Parliament should be wary of warrantless data access
Over the past few months, law enforcement has resurrected an important debate on warrantless access to the personal information of Canadians — a debate many privacy advocates thought was put to bed following a landmark Supreme Court of Canada ruling.
The decision, known as R v. Spencer, concluded subscriber information linked with specific Internet activity should not be obtained without a warrant, except in very precise circumstances.
Since this ruling, many telecommunications companies and Internet service providers have required warrants or production orders when police officers come calling for confidential subscriber data.
Law enforcement says this has made their jobs impossible. In a recent speech, RCMP commissioner Bob Paulson argued such a legal requirement is untenable in an era where more and more criminal activity has migrated online, where anonymity reigns.
The RCMP commissioner and organizations such as the Canadian Chiefs of Police are now calling for a reasonable law that would expand warrantless access, yet is consistent with both the charter and Canadian values.
How one might square that circle is not exactly clear.
We all want police to be able to protect us, including online, but policing must be done in ways that are consistent with the rule of law.
In its decision in Spencer a year-and-ahalf ago, the Supreme Court stated that a warrant is needed in all circumstances except where:1) there are exigent circumstances, such as where the information is required to prevent imminent bodily harm; 2) there is a reasonable law authorizing access; or 3) the information being sought does not raise a reasonable expectation of privacy.
As Parliament may consider bringing more clarity to this important matter, something I have called for in the past, I believe there are some key things to consider.
First, it seems to me somewhat false to suggest — as police have done — that the warrant requirement imposed by Spencer has resulted in such a delay that police are unable to prevent imminent threats or crimes in progress. The ruling itself recognized such emergencies among the exceptions to the warrant requirement.
As well, law enforcement agencies also argue that the Spencer decision has resulted in significant expenses that impede their work. If law enforcement needs more boots on the ground to effectively execute warrants, they should consider appealing to government for bigger budgets. The solution to a lack of resources is not to limit the rights of Internet users — rights that have been recognized by the Supreme Court.
Law enforcement has long argued basic ISP subscriber information — customer name and physical address — is akin to the information contained in a phone book. As such, they say it does not raise a reasonable expectation of privacy and should be turned over by Internet service providers in the absence of a warrant.
Yet the Supreme Court clearly ruled otherwise when it said a warrant is needed if police are investigating a crime. This is the context where the stakes for individuals are highest and where a reasonable expectation of privacy is most critical.
The court said that protecting privacy interests requires us to look not only at the specific information being sought, no matter how innocuous it may seem, but also at what the information may further reveal.
As we know from our research into metadata and into what an IP address can reveal about an individual, access to basic subscriber information linked with Internet activity can unlock details of a person’s interests based on websites visited, their organizational affiliations, where they have been and the online services for which they have registered. This goes well beyond a simple residential address.
Ultimately, impartial oversight in the form of judicial authorization is critical before sensitive personal information may be turned over to the state. Courts are best placed to balance the interests of the police and of individuals. It is only in exceptional circumstances that warrantless access is and should be permitted.
I therefore urge the Parliament of Canada to confirm the Spencer principles and clarify the very narrow scope of circumstances in which law enforcement can obtain subscriber information without a warrant.