OTTAWA - The Supreme Court of Canada says police need judicial authorization to obtain a computer user's internet protocol address, calling the identification number a crucial link between a person and their online activity.
The top court's 5-4 ruling came Friday in a case that began in 2017, when Calgary police investigated fraudulent online transactions from a liquor store.
The store's third-party payment processor voluntarily gave police two IP addresses — numerical identifiers assigned by an internet service provider.
Police obtained a production order compelling the service provider to disclose the names and street addresses of the customers.
Police then got warrants to search two homes, leading to the arrest of Andrei Bykovets, who was eventually convicted on several counts.
The trial judge had rejected the argument that the police request to obtain the IP addresses violated his Charter of Rights guarantee against unreasonable search and seizure.
A majority of the Alberta Court of Appeal dismissed Bykovets's appeal, prompting him to take his case to the Supreme Court.
The high court allowed Bykovets's appeal, set aside his convictions and ordered a new trial.
Writing for a majority of the court, Justice Andromache Karakatsanis said an IP address "is the key to unlocking a user's internet activity and, ultimately, their identity, such that it attracts a reasonable expectation of privacy."
IP addresses are not just meaningless numbers, she wrote. As the link that connects internet activity to a specific location, they may betray deeply personal information — including the identity of the device's user — without ever triggering a warrant requirement.
Karakatsanis said that if the Charter provision against unreasonable search "is to meaningfully protect the online privacy of ºÚÁϳԹÏÍøs in today's overwhelmingly digital world, it must protect their IP addresses."
The British Columbia Civil Liberties Association, an intervener in the case, called the decision a huge victory for online privacy.
"ºÚÁϳԹÏÍøs can have the peace of mind that their online activities are safer from the prying eyes of the state," said Vibert Jack, the association's litigation director.
in the ruling, Karakatsanis said police should have the investigative tools to deal with crime committed and facilitated online. However, she concluded that requiring police to obtain judicial authorization before obtaining an IP address "is not an onerous investigative step."
She disagreed with the Crown's suggestion that an IP address is useless without a subsequent warrant to obtain a name and street address.
First, as the link that connects specific internet activity to a specific location, an IP address may betray deeply personal information, even before police try to link the address to the user's identity, she said.
Second, activity associated with the IP address can be correlated with other online activity associated with that address available to the state — with particularly concerning consequences when coupled with access to information held by third parties, Karakatsanis wrote.
Finally, an IP address can set the state on a trail of internet activity that leads directly to a user's identity, even without a subsequent warrant, she added.
When linked to financial intermediaries like Moneris or PayPal, an IP address can reveal all of a user's transactions on that intermediary over the period the IP address was assigned to them, the ruling says.
In turn, these purchases might reveal an array of personal information, from the restaurants someone visits to the hobbies they enjoy and the health supplements they use.
"Websites offering dating services or adult pornography can give the state a depiction of the user's sexual preferences," Karakatsanis wrote. "An internet user's history on medical, political, or other similar online chatrooms can reveal their health concerns or political views.
"If an IP address is not protected, this information is freely available to the state without the protection of the Charter whether or not it relates to the investigation of a particular crime."
The four dissenting judges said the appeal should be dismissed, finding Bykovets did not have a reasonable expectation of privacy in the IP addresses on the credit card processor's servers and the internet service provider they revealed.
However, they said another person might have a reasonable expectation of privacy in a different scenario.
The reasonable expectation of privacy test is fact-specific and contextual, and depends on the totality of the circumstances of a particular case, the four judges said.
This report by ºÚÁϳԹÏÍø was first published March 1, 2024.
