Spencer, PIPEDA & Lawful Authority

A busy practice combined with a very bad shoulder injury will, regretfully, move blogging down the priority list. As we reach mid-2014 there have been a few interesting privacy law developments this year but, in my view, no real “blockbusters”. That all changed today. Today, the Supreme Court of Canada (SCC) came out with R v. Spencer. Digesting the decision like this takes time but, in a first read, what it says about lawful authority should make every private sector organization pause and re-examine its policy on cooperation with law enforcement.

Spencer is a case involving access and storage of child pornography through an Internet file-sharing program. The police identified the Internet Protocol (IP) address of a computer and then obtained the subscriber information associated with that IP address from the Internet Service Provider (ISP). This was done without prior judicial authorization and identified Mr. Spencer. The subscriber information was used in support of the “Information to Obtain”, which led to the issuance of a warrant to search Ms. Spencer’s home. Following the search, Mr. Spencer was charged and convicted of possession of child pornography. A charge of “making available” was dismissed.

Spencer claimed that obtaining subscriber information through the use of the IP address was an unconstitutional search and that the evidence obtained as a result of this identification should be excluded. The trial judge concluded that there was no Charter violation — there had been no breach of Mr. Spencer’s right to be secure against unreasonable searches and seizures.

Upon appeal, the Court of Appeal upheld the conviction and agreed with the trial judge that obtaining the subscriber information was not a search and even if it was, it would have been a reasonable search. The Court also ordered a new trial on the “making available” charge, ruling that the trial judge had erred.

With a further appeal, with respect to Mr. Spencer, the SCC agreed that the trial judge did err on the “making available” charge. As for the “possession” charge, the court concluded that there had been a s. 8 violation but, pursuant to s. 24, the evidence should not be excluded. What is more significant — from a broader privacy perspective — is that the court found that obtaining the subscriber information from the ISP through the IP address was an unauthorized search. What I think is the more interesting aspect of the decision revolve around “lawful authority”. As those versed in the Personal Information Protection and Electronic Documents Act (PIPEDA) know, exceptions to the rule of “no disclosure without consent” reside in the provisions of s. 7(3), one of which is:

“(c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that

(i) it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs,

(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or

(iii) the disclosure is requested for the purpose of administering any law of Canada or a province;”

Until this decision, what constitutes “lawful authority” has been left to regulators, practitioners and organizations to divine. Its often been considered “ok” for police to ask provided that the “government institution” had some legal authority to collect the information. With the police, this would arguably be authority under various Police Acts that provide a general law enforcement role. This then left it to organizations to decide how they wanted to treat requests for information – whether or not to say to the police to provide a search warrant. If information was voluntarily provided, at some point if things got serious, the police, with one eye on the suspect’s Charter rights, would seek a search warrant.

This case changes the status quo. In paragraph 71, Mr. Justice Cromwell states:

“The reference to “lawful authority” in s. 7(3)(c.1)(ii) must mean something other than a “subpoena or [search] warrant”. “Lawful authority” may include several things. It may refer to the common law authority of the police to ask questions relating to matters that are not subject to a reasonable expectation of privacy. It may refer to the authority of police to conduct warrantless searches under exigent circumstances or where authorized by a reasonable law: Collins. As the intervener the Privacy Commissioner of Canada submitted, interpreting “lawful authority” as requiring more than a bare request by law enforcement gives this term a meaningful role to play in the context of s. 7(3) and should be preferred over alternative meanings that do not do so.”

It would therefore appear that police requests for information — unless in exigent circumstances or under a reasonable law or where there is no reasonable expectation of privacy — constitutes a search, requiring a warrant. While the police will no doubt adapt to this change in the law of search and seizure, this legal development should make every organization subject to PIPEDA pause to review and, if necessary, refine their corporate policy on law enforcement cooperation. Disclosures in the wrong circumstances may well result in a PIPEDA violation.

Now in this case, there were no exigent circumstances and no applicable law providing specific authority to request information. That means the court found a reasonable expectation of privacy in Spencer’s IP address. More on this aspect in the next blog post.