The Canadian Supreme Court Just Stood up For Online Privacy Rights

In a unanimous decision, Canada's top court found that requesting Canadians' personal information from telecommunications companies in order to obtain a search warrant is unconstitutional. The ruling, released today, can only be seen as a stiff rebuke to the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

That has huge implications for the Conservatives' two controversial bills that would have allowed private corporations to pass on your private information to law enforcement without a warrant. Thanks to the SCOC, when the bills finally passed through the Conservative controlled Parliament, their most expansive powers will be dead on arrival.

The court found that while police do have some established power to request this information, and while the telecommunications company has some ability to disclose it, the information must be obtained by judicial authorization if police expect to use it in a trial.

In other words, getting a user’s information by having an informal chat with Shaw, Bell, or Rogers is a no-go. The ruling also promises to put a chill on both law enforcement and Internet Service Providers (ISPs), which will likely end the practise of voluntary disclosure for good.

"The impact here was serious…anonymity is an important safeguard for privacy interests online,” wrote Tory appointed Justice Thomas Cromwell.

Given the Prime Minister’s blood feud with the Supreme Court—specifically Chief Justin Beverley McLachlin who was appointed by Liberal PM Jean Chrétien, the fact that this ruling was written by one of his own appointees must be particularly stinging.

The case was centred around the 2007 arrest of Matthew Spencer. The Saskatoon resident's home was raided by police after his IP address was linked to the downloading and sharing of child pornography. Police had pulled his address after making a request, under PIPEDA, to Shaw, his ISP.

During trial, Spencer's lawyers made the case that their client had a reasonable expectation of privacy and that police did not have lawful authority to request his identifying information.

The two big caveats in the ruling is that police will still have the power to request this information in exigent circumstances—like bomb threats and missing children—and that, if the ISP discovers criminal activity of their own accord, they can offer it unilaterally to police.

But otherwise, the ruling is quite clear: requesting this data constitutes a search, and if you want to conduct a search, you need to get a warrant.

“PIPEDA prohibits disclosure of the information unless the requirements of the law enforcement provisions are met, including that the government institution discloses a lawful authority to obtain, not simply to ask for the information,” Cromwell wrote.

The Tories’ cyberbullying bill, C-13, would have expanded police power to make these sort of requests, providing broad civil and criminal immunity to telecommunications companies that share this data. Under C-13 everyone from fisheries officers to mayors can request the data. But now those powers are now effectively moot, making the Harper Government’s effort to strong-arm the bill past opposition all for naught.

The ruling also has implications for S-4, the Digital Privacy Act, which will expand Section 7 of PIPEDA—the section that the Supreme Court pulled apart today—in allowing corporations to share users’ personal data in the context of a contract breach. While the Court didn’t pronounce itself on that section, it will almost certainly make corporations reticent to take advantage of the changes, given the Court’s newfound love for strict privacy rights.

Neither bill is unconstitutional, per se. The new powers found in C-13 could still apply in the narrow circumstances laid out by the court, but it would be otherwise useless. S-4, however, could be wide open to challenge.

The court’s decision to torch police powers comes amidst renewed attention to privacy and surveillance issues in Canada. It was revealed by interim Privacy Commissioner Chantal Bernier last month that these sort of voluntary disclosure requests from police are used a staggering amount: easily more than a million times per year. After today, that tap will be turned off.

The ruling came as a huge surprise, as many of the lower courts had found that basic subscriber information like name, address and phone number of users on the basis of an IP address—does not constitute personal information, and therefore could be shared with police without a warrant.

However, Motherboard revealed in May that requests often go far beyond that basic information, to include users’ passwords, call records and much more. Those should all stop, following this ruling. The RCMP will be particularly frustrated by this decision, as they were one of the biggest beneficiaries from this judicial workaround.

Documents obtained under Access to Information request revealed that the federal police service not only used the voluntary disclosure provision to obtain users’ personal data, but that they impose heavy gag orders in doing so, ensuring that ISPs would never speak about the process.

“The information requested and the existence of this query should not be further disseminated or divulged outside the purpose for which it is required of you, as doing so could seriously compromise an ongoing criminal investigation. Failure to maintain the confidentiality of this request may be constructed as obstructing, perverting or derating the course of justice, possible resulting in criminal sanctions,” reads one RCMP template letter, which presumably is no longer valid.

Reaction to the decision came pretty quickly. OpenMedia Executive Director Steve Anderson said in a press release that the "historic decision" will protect Canadians' privacy.

"All along we’ve said the government’s online spying Bill C-13 is reckless and irresponsible and today’s ruling vindicates those concerns. Now the government will finally have to take heed and withdraw their extreme spying provisions from their bill," he said.

Both OpenMedia and Privacy expert Michael Geist underlined that all of the case law the Tories trotted out to defend C-13 has been declared effectively null.

Spencer’s story isn’t over yet, though. The court found that the police acted in good faith in requesting his information, given that it had been upheld by numerous lower courts, and therefore allowed proceedings against him to continue. He faces a new trial on the count of whether he made child pornography available to others.

But while Spencer might still be screwed, today’s ruling represents one of the most important enhancements for Canadians’ privacy to come down since PIPEDA was passed.