Canadians’ Right To Privacy In Cell Phone Data Confirmed…

Telecom companies have the obligation to protect the privacy of their subscriber’s personal information, and police must make sure that requests for this information are minimally intrusive. These are key elements of a decision released January 14, 2016 by the Ontario Superior Court in a Charter Challenge brought by Rogers and Telus.

In April 2014, Peel Regional Police, as part of an investigation into a series of jewelry store robberies, obtained a production order for a “tower dump”—it asked Rogers and Telus to turn over customer information from all cellphones that accessed every cell tower near to 21 different municipal addresses. The two companies estimated that this would include the personal information of at least 9000 Telus subscribers, and 34,000 Rogers’ subscribers, including information about call recipients and subscriber billing information. The orders also did not specify how this customer information about thousands of innocent people would be safeguarded.

The two companies felt this was excessive, amounting to a violation of section 8 of the Charter protecting against unreasonable search and seizure. In deciding to hear the case, Justice John Sproat of the Ontario Superior Court noted that individual subscribers lack the means to raise this issue, and that “The privacy rights of the tens of thousands of cell phone users are of obvious importance.”

Today’s decision is significant for a number of reasons:

1. The decision confirms that telecommunications companies have a contractual obligation to keep subscriber information confidential.  They must protect their customers’ information from undue intrusion.
2. The decision explicitly declares that “Canadians have a reasonable expectation of privacy in their cell phone records.”
3. Overly broad production orders for cell phone subscriber information are declared, clearly and pointedly, to be unconstitutional.

Justice Sproat includes a series of guidelines for police detailing the information that should be included in the information to obtain a production order. This includes demonstrating that the principles of incrementalism and minimal intrusion have been duly considered in making the request; explaining why all information requested—locations, towers, dates, times, and types of records– is relevant to the investigation; providing details that might permit the search to be narrowed; limiting requests when feasible to ask for a report on the specified data rather than all of the underlying data, or, if this is insufficient, justifying any need for underlying data; and confirming that the data can be meaningfully reviewed.

The Justice declined to provide guidance on appropriate safeguards for retention, storage and deletion of data obtained from these production orders, suggesting that this would require legislation and that it should be left to parliament to enhance existing privacy laws. He further declined to limit police use of tower dumps, again noting a need for legislation before limiting investigative practice, and citing the example of s. 186(1)(b) of the Criminal Code as an example of where legislation explicitly limits the ability to intercept private communications by imposing a high standard of investigative necessity for the practice.

This decision is an important counter to the increasingly popular belief that more information is always better in investigative contexts, be they law enforcement, national security, or even in relation to the private sector’s collection and use of personal information. CCLA has always maintained that information collection should be proportionate to the purpose, and undertaken in a way to minimally impair privacy. This judgement comes down soundly in favour of these important privacy principles.

Related links:

The full text of the decision, R. v. Rogers Communications, 2016 ONSC 70.

Our Executive Director and General Counsel, Sukanya Pillay, comments on the decision for the CBC.