On Friday, June 13, 2014, the Supreme Court of Canada issued a landmark decision (R v Spencer) upsetting a common interpretation of a provision of the Personal Information Protection and Electronic Documents Act (PIPEDA) that had been relied upon for many years as permitting pre-warrant disclosures of subscriber information by Internet Service Providers and other organizations in response to police requests.
The provision at issue was paragraph 7(3)(c.1) of PIPEDA, which provides that an organization may disclose personal information without the knowledge or consent of the individual if (a) the government institution (which includes law enforcement) has made a request for the information, (b) the government institution has identified its lawful authority, and (c) the disclosure falls within one of the following specified categories:
7(3) [...] an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is
(c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that
(i) it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs,
(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or
(iii) the disclosure is requested for the purpose of administering any law of Canada or a province;
The court concluded that the determination of whether law enforcement has lawful authority to request information without a production order or warrant depends on an analysis of whether the individual whose personal information is at issue has a reasonable expectation of privacy in that information. If the individual has a reasonable expectation of privacy in the information, law enforcement would (under current provisions of the Criminal Code) require a production order or warrant to obtain access to the information. If there is no reasonable expectation of privacy in the information, the information could be disclosed without a production order or warrant.
In coming to this conclusion, the court expressly rejected a common interpretation of paragraph 7(3)(c.1) of PIPEDA. Under that interpretation, lawful authority was law enforcement’s bona fide investigation of an offence. An organization could lawfully provide information in response to such a request. Instead, the court has affirmed that the analysis must begin with an understanding of whether there is a reasonable expectation of privacy in the information at issue. The fact that PIPEDA may permit disclosure without an order or warrant if there is no reasonable expectation of privacy is not relevant to determining whether there is a reasonable expectation of privacy in the first place.
Although the case involved access to subscriber records based on an IP address, the court’s ruling has broad implications for any organization that receives a police request for information that is not accompanied by a production order or warrant. Whether the current state of the law will remain for long is uncertain. Given the overall government agenda in Bill C-13, which is currently before Parliament, to expand the investigatory tool kit of policy, one might expect to see some dialogue between Parliament and the court on this issue.