Police will now be required to get a court order or a warrant to obtain the IP address of computers belonging to individuals or organizations, following a Supreme Court of Canada ruling on Friday.
The issue at hand was whether or not an IP address alone, without that attached personal information, was protected under the Charter of Rights and Freedoms privacy expectations.
The court ruled that it was a reasonable expectation of privacy that a person’s IP address should require a warrant prior to a search, in a five-four split decision.
Justice Andromache Karakatsanis, who ruled in favour of the decision, wrote that an IP address is “the crucial link between an internet user and their online activity.”
“Thus, the subject matter of this search was the information these IP addresses could reveal about specific internet users including, ultimately, their identity.”
However, dissenting Justice Suzanne Côté disagreed with Karakatsanis central argument, saying that privacy around an IP address alone should not be an expectation of privacy under the Charter.
The recent decision was based on the case of Andrei Bykovets, a man convicted of 14 online fraud offences involving purchases made from a liquor store in Alberta, according to CBC News.
Once Calgary Police Services discovered that a third-party payment processing company called Moneris was responsible for the liquor store’s payments, they contacted them to request IP addresses associated with the purchases.
Monteris obliged the request, however, CPS did so without a warrant or a court order.
CPS then went to the internet service provider with a court order to obtain the names and addresses associated with the IP addresses, one of which belonged to Bykovets and another to his father.
The names and addresses were then used to acquire a warrant to search their residences.
Bykovets was subsequently arrested and charged with possession of a third party’s identity documents and credit card.
His defence in the trial was that he was a victim of unreasonable search and seizure, a violation of Section 8 of the Charter of Rights and Freedoms, due to an expectation of privacy regarding his IP address.
The trial judge ruled against Bykovets’ argument and it was later brought before the Alberta Court of Appeal, with a majority decision also siding with the trial judge.
However, one appeal court judge disagreed, saying that there was an expectation of privacy associated with one’s IP address.
In the Supreme Court ruling, Karakatsanis stated that privacy interests cannot be limited to what the IP address can reveal on its own “without consideration of what it can reveal in combination with other available information, particularly from third-party websites.”
Once an IP address unlocks the identity of the user, a reasonable expectation of privacy should be protected under the Charter, the ruling added.
“If [the Charter] is to meaningfully protect the online privacy of Canadians in today’s overwhelmingly digital world, it must protect their IP addresses,” reads the ruling.
