Internet users' privacy upheld by Canada's top court

Canadians have the right to be anonymous on the internet, and police must obtain a warrant to uncover their identities, Canada's top court has ruled.

The landmarkdecision from the Supreme Court Fridaybars internet service providers from disclosing the names, addresses and phone numbers of their customers to law enforcement officials voluntarilyin response to a simple request something ISPs have been doing hundreds of thousands of times a year.

• Read the Supreme Court's reasons for internet privacy decision

It also means parts of thecyberbullyingand digital privacy bills that are currently before the House of Commons may be unconstitutional.

• Online privacy decision means 'back to the drawing board' for feds

Friday's decision concerned the case ofMatthew David Spencer, of Saskatchewan, who was charged in 2007 and convicted of possession of child pornographyafter a police officer saw illegal files being downloaded to hisIPaddressa series of numbers representing theinternet identity of a device such as a computer.

The police officer went to Spencer's internet service provider (ISP), Shaw, and asked for the real identity of the customer attached to theIPaddress. The police officer did not have a search warrant, but was given subscriber information for Spencer's sister, allowing police to track him down.

Spencer appealed his conviction, arguing that the search was unconstitutional andhis rights were violated.

The Saskatchewan Court of Appeal ruled there is no reasonable expectation of privacy for basic internet subscriber information, prompting Spencer to appeal to the Supreme Court of Canada.

• Internet privacy ruling: reaction from the Twitterverse

The Supreme Court disagreed that there is no reasonable expectation of privacy for the data obtained by police.

"In my view, in the totality of the circumstances of this case, there is a reasonable expectation of privacy in the subscriber information,"Supreme Court Justice Thomas Cromwell wrote.

"The disclosure of this information will often amount to the identification of a user with intimate or sensitive activities being carried out online, usually on the understanding that these activities would be anonymous."

Warrantless search 'unreasonable'

He added, "A warrantless search, such as the one that occurred in this case, is presumptively unreasonable.The Crown bears the burden of rebutting this presumption."

Althoughthe Supreme Courtset limits on when internet providers can disclose customer information, it dismissed Spencer's appeal.

It said police should have obtained a warrant before asking Shaw for the customer information. But it also saidpolice acted reasonably and in good faith, so the administration of justice would be impaired if the evidence gathered by searching Spencer's home in this particular case were thrown out of court.

The top court decision means Spencer would be subjected to a new trial, on a charge of making child pornography available to others.

The Canadian Civil Liberties Association said in a statement that the Supreme Court decision clarifies "a point of long-standing disagreement between privacy advocates and law enforcement authorities" whether Canada's Personal Information Protection and Electronic Documents Act allows police to obtain subscriber information without a warrant. The actgoverns how the private sector gathers andhandles personal information.

• Read the CCLA statement

The Supreme Court's ruling that a warrant is required "confirms CCLAs view that PIPEDA is legislation to protect privacy, and cannot be used to undermine it," the association said.

The CCLAlaunched a challenge in May to have parts of PIPEDA declared unconstitutional. It said the new Supreme Court decision may play a "significant role" in the challenge.

• Federal privacy law faces constitutional challenge

'Huge victory for internet privacy'

Michael Geist, a professor of internet law at the University of Ottawa, called the Supreme Court decision a "huge victory for internet privacy."

The decision means that the common police practice of obtaining information about customers from internet service providers simply by asking for it must stop, he wrote in a blog post Friday.

"This means ISPs must change their practices on voluntary, warrantless disclosure," he added.

• Read Michael Geist's blog post

The decision could also affecttwo federal government bills, rendering parts of them unconstitutional:

• Bill C-13, which is intended to crack down on cyberbullying, but includes provisions that wouldgivepolice easier access to themetadatathat internet service providers and phone companies keep on every call and email from their customers.
• Bill S-4, to be known as the digital privacy act, would update the Personal Information Protection and Electronic Documents Act thatgoverns how the private sector handles privateinformation. It includes provisions that also make it easier for police to obtain basic subscriber information without a warrant.

Governmentreviewing decision

The government is reviewing the decision, said Bob Dechert, parliamentary secretary to Justice Minister Peter MacKay during question period Friday.

"In addition," he said, "we'll continue to crack down on cyberbullies and online criminals who work against and make our children and all Canadians unsafe."

A spokesperson for Industry Minister James Moore, who introduced the digital privacy act bill in April, told CBC News that his office is also reviewing the Supreme Court decision.

Meanwhile, opposition MPssaid the ruling was no surprise.

NDP House leader Peter Julian said, also during question period, that the NDP and privacy experts had warned the government all along.

"And yet Conservatives are steamrolling ahead with Bill C-13, which also allows unconstitutional spying on Canadians," he said. "When will they finally take a balanced approach that keeps Canadians secure without infringing on constitutional rights?"

Recent reports show that law enforcement and government agencies have been routinelyasking Canadian telecommunications companies for information about hundreds of thousands of their subscribers each yearwithout a warrant.

Rogers Communications released a report last week showing that itreceived almost 175,000 requestsfor information about its customers from government and police agencies last year.

• Telecomgiant Rogers got 175,000 info requests from government

In March,the Chronicle Herald newspaper in Halifax reportedthe Canada Border Services Agency alone accessedtelecomcustomerdata almost 19,000 times in one year and without a warrant more than 99 per cent of the time.

In 2011, the Canadian Wireless Telecommunications Association reported to Canada's privacy commissioner its members received 1.2 million requests for customer information in one year and disclosed information about 780,000 customers.