Pizza Pizza gave police customers’ information

Police investigators matched intercepted phone numbers to names of pizza chain clients

Call Pizza Pizza and — hey, hey, hey, as the old jingle went — you might just end up with your name and address in police records.

Amid a major criminal investigation that led to dozens of arrests last year, the popular pizza chain voluntarily searched its internal data and handed over customers’ personal information to Toronto police investigators, the Star has learned.

Officers used the technique in Project Kraken, an investigation into guns, gangs and drugs that resulted in more than 70 arrests last June. Seven of those charged were tow-truck operators, police said at the time. The accused are awaiting trial.

During the investigation, Toronto police obtained telephone numbers from phone intercepts. Officers then took those numbers to Pizza Pizza to get any matching customers’ names.

None of the accused were identified using the technique.

Rather, it was used to identify people associated with targets of the investigation. It is not clear how many people were identified.

Two sources connected to the case told the Star police used the technique. The Star is not identifying the sources because they can’t publicly speak about material that is part of disclosure.

“Pizza Pizza is providing contactless delivery of pizzas and warrantless delivery of your private information,” Michael Bryant, executive director and general counsel of the Canadian Civil Liberties Association, said in an interview.

Bryant was responding after the Star shared details of the technique.

“I think it’s not reasonable to think that people who provide their phone number and address to Pizza Pizza for the purposes of getting a pizza expect that, or consent to, that information being shared with others, let alone the police,” he said.

The Star posed a number of questions to Toronto police about the technique, including how often it is used and if other businesses have voluntarily given police similar information.

Police did not answer any of the Star’s questions. In an email, a police spokesperson said the service “will not be commenting on this story.”

The Star also asked Pizza Pizza for comment. In an emailed response, the company said it is “committed to protecting the personal information provided by customers. Our Privacy Policy details how we protect and use customer data in the fulfilment of customer orders.”

Pizza Pizza’s privacy policy states the company “reserves the right to access and/or disclose personal information where required to comply with applicable laws or lawful government requests.”

Customers, the policy states, consent with every order made to the “collection, use and disclosure of your information by Pizza Pizza in accordance with” its policy terms.

The company, which has over 700 outlets across the country, did not answer questions about how often and where the company is sharing customer information with police.

Police routinely obtain warrants to access personal information from businesses, which requires officers to make a compelling case to a justice of the peace or judge for access.

In this case, multiple officers simply asked a contact at Pizza Pizza to look up phone numbers.

Because the people identified are not facing charges, the technique may not be publicly disclosed or tested in court. What has been tested, all the way to the Supreme Court of Canada, is whether it is constitutional for internet service providers to voluntarily hand over information to police without a warrant.

In a 2014 ruling, in which police asked for subscriber information in a child pornography case, the court ruled the search was done without judicial authorization and was thus an unlawful violation of the charter — which says everyone has the “right to be secure against unreasonable search or seizure.” However, due to the seriousness of the case, the evidence gained from the search was allowed.

Police “were acting by what they reasonably thought were lawful means to pursue an important law enforcement purpose.

“The nature of the police conduct in this case would not tend to bring the administration of justice into disrepute,” the court said in its decision.

Pizza Pizza “handing this information over to police without a warrant is not with (a customer’s) meaningful consent,” said Bryant, and allows for police to go on “fishing expeditions.”

In a statement to the Star, Brian Beamish, Ontario’s information and privacy commissioner, said while his office “supports public institutions in their work to maintain public safety, I would be concerned if police were routinely requesting disclosure of personal information without a warrant, particularly if they were collecting the personal information of those who are not themselves the subject of an investigation.”

He added: “I would consider this to be an erosion of the public’s fundamental right to privacy.”

Businesses are legally required in response to court orders to “aid a law enforcement investigation, and for health or safety reasons,” Beamish said.

“If the disclosure appears likely to intrude on a reasonable expectation of privacy, the institution should not disclose without a court order.

“The only exception to this is where there are urgent circumstances that do not allow the time to seek a court order. Urgent circumstances may include cases involving a kidnapping, escaped violent offender, or missing vulnerable person.”

What private businesses disclose about individuals is a federal matter.

In response to Star queries, a spokesperson for the Office of the Privacy Commissioner of Canada said the office could not comment on this specific scenario involving Pizza Pizza because it had not examined it “in detail.”

The federal Personal Information Protection and Electronic Documents Act generally requires commercial organizations, including restaurants, to obtain consent for disclosure of personal information.

There are some exceptions, including disclosure to government under “lawful authority to obtain the information,” the spokesperson told the Star.

As well, “organizations can also disclose personal information without the individual’s knowledge or consent in order to comply with a subpoena or warrant.”

There are a number of “wellfounded” complaints among case decisions on the federal privacy watchdog’s website over businesses and their employees improperly sharing personal telephone numbers, and other information, to third parties.

The watchdog can go to court in cases where there is a failure to comply, but does not have the power to issue orders or fines.

In 2014, the Canadian Civil Liberties Association launched a challenge of the federal law that applies to businesses, arguing the language is too broad and gives governments a back door to personal information that should be protected or require a warrant to obtain. The challenge is still winding its way through court.

Bryant told the Star he is “surprised” by how many businesses and professionals “think that they ought to be willingly participating as an arm of the state in a criminal investigation.”

There is also, said Bryant, a “pressure that comes with the police asking for information, and many businesses will hand it over because they think that that’s the Good Samaritan thing to do, when in fact they’re betraying the privacy of their customers and they’re being roped into something that they shouldn’t have to be roped into.”