA and the amendments proposed in Bill C-27 to enact the Consumer Privacy Protection Act (CPPA).

Facts

The case involved a police investigation into fraudulent online purchases from a liquor store. Prior to seeking a production order under the Criminal Code, police contacted the store's third-party payment processing company to ask for the IP addresses used for the alleged fraudulent transactions, which the company voluntarily provided. Police then used the IP addresses to obtain a "Spencer warrant", i.e., a court order, compelling Mr. Bykovets' internet service provider to disclose the subscriber information'name and residential address'associated with the IP addresses and executed a search warrant for Mr. Bykovets and his father.

At trial, Mr. Bykovets argued unsuccessfully that the police's request for IP addresses from the third-party payment processing company violated his right against unreasonable search and seizure under section 8 of the Charter. The Alberta Court of Appeal upheld the trial court's decision and held that section 8 did not apply because an IP address alone does not provide any information about a person's lifestyle or core biographical information, and therefore Mr. Bykovets had no reasonable expectation of privacy in the IP address.

The Majority's Decision

The issue on appeal before the Supreme Court was whether the request for the IP addresses was a "search".² A search occurs where the state invades a "reasonable expectation of privacy".

A 5:4 majority of the Supreme Court overturned the Court of Appeal's decision and held that Mr. Bykovets had a reasonable expectation of privacy in his IP addresses and therefore the police violated section 8 by obtaining his IP address without prior judicial authorization.

The majority analyzed whether IP addresses attract a reasonable expectation of privacy by considering both (1) the subject matter of the search (i.e., the nature of an IP address); and (2) whether Mr. Bykovets' expectation of privacy in that subject matter was objectively reasonable.

Addressing the question of whether there is a reasonable expectation of privacy in an IP address, the Supreme Court emphasized that Section 8 protects...