Police seeking cell tower data violated rights: judge,

Warrant for 40,000 customers’ cellphone records ‘far beyond what was reasonably necessary’

An Ontario court judge has ruled that Peel police violated the Charter of Rights when they requested a “tower dump” of records from about 40,000 telecommunications customers.

Justice John Sproat of the Ontario Superior Court issued his decision Thursday morning. The case was brought to court by Telus Corp. and Rogers Communications Inc. in 2014, after Peel police issued a production order — a legal warrant for documents approved by a judge — for the cellphone records of tens of thousands of customers in order to aid in an investigation into a string of jewelry store heists.

In Thursday’s ruling, Sproat found the orders issued by Peel police violated Telus and Rogers customers’ privacy and their Charter rights, particularly the section of the law that relates to unreasonable search.

“Whether and when someone chooses to contact a divorce lawyer, a suicide prevention hotline, a business competitor or rehabilitation clinic obviously impacts privacy concerns,” Sproat wrote in his ruling.

“The disclosure of personal information of the production orders required went far beyond what was reasonably necessary to gather evidence concerning the commission of the crimes under investigation.”

Representatives from both Telus and Rogers ap- plauded Sproat’s decision.

“Protecting our customers’ privacy is vitally important to Telus,” Telus’s chief data and trust officer Pam Snively said in a statement. “We think the Court has struck an appropriate balance between the need to protect individuals’ privacy and the need for police to obtain information that will assist in their investigation of criminal activity.”

“We went to court because we wanted to ensure our customers’ privacy rights are protected and that there are ground rules for the scope of what law enforcement is able to request and access,” said David Watt, chief privacy officer for Rogers, in a statement.

John Lawford, the executive director for the Public Interest Advocacy Centre, called the ruling a win not merely for privacy advocates, but for “people who use cellphones.”

“It’s a good decision,” he told the Star. “Probably about the best one you could get considering it may actually result in some changes in practice.”

So-called “tower dumps” require telecommunications companies to release records of cellphones that made a connection to certain cell towers, which have a range of about 10-25 kilometres in the country and less than two kilometres in the city, Sproat’s ruling explained.

In this specific order, which Sproat

“It’s a good decision. Probably about the best one you could get considering it may actually result in some changes in practice.” JOHN LAWFORD PUBLIC INTEREST ADVOCACY CENTRE

called “particularly large and onerous,” Peel police told Rogers and Telus to turn over hundreds of thousands of records — including the name, address and billing information — of more than 40,000 customers who used a number of cell towers in the area of their investigation. If both the caller and the recipient were customers of either Telus or Rogers, then information on the recipient was also requested.

These types of orders are becoming a routine part of police work, Sproat noted. In their affidavits, Telus said it responded to 2,500 such requests and Rogers said it produced 13,800 “files” in 2013 alone.

While Sproat acknowledged that the information can help police locate suspects near the scene of a crime, he said that customers have a right to expect that their cellphone information is private, and that Rogers and Telus have an obligation under privacy law to protect that information.

Andrea Slane, who researches technolo- gy and privacy law at the University of Ontario Institute of Technology, said Sproat’s ruling was unusual because the judge decided to hear the case even after Peel police withdrew the initial order.

“That shows that there’s actually been a shift in thinking about privacy,” Slane told the Star.

In addition to ruling that Peel police violated the Charter, Sproat issued guidelines for how courts should handle police requests for customer data in the future.

Police should first and foremost seek to minimize the amount of data collected, Sproat cautioned. They should only seek information that provides evidence that a crime has been committed, and limit data requested as much as possible, for instance, by narrowing the locations and time frame of the tower dump.

Sproat wrote that courts should make sure that police understand these limits, and that all information requested is relevant to the case.

Slane, whose research was cited in the 2014 Supreme Court ruling that forbid telecoms from disclosing customer identities without a warrant, said these guidelines extend protection to all customer data collected, a big step for privacy law.

But she was concerned that one of Sproat’s guidelines might ask too much of telecom companies, by requiring them to investigate their own customers.