| Case-Name: | R v Spencer |
| Full-Case-Name: | Matthew David Spencer v Her Majesty The Queen |
| Heard-Date: | 9 December 2013 |
| Decided-Date: | 13 June 2014 |
| Citations: | 2014 SCC 43, [2014] 2 SCR 212. |
| Docket: | 34644 |
| History: | APPEAL from R v. Spencer. 2011. skca. 144. 2011-11-25., affirming in part and setting aside in part R v. Spencer. 2009. skqb. 341. 2009-08-31. . Leave to appeal granted, Matthew David Spencer v. Her Majesty The Queen. 2013. scc-l. 2395. canlii. 2013-01-24. auto. |
| Ruling: | Appeal dismissed. |
| Ratio: | Users may have a reasonable expectation of privacy in their Internet service provider subscriber information, as its disclosure will often identify users with intimate or sensitive activities carried out online with the expectation of anonymity. |
| Scc: | 2013-2014 |
| Unanimous: | Cromwell J |
R v Spencer, 2014 SCC 43 is a landmark decision of the Supreme Court of Canada on informational privacy. The Court unanimously held that internet users were entitled to a reasonable expectation of privacy in subscriber information held by Internet service providers. And as such, police attempts to access such data could be subject to section 8 of the Charter of Rights and Freedoms.
At issue was whether the police could request subscriber information associated with an IP address from an Internet service provider without prior judicial authorisation, who could then voluntarily provide it. The Supreme Court ruled that the request for internet subscriber information infringed the Charter's guarantee against unreasonable search and seizure.[1]
The appellant, Matthew David Spencer, used LimeWire to download child pornography onto a computer belonging to his sister, with whom he lived, and inadvertently shared it publicly. A member of the Saskatoon Police Service, using software to track worldwide child pornography file sharing, found Spencer's IP address among the results. Police investigators suspected the IP address to belong to a Shaw Communications customer in Saskatoon, although they did not know the identity or precise location of the customer to whom the IP address belonged. Without a production order or judicial authorization, police investigators made a written request to Shaw for the subscriber information linked to the IP address in question. Shaw voluntarily complied, turning over records including the name and address of the user associated with the IP address. The police used this information to lawfully obtain a search warrant for Spencer's sister's house, where they found several child pornography photos and videos. Spencer was arrested and charged with two criminal offences: possession of child pornography, contrary to section 163.1(4) of the Criminal Code, and distribution of child pornography, contrary to section 163.1(3) of the Criminal Code.[2]
Spencer was tried before the Court of Queen's Bench for Saskatchewan. At a pre-trial application, he argued that the way the police obtained his subscriber information was an unconstitutional search, violating section 8 of the Canadian Charter of Rights and Freedoms. On the merits of the charges, he argued that he did not knowingly share the child pornography because he did not know how LimeWire sharing worked. Spencer moved for the evidence to be excluded under section 24(2) of the Charter.
In response, the Crown argued that Shaw's voluntary disclosure of Spencer's subscriber information was authorized by section 7(3)(c.1)(ii) of PIPEDA, which allows an organization to disclose personal information to a government institution that has "identified its lawful authority to obtain the information and indicated that the disclosure is requested for the purpose of... carrying out an investigation relating to the enforcement of any... law or gathering intelligence for the purpose of enforcing any... law".[3]
The trial judge dismissed Spencer's Charter application, finding that the police's request for Spencer's subscriber information was not a search for the purposes of section 8.[4]
At trial, the trial judge convicted Spencer of possession of child pornography. However, he acquitted Spencer of distribution of child pornography, holding that offence required some "positive step or action" to distribute the materials[5] and that the mens rea had not been established..
Spencer appealed the conviction on the possession charge to the Saskatchewan Court of Appeal, while the Crown appealed the acquittal on the distribution charge. The Court of Appeal unanimously upheld the possession conviction, agreeing with the trial judge that the way the police obtained the IP information was not an unreasonable search and did not violate the Charter.[6] The Court therefore dismissed Spencer's appeal on this charge.
On the second issue, the acquittal on the charge of distributing child pornography, the Court allowed the Crown appeal. The Court of Appeal held that the trial judge had erred by holding that the offence required proof of a "positive step" to distribute the child pornography. The Court therefore set aside the acquittal and ordered a new trial on the distribution charge.[7]
Spencer then appealed to the Supreme Court of Canada.
Cromwell J, writing for a unanimous Court, held that law enforcement's obtainment of Spencer's subscriber information was a search for the purposes of section 8. He found that Spencer had a reasonable expectation of privacy in his subscriber information, a decision reached by weighing several factors previously identified in R v Tessling. And that the police request to access those records was unauthorized, and therefore unlawful and unconstitutional. In doing so he recognized a new component of informational privacy, as protected by the Charter, the concept of "privacy as anonymity".
First, the Court took a "broad and functional approach"[8] by determining the subject matter of the search to be not merely Spencer's name and address but the identity of an Internet user. Second, the Court found that the nature of Spencer's privacy interest in subscriber information relating to a computer used privately was primarily an informational one, and set out three key elements of informational privacy: "privacy as secrecy", "privacy as control", and "privacy as anonymity".[9] The Court found anonymity to be particularly important in an online context, where subscriber information "may implicate privacy interests relating not simply to the person’s name or address but to his or her identity as the source, possessor or user of that information".[10] Although the Court did not recognize a right to absolute anonymity, noting that an individual's privacy interests and expectations vary in different circumstances.[11] It nonetheless held that the type of information sought (subscriber information) implicated a high degree of informational privacy interests, and that Spencer had an expectation of privacy in it. Third, citing those interests, the Court held that Spencer's expectation of privacy in his subscriber information was an objectively reasonable one. The Court dismissed the Crown's argument that the request for subscriber information was authorized by section 7(3)(c.1)(ii) of PIPEDA, which allows for disclosure to government institutions who identify their lawful authority to obtain such information. Stating that the existence of lawful authority itself depends on the existence of a reasonable expectation of privacy in subscriber information. Thus PIPEDA was not determinative of the issue at hand.
The Court held that the police's search was not authorized by law, since it interpreted "lawful authority" in section 7(3)(c.1)(ii) to mean more than a "bare request by law enforcement".[12] The Court thus found the search unreasonable on the basis of the Collins test. Which states that warrantless searches are presumptively unreasonable under section 8, unless it can be established that A) the search was authorized by law, B) the law itself was reasonable, and C) the search was conduced in a reasonable manner. In this case, since section 7(3)(c.1)(ii) did not even purport to authorize any searches (due to the Court's findings), the request was automatically unreasonable. Since the search warrant that led to Spencer's arrest was predicated entirely on the earlier unreasonable search of Spencer's subscriber information, there would not have been grounds to issue the warrant had the police acted lawfully. Thus the search of Spencer's sister's house was also unconstitutional, violating section 8 of the Charter.
However, the Court held that the evidence obtained during the search of Spencer's sister's house should not be excluded, on the basis of the Grant test. The state's conduct was deemed not to constitute "wilful or flagrant disregard of the Charter"[13] because the Saskatoon Police Service reasonably believed that the subscriber information request to Shaw was authorized by law. The impact of the Charter-infringing conduct on Spencer was serious, unmasking his anonymity and exposing his online choices. However, society's interest in the adjudication of the case, one involving serious offences with mandatory minimum prison sentences, on its merits outweighed any privacy infringement.[14]
The Court also agreed with the Saskatchewan Court of Appeal that the trial judge had erred by holding that the offence of distribution of child pornography required proof of a positive step.[15]
The Supreme Court's decision was hailed as a landmark victory for privacy and anonymity, sending a "strong message on Internet privacy"[16] and holding definitively that law enforcement cannot use the section 7(3)(c.1)(ii) PIPEDA disclosure provision or the section 487.014 Criminal Code investigative power alone to compel ISPs to disclose a customer's subscriber information.