Written By Robert Staley, Cheryl Woodin, Sébastien Gittens and Doug Fenton

In a first-of-its-kind decision, R. v. Bykovets, 2024 SCC 6 (Bykovets), the Supreme Court of Canada has adopted a broad view of internet privacy—at least in the criminal and public authority context—finding that internet protocol (IP) addresses attract a reasonable expectation of privacy protected by section 8 of the Canadian Charter of Rights and Freedoms (the Charter). Section 8 guarantees Canadians the "right to be secure against unreasonable search and seizure." Section 8 of the Charter does not typically apply in disputes between private individuals and requires a degree of government or public authority involvement. Until this point, only subscriber information associated with a particular IP address had attracted a reasonable expectation of privacy. Bykovets now conclusively resolves the debate as to whether an expectation of privacy exists in the IP address itself.

Bykovets has important implications for private organizations that regularly respond to requests for production of information from law enforcement or regulatory authorities. In general, law enforcement authorities will need to seek prior judicial authorization before requesting IP addresses. Bykovets also reflects a broader conceptualization of online privacy which will shape the development of Canadian privacy laws going forward.

The Facts and Background

In 2017, the Calgary Police Services investigated fraudulent online purchases from a liquor store. The police contacted Moneris, the third-party processing company that managed the store's online sales. Moneris voluntarily provided the IP addresses associated with the fraudulent transactions.

The police then obtained a production order compelling the Internet service provider of the IP addresses to disclose the subscriber information associated with them. The police then used the IP addresses to obtain a "Spencer warrant"—i.e., a court order—compelling the internet service provider to disclose the subscriber information (name and residential address) associated with the IP addresses, and subsequently executed a search warrant for Mr. Bykovets and his father.

At trial, Mr. Bykovets argued that the police's request for the IP addresses from Moneris violated his right against unreasonable search and seizure under section 8 of the Charter. The trial judge found that there was no "reasonable expectation" of privacy in the IP addresses because "IP addresses do not provide a link to, or any other information about, an Internet user." The majority of the Court of Appeal for Alberta agreed.

The Supreme Court of Canada Recognizes Privacy Rights in IP Addresses

By a 5:4 majority, the Supreme Court of Canada allowed the appeal. Writing for the majority, Justice Karakatsanis held that the police were required to obtain a warrant before asking Moneris to provide the IP addresses associated with the fraudulent transactions: It was not sufficient that the police had obtained a warrant for production of the underlying subscriber information after Moneris had voluntarily produced the IP addresses.

The purpose of section 8 is to protect privacy, including informational privacy. To establish a breach of section 8, a claimant must show that there was a search or seizure, and that the search or seizure was unreasonable. Only the first requirement—whether the request for the IP addresses was a search—was in issue.

A search occurs where the state invades a reasonable expectation of privacy. While the courts will consider several factors to determine whether a reasonable expectation of privacy arises in certain circumstances, two key factors were at issue in Bykovets: (1) the subject matter of the search; and (2) whether Mr. Bykovets' subjective expectation of privacy was objectively reasonable. Using this framework, the majority held that under section 8 of the Charter, Canadians have a reasonable expectation of privacy in their IP addresses.

In defining the subject matter of the search, Justice Karakatsanis held that the Court must consider not only the information itself, but also the further personal information that can be obtained or inferred because of the information. An IP address is "the first digital breadcrumb that can lead the state on the trail of an individual's Internet activity." So, while an IP address may not reveal personal information itself, it is the "the key to obtaining more information about a particular Internet user including their online activity and, ultimately, their identity." The "potential to reveal personal or biographical core information" is enough to trigger section 8 of the Charter.

On the issue of whether Mr. Bykovets' subjective expectation of privacy was objectively reasonable, the Supreme Court affirmed that section 8 of the Charter protects informational privacy. This includes "a biographical core of personal information which individuals in a free and democratic society would wish to maintain and control from dissemination to the state."

The fact that a third-party service provider held the IP addresses—and Mr. Bykovets exercised little, if any, control over the information—did not diminish the expectation of privacy. In the majority's view, the internet can disclose more intimate details than physical searches, making the lack of physical intrusion less relevant to privacy expectations.

Underpinning the majority's reasons is a recognition that section 8 of the Charter, and legal concepts of privacy, must be adapted to address the increased importance of online information aggregated by private third parties.

Writing for the four judges in dissent, Justice Côté would have dismissed the appeal. In Justice Cote's view, the IP addresses in this case did not attract a reasonable expectation of privacy because the search revealed nothing more than the IP addresses and the associated internet service providers. In her view, the requirement to obtain a warrant before obtaining production of the underling subscriber information provided sufficient protection.

Key Takeaways

1. While it was well-established in Canadian law that subscriber information associated with a particular IP address attracts a reasonable expectation of privacy, Bykovets now establishes that the IP addresses themselves attract a reasonable expectation of privacy, at least in the criminal and public authority context having regard to section 8 of the Charter. The majority's reasoning in Bykovets could easily be extended to other online information that provides the initial "breadcrumbs" to link online internet activity to a particular individual.
2. The Bykovets decision will have implications for Canadian businesses—including internet service providers, search engines, advertising companies and retailers—that collect and store user data, including IP addresses. As Justice Karakatsanis held at paragraph 10:

Private corporations respond to frequent requests by law enforcement and can volunteer all activity associated with the requested IP address. Private corporate citizens can volunteer granular profiles of an individual user’s Internet activity over days, weeks, or months without ever coming under the aegis of the Charter. This information can strike at the heart of a user’s biographical core and can ultimately be linked back to a user’s identity, with or without a Spencer warrant. It is a deeply intrusive invasion of privacy. [Emphasis added]

In this light, Bykovets reinforces the wisdom of private organizations requiring a court order or other form of judicial authorization before producing an IP address to law enforcement officials. This decision should also inspire private organizations to revisit whether any IP addresses under their custody or control should be treated as personal information.

If you would like to learn more about how the Bykovets decision may affect your business, we invite you to contact the authors of this blog post, or members of our Class Actions group or Privacy and Data Protection group.

Download PDF