On March 1, 2024, the Supreme Court of Canada released its decision in R v Bykovets, finding that IP addresses attract a reasonable expectation of privacy. Accordingly, corporations should take note that they have no legal obligation to provide the IP addresses of any customer to the police without a proper warrant.
An IP address is a unique alphanumeric identification number that identifies the source of every online activity and connects that activity to a specific location.
In this decision, the Calgary Police Service were investigating fraudulent online purchases from a liquor store. During the course of this investigation, the police contacted the third-party payment processing company, Moneris, and requested the IP addresses of the subscribers who had made the fraudulent purchases. Moneris provided the IP address information and police were able to identify Bykovets by obtaining a production order against the telecommunications provider for the names and addresses of subscribers.
The suspect, Bykovets, brought a Charter claim under section 8 which provides a right against unreasonable search and seizure. To claim protection under section 8 of the Charter, the claimant must identify the subject matter of the search, have a direct interest in the subject matter, and demonstrate that the applicant had a subjective and objective reasonable expectation of privacy in the subject matter.
Both the Alberta Court of the Queen’s Bench and the Alberta Court of Appeal determined that the police’s request to Moneris did not amount to a search under section 8 of the Charter because there was no reasonable expectation of privacy in an Internet user’s IP address as IP addresses alone do not reveal information about a person’s lifestyle or core biographical information. Justice Veldhuis of the Alberta Court of Appeal dissented, noting that the police force was not seeking only the IP address but rather the information the IP address could reveal about the specific Internet user. Mr. Bykovets appealed to the SCC.
SCC Decision
The SCC reversed the trial and appellate decision, agreeing with Justice Veldhuis’ dissent. In doing so, the Court called an IP address “the key that can lead the state through the maze of a user’s Internet activity,” and “the first digital breadcrumb that can lead the state on the trail of an individual’s Internet activity.” As well, the Court emphasized the need to examine the user’s expectation of privacy “in relation to all the information this IP address ‘tends to reveal.’”
In particular, the Court found an IP address is not just an abstract string of numbers that is used to obtain a production warrant against an Internet service provider but rather, it shares personal information about the user including their specific location, as well as a range of highly personal online activities, such as purchases, destinations the user visits, or political preferences. This information is not protected by a Spencer warrant (a warrant that police must obtain before asking an Internet service provider to identify a specific user associated with an IP address). Among other factors, the Court also emphasized that the burden of obtaining a warrant for accessing IP addresses was not onerous. Section 8 protection simply protects against police accessing a user’s online activities unrelated to the investigation.
Justice Côté dissented from the decision, stating that the subject matter of the search was the IP address and the identity of their associated Internet service provider, not the identity of the Internet user linked to the particular IP address. In addition, Justice Côté stated that IP addresses were not private nor did they reveal any private information, and that IP addresses must be combined with other information in order to provide any sensitive and personal information. Justice Côté cautioned that the section 8 analysis was contextual, and she was not foreclosing the possibility of someone having a reasonable expectation of privacy in IP addresses based on different facts.
This decision constrains the government’s surveillance powers in an increasingly digital world. It may come as a comfort to individuals that as their Internet activities are increasingly being tracked in ways they may not be aware by private entities, this information cannot be obtained by the police without a warrant. Internet service providers and other businesses should be aware that they have no legal obligation to provide the IP addresses of any customer to the police without the police first obtaining a proper warrant.
Should you have any further questions or concerns, please feel free to reach out to a member of Miller Thomson’s Privacy, Data Protection and Cybersecurity team.
