R. v. Bykovets: SCC Recognized Privacy Rights for IP Addresses

In R. v. Spencer^[1] the Supreme Court of Canada held that a reasonable expectation of privacy attaches to subscriber information — the name, address, and contact information — associated with an individual Internet Protocol (IP) address. In R. v. Bykovets^[2], the majority found that reasonable expectation of privacy extends to the numbers which make up an Internet protocol address even though those numbers might be changed at random by an Internet service provider.

The Facts

The Calgary City Police were investigating fraud in online liquor sales and came across a payment processor who processed the suspect transactions. The payment processor volunteered the IP addresses of the suspect transactions which the police used to get a production order from the ISP who managed the account and identified the subscribers.

Police then used the subscriber information to seek and execute search warrants for the appellant’s and his father’s residential addresses. The appellant was arrested, and convicted after a trial, and his convictions were confirmed on appeal.

Before the trial, the appellant alleged that the police’s request to the payment processor violated his right against unreasonable search and seizure under s. 8 of the Charter. S. 8 of the Charter guarantees that:

“Everyone has the right to be secure against unreasonable search or seizure.”

The key issue on the hearing at trial was whether the appellant had a reasonable expectation of privacy in his IP address.

Defence counsel submitted a forensic investigator’s expert report providing a technical summary of IP addresses and their functions. The Supreme Court noted:

“The report showed that there are internal and external IP addresses. External IP addresses are used to transfer information across the Internet from one source to another through a modem rented from the ISP. An external IP address is much like the street address of an individual’s house. Without one, a user can neither send nor receive data. A modem or router also assigns an internal IP address to each device on a local network, roughly equivalent to the individual rooms in a house.

IP addresses can also be static or dynamic. Most are dynamic, meaning that the ISP can change a user’s external IP address without notice and for any number of reasons. ISPs keep a record of which subscriber each external IP address was assigned to and for what time period.

A user’s ISP can be determined by entering their IP address into an IP lookup website. The police can then request subscriber information for the assigned IP address from the ISP, as contemplated by Spencer. That said, the expert explained that one may still take steps to determine a user’s identity, without resorting to an ISP, through the information logged on the website of a third-party company. Third-party companies, such as Google or Facebook, can track the external IP addresses of each user who visits their site and log this information to varying degrees. These companies can determine the identity of those individual users based on their Internet activity on their sites .”^[3]

The forensic expert’s view at trial was if a user can have access to the information logged by such third-party companies, “it is not necessary to obtain ISP-held subscriber information in order to accurately identify a particular internet user”.^[4]

The majority focused on the subject matter of the search to find that was not the random numbers which make up an IP address but rather the information it reveals on the identity of the internet user. In the words of the majority, the IP address is the first “digital breadcrumb”^[5] and thus the key to unlocking the user’s internet usage. The majority described the approach to privacy protection as normative, as follows:

“… our Court has applied a normative standard to reasonable expectations of privacy. We have defined s. 8 in terms of what privacy should be — in a free, democratic, and open society — balancing the individual’s right to be left alone against the community’s insistence on protection. This normative standard demands we take a broad, functional approach to the subject matter of the search and that we focus on its potential to reveal personal or biographical core information.^[6]

Thus the majority found that “Viewed normatively, an IP address is the key to unlocking a user’s Internet activity and, ultimately, their identity, such that it attracts a reasonable expectation of privacy”.^[7]

The minority was of the view that “the subject matter of this search was the IP addresses, i.e., the collections of numbers, and the identity of the ISP that is revealed by them.”^[8] Rather than see the IP address as opening a door to the exposure of personal information the minority focused on the limited information available from an IP address and that judicial authorization would provide the safeguard to the release of subscriber information.

The minority was also concerned that the recognition of an IP address as requiring court sanction would impede police investigation into internet crimes. The majority saw the investigative impact of their decision as minor.

Businesses that collect IP addresses should consider voluntarily sharing them as a warrant may now be needed for criminal investigations. Internal policies regarding the sharing of such data with the state should be updated.

Overall the Bykovets decision reinforces that additional scrutiny should be exercised whenever information is shared on the internet. It is another reason to review an organization’s information collection practices and policies.

_____________________

^[1] 2014 SCC 43, [2014] 2 S.C.R. 212.

^[2] 2024 SCC 6 (CanLII).

^[3] See R. v. Bykovets, 2024 SCC 6 at paras 19 – 21.

^[4] See R. v. Bykovets, 2024 SCC 6 at para 22.

^[5] See R. v. Bykovets, 2024 SCC 6 at para 69 citing R. v. Jones, 2017 SCC 60, [2017] 2 S.C.R. 696 at para. 42, citing S. Magotiaux, “Out of Sync: Section 8 and Technological Advancement in Supreme Court Jurisprudence” (2015), 71 S.C.L.R. (2d) 501, at p. 502.

^[6] See R. v. Bykovets, 2024 SCC 6 at para 7 citing from R. v. Marakah, 2017 SCC 59, [2017] 2 S.C.R. 608, at para. 32.

^[7] See R. v. Bykovets, 2024 SCC 6 at para 28.

^[8] See R. v. Bykovets, 2024 SCC 6 at para 140.