Supreme Court Rules That Private Companies Cannot Disclose IP Addresses To Law Enforcement Without A Warrant Due To Their "Deeply Personal" Nature

• Published date: 04 April 2024
• Subject Matter: Media, Telecoms, IT, Entertainment, Privacy, IT and Internet, Privacy Protection
• Law Firm: Torys LLP
• Author: Ms Mavra Choudhry, Nic Wall, Andrew Bernstein and Molly Reynolds

In R v. Bykovets¹, the Supreme Court of Canada ruled that a criminal accused's Charter rights against unreasonable search and seizure were violated when law enforcement obtained his IP address without prior judicial authorization (i.e., a warrant) because the accused had a reasonable expectation of privacy in his IP address information.

What you need to know

• The Supreme Court held that IP addresses can easily reveal deeply personal information about individuals, which can include both their identity and a related trove of intensely private information contained in or inferable from their Internet activity.
• Due to this reasonable expectation of privacy, law enforcement collecting IP address information from private organizations without judicial pre-authorization constitutes a violation of section 8 of the Charter, which protects against unreasonable search and seizure.
• Private organizations should note that voluntarily disclosing IP addresses and other Internet activity-related information to law enforcement may result in increased privacy-related risk following this decision. The decision may also influence the views of privacy regulators regarding the sensitivity of IP addresses and analogous data, which could, in turn, heighten the privacy law requirements applicable to such information.

The decision

Background and ruling

The Bykovets case concerned a police investigation into fraudulent online purchases from a liquor store. During the course of the investigation, police obtained the IP address linked to the purchases from a private payment processing company, Moneris, used by the store. The accused, the appellant in this case, was convicted at trial, and his convictions were confirmed on appeal.

The appellant claimed both at trial and at appeal that his right against unreasonable search and seizure (protected by section 8 of the Charter) was violated when police obtained the IP addresses from Moneris. A violation of section 8 can only be found in this context if law enforcement interfered with the individual's reasonable expectation of privacy in what was searched or seized. Here, both lower courts found that the appellant did not have a reasonable expectation of privacy in his IP address information, and so his section 8 rights were neither engaged nor violated.

In a 5-4 split, the Supreme Court deviated from the lower courts' decisions and ruled that an individual's IP address information does, in fact, have "deeply personal" characteristics when...