R. v. Bykovets: A review of Section 8 of the Charter and its protection of the Internet Protocol from unreasonable search

The Supreme Court of Canada recently decided an appeal in R. v. Bykovets[1] from the Court of Appeal of Alberta, on a 5-4 split judgment with the majority stating that Section 8 of the Charter protects the Internet Protocol from unreasonable search. This would require the police authorities to obtain prior judicial authorization before acquiring a person's IP address. The Supreme Court decided that a person's IP address attracted a reasonable expectation of privacy regardless of it is an external or internal IP. The majority stated that IP addresses are not a random collection of numbers but can provide personal information like location and online activity, as third-party providers have a profile on these IP addresses and is the first digital breadcrumb[2].

Facts

Andrei Bykovets/Appellant had been convicted of 14 offences for using unauthorized credit card data to buy gift cards online, using those gift cards to make purchases in store, and possessing material related to credit card fraud[3]. Calgary Police Service investigated fraudulent online purchases from a liquor store, identifying two IP addresses managed by Moneris. Police contacted Moneris to obtain the IP addresses used for the transactions, and Moneris voluntarily identified two.  They obtained a production order for each IP address as required by R v. Spencer[4], one registered to the appellant and the other to his father. Police used this information to execute search warrants, arrest the appellant, and confirm his convictions[5].

Andrei Bykovets stated that the request of the IP address from Moneris was a contravention of his rights under Section 8 of the Charter.

Decision by  Court of Queen’s Bench of Alberta

The Trial Court decided that the reasonable expectation of privacy was not available to the Appellant. In Applying the principle of R v Tessling[6] Totality of the circumstances test the court opined The subject matter of the alleged search since the external IP address did not on its own reveal any information, The IP addresses were used by the CPS to subsequently seek subscriber information from the ISP, which was done by obtaining judicial pre-authorization.[7]

Decision by Court of Appeal of Alberta

The Court of Appeal agreed with the decision of the Trial Judge stating that the IP address on its own did not reveal any information[8] and hence had no reasonable expectation of privacy.

Analysis

The Supreme Court disagreed with the narrow approach taken by the earlier courts and stated that the approach to privacy has to have a broad approach[9]. The Supreme Court considered a number of factors enumerated below to state that even an external IP address could be used to ascertain key personal information about an individual:

1. Subject matter of the information

The Supreme Court majority view stated that the IP address is in itself not of interest to the Police but rather the information that flows from it and the information received from the IP address can be personal[10] stating that this might not extend to all investigative steps but any innocent information also revealed must be examined with the personal interest at stake[11].

2. Was the Expectation of Privacy Reasonable?

The Supreme Court took into view three aspects while deciding this:

1.  Control Over the Subject Matter

Based on Jones[12] the majority stated that the control can be exercised even while revealing it to a few people and people are not asked to be digital recluses in order to protect their privacy[13] and further stated that in the informational privacy context control is not determinative[14].

2. The Place of the Search

Stating that the lack of physical intrusion would not be a viable argument, as the internet is a wide space and this principle was developed for physical spaces and the digital space does not fall within the said framework.[15]

3. The Private Nature of the Subject Matter

Defining the “Biographical Core” as not limited to identity but also “include[s] information which tends to reveal intimate details of the lifestyle and personal choices of the individual”[16] Baseing their view on these points the Supreme Court stated that firstly. activity associated with an IP address, like financial transactions, reveals personal details. Purchases can expose habits, preferences, and even health concerns. Without protection, websites visited, including adult content or political forums, are freely accessible. Unprotected IP addresses jeopardize privacy, regardless of criminal investigation relevance[17]. Secondly, the IP address reveals the search associated with it, and third parties like Google, Facebook and YouTube also keep track of IP addresses that visit their sites which can betray a person's online activities which they might want to keep anonymous[18]. Finally, a piece-by-piece information collection can help ascertain the identity of the person, leading to an electronic roadmap[19].  

3.  Does the Balance Weigh in Favour of a Reasonable Expectation of Privacy?

Stating that the IP address allow the stae to get deep personal information about a person from their IP address and allows an avenue to identify the person through their IP address and due to this the public interest in being left alone take precedence over the burden of law enforcement in getting a warrant[20]

Hence, the Majority view stated that the risk posed by the information that could be gathered from an IP address even though external is detrimental to a person's privacy. At the same time stating that the extra step would not seriously handicap the investigative procedure of the Police Department.

Dissenting view

The Dissenting view stated that the IP address being external severely limited the information that could be gathered about a person and their identity or their “Biographical core”[21]. The Dissent also stated that this was fact-based case wherein the Police had used the IP address to further investigation and not jump to identifying the individual. Hence, the judgement on a social point was not the issue here and it had to be looked at from the point of view of the facts of the case[22].

Conclusion

The Judgement does deal with a social issue which is very important from the perspective of an individual's privacy and their right to be left alone. It also sets the standard to be followed by the State when dealing with the personal information of an individual in Canada. The Judgement does set up an extra step but with the changing scenario and the presence of data on the internet of individuals, it would help to safeguard the personal information of the people from unnecessary government scrutiny and prosecution.

Any article or other information or content expressed or made available in this Section is that of the respective author(s) and not of the OBA.