R. V. Spencer: Keeping Your Digital Identity Private

Because the Learn section of TalkRights features content produced by CCLA volunteers and interviews with experts in their own words, opinions expressed here do not necessarily represent the CCLA’s own policies or positions. For official publications, key reports, position papers, legal documentation, and up-to-date news about the CCLA’s work check out the In Focus section of our website. CCLA’s intervention in R. v. Spencer is documented here.

Would you want the government to know every webpage you’ve seen? Every Google search you’ve run? Every social media post you’ve clicked? Every file, photo, or video you’ve downloaded? If not, you can thank R. v. Spencer, 2014 SCC 43, 2 SCR 212 (available at: https://scc-csc.lexum.com/scc-csc/scc-csc/en/item/14233/index.do).

Every time you retrieve any digital resource, your computer tells the Internet your digital location (an “IP address”), so that the Internet knows where to send the information. Take a moment to think about the mental patterns you reveal in your posts and searches, the political and sexual preferences hidden in your deleted Internet history, and the secrets you tried to hide in your private browsing. Anyone the Internet with the technical skills can track this information, and so paint an intimate picture of what you think about, how you think about it, and ultimately who you are.

However, they don’t know they’re painting a picture of you. Generally, only your Internet Service Provider (ISP) knows what IP address you are using – that anonymity prevents anyone from reading your digital diary. That is, until the police “requests” your subscriber information from your ISP, giving them your IP address and demanding they share your name. This was at issue in R. v. Spencer, where the CCLA successfully intervened to protect your digital anonymity.

THE CASE

The police were tracking a child pornography file-sharing site, and found an IP address which accessed it. They demanded, without a warrant, that the ISP divulge the name associated with the IP address, and used that information to find where their suspect lived. It was Spencer’s sister’s house, where they found evidence incriminating Spencer.

Spencer appealed to the Supreme Court, arguing that his digital anonymity was constitutionally protected. The court unanimously agreed with the CCLA that “maintaining anonymity can be integral to ensuring privacy”. Providing the police with subscriber information prejudiced Spencer’s anonymity, and so his privacy.

The Crown then argued that, even if this was an interference with Spencer’s privacy, it was a reasonable interference. They argued that the ISP’s Privacy Policy required it to disclose information requested by the police, so Spencer could not have expected privacy from them (courts will only protect privacy if the victim has “a reasonable expectation of privacy” before the breach). The Supreme Court rejected this argument, saying that the police had no right to force ISPs to share subscriber information, and so Spencer could have expected the ISP would keep his sister’s subscriber information confidential. Getting that information was therefore unconstitutional.

IMPLICATIONS AT THE TIME

When R. v. Spencer was decided in 2014, it sent a strong message to the police that warrantless access to subscriber information was unacceptable in most cases. The picture drawn from IP addresses can be so intimate that it should only be accessible with probable cause or in exigent circumstances. The police now need a warrant to get your subscriber information, and so trace your digital history through your IP address.

Six months later, the Supreme Court added to these limits in R. v. Fearon, which limited the amount that the police could request in a production order (a type of warrant). With these two cases, the court was clearly strengthening privacy rights.

More broadly, the decision redefined privacy to include not just secrecy, but also control over information and anonymity. The court accepted that “anonymity may enjoy constitutional protection” in the context of the Internet. This is promising, because it suggests the court genuinely understands that times have changed: we now put so much information online that the only way to protect privacy might be through anonymity.

WHY THIS MATTERS NOW

Although the ruling in R. v. Spencer may suggest that anonymity has been assured, it has not been the final word on the issue. The government is currently pursuing a National Security Consultation which may reverse the new importance the court has placed on anonymity. Specifically denouncing R. v. Spencer, the government is asking Canadians for a mandate to pass legislation granting intelligence services the right to subscriber information – in effect giving them an unshaded window into everyone’s hearts and minds. It is unclear yet whether this proposal will move forward, and if so, whether it would be constitutional. Only time will tell whether R. v. Spencer was a bold step towards secure digital privacy, or a stumbling block on the road to greater government access to your digital identity.