Police want easy access to personal information, generally with the assurance that they will not misuse the data they collect. The trouble is they almost always misuse the data, or if that statement seems too unfair, they often use it in ways never intended and they said they would never do.

Take the testimony of Scott Naylor of the Ontario Provincial Police before the Standing Senate Committee on Legal and Constitutional Affairs regarding the so-called “lawful access” Bill C-13, also known as the “Protecting Canadians from Online Crime Act”.

Naylor and the Ontario Provincial Police correctly want to stop child sexual exploitation and cyber-bullying. They get themselves in hot water, however, due to their overreaching desire to strip Canadians of their Right to Privacy in the process.

Here is Naylor’s testimony before the committee, courtesy of privacy expert Michael Geist:

If the bag was open and I could do anything, the biggest problem that I see in the world of child sexual exploitation is anonymity on the Internet. When we get our driver’s licence we’re required to get our picture taken for identification. When you get a mortgage you have to sign and provide identification. When you sign up for the Internet, there is absolutely no requirement for any kind of non-anonymity qualifier. There are a lot of people who are hiding behind the Internet to do all kinds of crime, including cybercrime, fraud, sexual exploitation and things along those lines.

The Internet is moving so quickly that law enforcement cannot keep up. If there were one thing that I would ask for discussion on is that there has to be some mechanism of accountability for you to sign on to an Internet account that makes it like a digital fingerprint that identifies it to you sitting behind the computer or something at that time. There are mechanisms to do it, but the Internet is so big and so vast at this point, and it’s worldwide, I’m not sure how that could happen, but that would certainly assist everybody. In that way I can make a digital qualification that that’s the person that I’m talking to. If I had one choice, that’s what I would ask for.

As Michael Geist points out, Scott Naylor starts his argument with something completely disconnected and irrelevant to the discussion of privacy rights and internet anonymity: driver’s licenses and mortgages.

I am required to prove who I am when I take out a mortgage because the bank needs to know who they have on a string, and where to go to yank on that string when required. A driver’s license is required to drive a motor vehicle on the state’s roadways. These comparisons are ludicrous, yet Naylor delivered these statements with a straight face as though some non-existent causal link between the two and privacy on the internet actually exists.

It doesn’t.

More to the point, and this is something a police officer looking to violate our Charter Right to Privacy ought to be fully aware of, is that Canada’s Supreme Court already ruled this year that our right to privacy is a paramount concern, and should only be violated in the most egregious cases.

The case I’m referring to is R. v. Spencer, 2014 SCC 43, where the Supreme Court made these statements about internet access and anonymity in a child pornography case:

The nature of the privacy interest engaged by the state conduct turns on the privacy of the area or the thing being searched and the impact of the search on its target, not the legal or illegal nature of the items sought. In this case, the primary concern is with informational privacy. Informational privacy is often equated with secrecy or confidentiality, and also includes the related but wider notion of control over, access to and use of information.

However, particularly important in the context of Internet usage is the understanding of privacy as anonymity. The identity of a person linked to their use of the Internet must be recognized as giving rise to a privacy interest beyond that inherent in the person’s name, address and telephone number found in the subscriber information.

Subscriber information, by tending to link particular kinds of information to identifiable individuals may implicate privacy interests relating to an individual’s identity as the source, possessor or user of that information. Some degree of anonymity is a feature of much Internet activity and depending on the totality of the circumstances, anonymity may be the foundation of a privacy interest that engages constitutional protection against unreasonable search and seizure.

In this case, the police request to link a given IP address to subscriber information was in effect a request to link a specific person to specific online activities. This sort of request engages the anonymity aspect of the informational privacy interest by attempting to link the suspect with anonymously undertaken online activities, activities which have been recognized in other circumstances as engaging significant privacy interests.

The Court goes on to say:

[66] In my view, in the totality of the circumstances of this case, there is a reasonable expectation of privacy in the subscriber information. The disclosure of this information will often amount to the identification of a user with intimate or sensitive activities being carried out online, usually on the understanding that these activities would be anonymous. A request by a police officer that an ISP voluntarily disclose such information amounts to a search.

[67] The intervener the Attorney General of Alberta raised a concern that if the police were not permitted to request disclosure of subscriber information, then other routine inquiries that might reveal sensitive information about a suspect would also be prohibited, and this would unduly impede the investigation of crimes. For example, when the police interview the victim of a crime, core biographical details of a suspect’s lifestyle might be revealed. I do not agree that this result follows from the principles set out in these reasons. Where a police officer requests disclosure of information relating to a suspect from a third party, whether there is a search depends on whether, in light of the totality of the circumstances, the suspect has a reasonable expectation of privacy in that information: Plant, at p. 293; Gomboc, at paras. 27-30, per Deschamps J. In Duarte, the Court distinguished between a person repeating a conversation with a suspect to the police and the police procuring an audio recording of the same conversation. The Court held that the danger is “not the risk that someone will repeat our words but the much more insidious danger inherent in allowing the state, in its unfettered discretion, to record and transmit our words“: at pp. 43-44.

Similarly in this case, the police request that the ISP disclose the subscriber information was in effect a request to link Mr. Spencer with precise online activity that had been the subject of monitoring by the police and thus engaged a more significant privacy interest than a simple question posed by the police in the course of an investigation.

Police routinely make requests for internet subscriber information from Internet Service Providers (ISPs). While there is no legal requirement for ISPs to surrender this data, and in fact a very real legal requirement to protect the personal information of their clients, the act of a police officer asking for someone’s personal information creates the illusion that their request has the authority of law and cannot be denied.

It does not, as the Supreme Court makes clear.

Turning to whether the search of Mr. Spencer’s home and computer was lawful, the Supreme Court makes it crystal clear that it was not.

[73] With respect, I cannot accept that this conclusion applies to s. 7(3) (c.1)(ii) of PIPEDA . Section 487.014(1) is a declaratory provision that confirms the existing common law powers of police officers to make enquiries, as indicated by the fact that the section begins with the phrase “[f]or greater certainty”: see Ward, at para. 49. PIPEDA is a statute whose purpose, as set out in s. 3 , is to increase the protection of personal information. Since in the circumstances of this case the police do not have the power to conduct a search for subscriber information in the absence of exigent circumstances or a reasonable law, I do not see how they could gain a new search power through the combination of a declaratory provision and a provision enacted to promote the protection of personal information.

[74] The subscriber information obtained by police was used in support of the Information to Obtain which led to the issuance of a warrant to search Ms. Spencer’s residence. Without that information, the warrant could not have been obtained. It follows that if that information is excluded from consideration as it must be because it was unconstitutionally obtained, there were not adequate grounds to sustain the issuance of the warrant, and the search of the residence was therefore unlawful. I conclude, therefore, that the conduct of the search of Ms. Spencer’s residence violated the Charter : Plant, at p. 296; Hunter v. Southam, at p. 161. Nothing in these reasons addresses or diminishes any existing powers of the police to obtain subscriber information in exigent circumstances such as, for example, where the information is required to prevent imminent bodily harm. There were no such circumstances here.

Quite clearly the highest court in the land takes our right to personal privacy and anonymity on the internet very seriously. Equally clear is the fact that police forces routinely do NOT take that right seriously at all, and in fact ignore it as often as possible, since ignoring our rights makes their job of investigating crime much easier.

Is it a problem for police that we mere citizens have Rights and Freedoms guaranteed by the Canadian Charter of Rights and Freedoms? Absolutely, and as a result they must find ways of doing their job that does not violate our rights.

Police don’t like that.

I suppose were I in their shoes I wouldn’t like my job being made more difficult either, but as I view this issue from the standpoint of a mere citizen I naturally disagree with police and their quest for the easy way out.

My right to privacy has meaning. I don’t care that they don’t like it, or that it makes their jobs more difficult.

Tough.

Where I find fault with the Supreme Court decision in this case is that even though the police request for information was not “lawful” the court ruled their behaviour was not egregious enough to warrant tossing out the evidence simply because police “reasonably thought” they acted lawfully when they did not.

While I would not want to be understood to be encouraging the police to act without warrants in “gray areas”, in light of the fact that the trial judge and three judges of the Court of Appeal concluded that Det. Sgt. Parisien had acted lawfully, his belief was clearly reasonable. In short, the police were acting by what they reasonably thought were lawful means to pursue an important law enforcement purpose.

They cite the fact that a trial judge and three Court of Appeal judges concluded Det. Sgt. Parisien acted reasonably as proof that he did. That is not the case. They said this, yet in the very next paragraph explain that the Charter violation is extremely serious.

[78] The second Grant factor is the impact of the Charter-infringing conduct on Mr. Spencer’s Charter-protected interests. That impact here was serious. As discussed above, anonymity is an important safeguard for privacy interests online. The violation of that anonymity exposed personal choices made by Mr. Spencer to be his own and subjected them to police scrutiny as such. This weighs in favour of excluding the evidence.

Their decision to allow the evidence to stand ultimately rests on the idea that since they’d caught a man with child pornography, the ends justified the means. I’m paraphrasing, but you get the idea. Here is their actual written rationale:

[80] The offences here are serious and carry minimum prison sentences. Society has both a strong interest in the adjudication of the case and also in ensuring that the justice system remains above reproach in its treatment of those charged with these serious offences. If the evidence is excluded, the Crown will effectively have no case. The impugned evidence (the electronic files containing child pornography) is reliable and was admitted by the defence at trial to constitute child pornography. Society undoubtedly has an interest in seeing a full and fair trial based on reliable evidence, and all the more so for a crime which implicates the safety of children.

[81] Balancing the three factors, my view is that exclusion of the evidence rather than its admission would bring the administration of justice into disrepute, and I would uphold its admission.

Having caught someone who is downloading and distributing child pornography the Supreme Court says it must overlook the “serious” violation of Mr. Spencer’s Charter Rights because not to do so would bring the administration of justice into disrepute.

This ruling essentially tells police they can do as they please so long as they “reasonably believe” they are following the law when they are not.

That is a very dangerous precedent to set.

Where do we draw the line between our Right to Privacy and police violations of it under the rationale that to do otherwise would bring the administration of justice into disrepute? It’s a hard question and one our Supreme Court did its best to answer in R. v. Spencer.

Did they get it right?

I would prefer that our Supreme Court hold our police to a higher standard when they violate our right to privacy. Just because the police wrongly believed they were acting in good faith when they clearly are not doesn’t justify their violation of our rights. This leads us down a road none of us want.

However, the Supreme Court of Canada concluded that when it the choice is between our Right to Privacy vs the need of police to investigate crime, the police win.