News
Court rules on Internet privacy interest

Saskatchewan’s highest court has ruled in two child pornography cases involving Internet Protocol (IP) address information provided to police by the Internet Service Provider (ISP). The court was divided on whether there was a reasonable expectation of privacy in IP account information.

Trapp

In R. v. Trapp, 2011 SKCA 143, an undercover police investigator monitoring peer-to-peer file-sharing on the Internet searched for child pornography images or videos. Browsing a computer’s shared folders she discovered they contained child pornography files, generated a history for the corresponding IP address and determined that the Internet ISP was SaskTel, a Crown corporation.

The investigator faxed a letter to SaskTel Security requesting any information relating to the IP address under s. 29.2 of the Freedom of Information and Protection of Privacy Act (FIPPA). SaskTel faxed Trapp’s name and account information, including his address, services he subscribed to, telephone number, e-mail address, login name, cell phone number and television programming details. Police used this to obtain his date of birth, driver’s licence number, registered vehicles and a physical description through Saskatchewan’s driver licensing and vehicle registration database (SGI).

Officers obtained a warrant to search Trapp’s residence and seized a computer from a bedroom. A forensic computer analyst examined it and confirmed there was child pornography in a shared folder. Trapp was charged with several child pornography offences.

At trial in Saskatchewan Provincial Court Trapp asked that the evidence obtained under the search warrant be excluded, submitting his s. 8 Charter rights, among others, were breached when police obtained his information. The judge concluded Trapp’s reasonable expectation of informational privacy under s. 8 wasn’t infringed because police acted in accordance with s. 29(2)(g) of FIPPA during their investigation.

Trapp was convicted of accessing, possessing and making child pornography available, sentenced to 13 months incarceration plus three years probation and given a three-year s. 161 order, a DNA order and a 20-year sex offender registry order.

Trapp appealed to the Saskatchewan Court of Appeal arguing that police required a warrant to obtain his account information (name, address and telephone number), which revealed intimate details of his lifestyle and personal choices, from SaskTel relative to the IP address it had assigned to his computer. In his view, he had a reasonable expectation of privacy while surfing the Internet and police violated s. 8 by obtaining his account information without a warrant.

The Crown, on the other hand, submitted Trapp had no reasonable expectation of privacy in his account information in these circumstances, suggesting that the subscriber data wasn’t acquired biographical information and Trapp had no subjective or objective expectation of privacy.

Search

In assessing whether a s. 8 breach occurred, courts first need to determine whether police conduct amounts to a “search.” The onus of establishing that a search occurred lies with an accused (the person invoking the protection). A search occurs if police conduct intrudes upon the person’s reasonable expectation of privacy. This will require a subjective expectation of privacy that is objectively reasonable on the totality of the circumstances.

Privacy interests include personal privacy (concerning one’s body and bodily integrity), territorial privacy (the places one occupies, such as home or workplace) and informational privacy (information about self). In cases featuring allegedly confidential and private information about a person in the hands of a third party, the totality of the circumstances includes: nature of the privacy interest asserted by the person; the precise nature of the subject matter of the alleged search; the relationship between the third party and the person; the legal framework governing disclosure of the information; the intrusiveness of the alleged search; and such other factors as may bear upon the strength or weakness of the expectation of privacy at issue. If there is no reasonable expectation of privacy there is no search.

In this case, the two member majority concluded that the police conduct constituted a search. Trapp enjoyed a reasonable expectation of privacy in the information police sought and obtained from SaskTel regarding the IP address it assigned to him. He had a subjective expectation of privacy in that information, which was objectively reasonable having regard for the totality of the circumstances. It was used to further the investigation and to obtain a warrant to search his home, seize his computer and search it for evidence.

Reasonable search

If it is established that police conduct amounts to a search, the second step is to ask whether the search was reasonable. A warrantless search is presumptively unreasonable and the Crown bears the burden of establishing reasonableness. A search will be reasonable if it is authorized by law, the law is reasonable and the search is carried out in reasonable manner.

In this case, the majority found the search was authorized by law – s. 487.014 of the Criminal Code. This provision permits a police officer, without a “production order,” to request a person voluntarily provide information about another, provided they are not prohibited by law from disclosing it. Police had reasonable and probable grounds to believe an offence was committed and that SaskTel had information affording evidence of it.

Police had every reason to believe SaskTel wasn’t prohibited by law from disclosing this information and the company voluntarily released it when asked to do so. Since Trapp never challenged the constitutionality of the section, the law itself was assumed to be reasonable. Further, the search was conducted in a reasonable manner.

Justice Ottenbreit offered a different opinion. Although assuming there was a subjective expectation of privacy in the accused’s name, address and phone number respecting his IP address, the totality of the circumstances weighed against an objective expectation. In his view, there was no reasonable expectation of privacy and, therefore, no search had occurred. Since there was no search there was no s. 8 Charter breach.

Trapp’s appeal was dismissed and his convictions upheld.

Spencer

In R. v. Spencer, 2011 SKCA 144, a police officer, using file-sharing software, discovered files containing child pornography in a shared folder and identified the computer IP Address. He determined it was assigned to Shaw Communications and requested under the Personal Information Protection and Electronic Documents Act (PIPEDA) the disclosure of customer identifying information relevant to it. Shaw provided the name, address, telephone number, account number and current billing particulars relevant to the address, which turned out to be the accused’s sister.

Using the information, police prepared and obtained a warrant to search the residence, where Spencer also resided. Officers discovered a significant quantity of child pornography – 441 distinct images and 112 videos – in a shared folder on Spencer’s computer.

At his trial in Saskatchewan Provincial Court Spencer argued that the letter police sent to Shaw requesting the IP address information amounted to an unreasonable search and seizure, violating s. 8 of the Charter, and the evidence should have been excluded. The judge found that Spencer had no reasonable expectation of privacy in the circumstances. He was convicted of possessing child pornography and making it available and appealed his conviction to the Saskatchewan Court of Appeal.

Say one

Justice Caldwell concluded that Spencer’s expectation of privacy in the IP information disclosed to police wasn’t reasonable, when viewed in the totality of the circumstances, from the perspective of a reasonable and informed person concerned about protecting privacy. In his view, the contractual terms of the agreement his sister had with Shaw, along with the statutory terms of PIPEDA, negated an expectation of privacy. Caldwell stated:

It is clear from the terms of the service agreement that (the accused’s) sister had given her express, informed consent to Shaw to disclose the disclosed information to the police in the circumstances of this case. This fact moves the scales considerably more in favour of a finding that (the accused) did not hold an objectively reasonable expectation of privacy in the disclosed information.

However, even if (the accused’s) sister had not consented to the disclosure of her personal information, in these circumstances the disclosure would have been permitted under s. 7(3)(c.1)(ii) of PIPEDA. Section 7(3) of PIPEDA supplements the basic rule prohibiting disclosure in the absence of informed consent by setting forth certain disclosure activities which are permitted without the knowledge or consent of the individual in question (paras. 38-39).

Further:

In summary, neither its contractual relationship with (the accused’s) sister, as set out in the services agreement, nor PIPEDA prohibited Shaw from disclosing the disclosed information in the circumstances of this case; rather, each clearly provided Shaw with the discretion to disclose information to the police in these exact circumstances and Shaw had (the accused’s) sister’s express, informed consent to do so. The sum of these factors militates very strongly against a finding that (the accused’s) privacy expectation was reasonable (para. 42).

Even if Spencer did hold an objectively reasonable expectation of privacy in the information, Caldwell would have found the search reasonable. It was reasonably conducted and authorized by a reasonable law. There was no s. 8 violation.

Say two

Justice Ottenbreit would have also dismissed Spencer’s appeal. He too opined there was no privacy interest in the information police obtained:

In my view, the disclosed information in this case merely establishes the identity of the contractual user of the IP address, who in this case wasn’t the accused. The potential that the disclosed information might in this case eventually reveal much about the individual and the individual’s activity is, in my view, neither here nor there.

In my respectful view, the fact that the disclosed information is of such a quality that it is capable of being used to assist in obtaining a search warrant which will lead to revealing to the police more intimate details about a person once the warrant is granted and executed, does not take it beyond what it is at this stage – simply name, address and telephone number.

Theoretically, all the assertions in an information to obtain a search warrant have the potential of revealing to the police more intimate details of a person once the search warrant is granted and executed. In this respect the disclosed information has, in my view, no different special quality than any other piece of information that the police may receive prior to the warrant which furthers their investigation (para. 110).

Say three

Justice Cameron doubted Caldwell’s assessment that the contractual or statutory terms negated an expectation of privacy but nonetheless would also have dismissed Spencer’s appeal. Even if Spencer enjoyed a reasonable expectation of privacy in the information the police sought and obtained from Shaw, the search was reasonably conducted under the authority of s. 487.014(1) of the Criminal Code.

Spencer’s conviction appeal was dismissed.