Supreme Court Of Canada Finds IP Addresses Attract A Reasonable Expectation Of Privacy

On March 1, 2024, the Supreme Court of Canada (SCC) issued its decision in R. v Bykovets, 2024 SCC 6, in which a 5-4 majority held that an Internet Protocol (IP) address attracts a reasonable expectation of privacy and that a request by the state for an IP address constitutes a “search” under Section 8 of the Canadian Charter of Rights and Freedoms (the Charter).

Under Section 8 of the Charter, a “search” occurs where the state invades a reasonable expectation of privacy (i.e., where the public’s interest in being left alone by the government outweighs the government’s interest in intruding on the individual’s privacy to advance its goals, notably those of law enforcement).  The SCC noted that courts analyze an expectation of privacy by considering four categories of “interrelated but often competing factors”: (1) the subject matter of the search; (2) the claimant’s interest in the subject matter; (3) the claimant’s subjective expectation of privacy; and (4) whether the subjective expectation of privacy was objectively reasonable.

In considering the fourth factor, whether the expectation of privacy was reasonable, the SCC noted that factors such as the place of search (i.e., lack of physical intrusion) and the claimant’s control over the subject matter were not determinative in the informational privacy context.  The SCC focused on the private nature of the subject matter, noting that Section 8 of the Charter, “appreciated normatively, requires that we ask what information the subject matter of the search tends to reveal”.  The SCC held that: (i) an IP address may betray deeply personal information even before police try to link the address to the user’s identity; (ii) activity associated with an IP address can be correlated with other online activity associated with that address (which is particularly concerning when coupled with access to third-party-held information); and (iii) an IP address can set the state on a trail of Internet activity that leads directly to a user’s identity.

The SCC concluded that on balance, “the burden imposed on the state by recognizing a reasonable expectation of privacy in IP addresses pales compared to the substantial privacy concerns implicated in this case” and requiring police to obtain judicial authorization prior to obtaining an IP address would not constitute an onerous investigative step nor unduly interfere with the ability to deal with online crime.

Ultimately, the majority held that a reasonable and informed person concerned about the long-term consequences of government action for the protection of privacy would conclude that IP addresses should attract a reasonable expectation of privacy, and the majority allowed the appeal.

The dissenting judges would have dismissed the appeal on the basis that the IP addresses in this case did not attract a reasonable expectation of privacy because they did not reveal private information, but only the user’s Internet service provider.  However, the dissent noted that “this conclusion does not foreclose the possibility that someone may have a reasonable expectation of privacy on different facts.”

Summary By: Steffi Tran