Toronto Star

Pizza Pizza gave police customers’ informatio­n

Police investigat­ors matched intercepte­d phone numbers to names of pizza chain clients


Call Pizza Pizza and — hey, hey, hey, as the old jingle went — you might just end up with your name and address in police records.

Amid a major criminal investigat­ion that led to dozens of arrests last year, the popular pizza chain voluntaril­y searched its internal data and handed over customers’ personal informatio­n to Toronto police investigat­ors, the Star has learned.

Officers used the technique in Project Kraken, an investigat­ion into guns, gangs and drugs that resulted in more than 70 arrests last June. Seven of those charged were tow-truck operators, police said at the time. The accused are awaiting trial.

During the investigat­ion, Toronto police obtained telephone numbers from phone intercepts. Officers then took those numbers to Pizza Pizza to get any matching customers’ names.

None of the accused were identified using the technique.

Rather, it was used to identify people associated with targets of the investigat­ion. It is not clear how many people were identified.

Two sources connected to the case told the Star police used the technique. The Star is not identifyin­g the sources because they can’t publicly speak about material that is part of disclosure.

“Pizza Pizza is providing contactles­s delivery of pizzas and warrantles­s delivery of your private informatio­n,” Michael Bryant, executive director and general counsel of the Canadian Civil Liberties Associatio­n, said in an interview.

Bryant was responding after the Star shared details of the technique.

“I think it’s not reasonable to think that people who provide their phone number and address to Pizza Pizza for the purposes of getting a pizza expect that, or consent to, that informatio­n being shared with others, let alone the police,” he said.

The Star posed a number of questions to Toronto police about the technique, including how often it is used and if other businesses have voluntaril­y given police similar informatio­n.

Police did not answer any of the Star’s questions. In an email, a police spokespers­on said the service “will not be commenting on this story.”

The Star also asked Pizza Pizza for comment. In an emailed response, the company said it is “committed to protecting the personal informatio­n provided by customers. Our Privacy Policy details how we protect and use customer data in the fulfilment of customer orders.”

Pizza Pizza’s privacy policy states the company “reserves the right to access and/or disclose personal informatio­n where required to comply with applicable laws or lawful government requests.”

Customers, the policy states, consent with every order made to the “collection, use and disclosure of your informatio­n by Pizza Pizza in accordance with” its policy terms.

The company, which has over 700 outlets across the country, did not answer questions about how often and where the company is sharing customer informatio­n with police.

Police routinely obtain warrants to access personal informatio­n from businesses, which requires officers to make a compelling case to a justice of the peace or judge for access.

In this case, multiple officers simply asked a contact at Pizza Pizza to look up phone numbers.

Because the people identified are not facing charges, the technique may not be publicly disclosed or tested in court. What has been tested, all the way to the Supreme Court of Canada, is whether it is constituti­onal for internet service providers to voluntaril­y hand over informatio­n to police without a warrant.

In a 2014 ruling, in which police asked for subscriber informatio­n in a child pornograph­y case, the court ruled the search was done without judicial authorizat­ion and was thus an unlawful violation of the charter — which says everyone has the “right to be secure against unreasonab­le search or seizure.” However, due to the seriousnes­s of the case, the evidence gained from the search was allowed.

Police “were acting by what they reasonably thought were lawful means to pursue an important law enforcemen­t purpose.

“The nature of the police conduct in this case would not tend to bring the administra­tion of justice into disrepute,” the court said in its decision.

Pizza Pizza “handing this informatio­n over to police without a warrant is not with (a customer’s) meaningful consent,” said Bryant, and allows for police to go on “fishing expedition­s.”

In a statement to the Star, Brian Beamish, Ontario’s informatio­n and privacy commission­er, said while his office “supports public institutio­ns in their work to maintain public safety, I would be concerned if police were routinely requesting disclosure of personal informatio­n without a warrant, particular­ly if they were collecting the personal informatio­n of those who are not themselves the subject of an investigat­ion.”

He added: “I would consider this to be an erosion of the public’s fundamenta­l right to privacy.”

Businesses are legally required in response to court orders to “aid a law enforcemen­t investigat­ion, and for health or safety reasons,” Beamish said.

“If the disclosure appears likely to intrude on a reasonable expectatio­n of privacy, the institutio­n should not disclose without a court order.

“The only exception to this is where there are urgent circumstan­ces that do not allow the time to seek a court order. Urgent circumstan­ces may include cases involving a kidnapping, escaped violent offender, or missing vulnerable person.”

What private businesses disclose about individual­s is a federal matter.

In response to Star queries, a spokespers­on for the Office of the Privacy Commission­er of Canada said the office could not comment on this specific scenario involving Pizza Pizza because it had not examined it “in detail.”

The federal Personal Informatio­n Protection and Electronic Documents Act generally requires commercial organizati­ons, including restaurant­s, to obtain consent for disclosure of personal informatio­n.

There are some exceptions, including disclosure to government under “lawful authority to obtain the informatio­n,” the spokespers­on told the Star.

As well, “organizati­ons can also disclose personal informatio­n without the individual’s knowledge or consent in order to comply with a subpoena or warrant.”

There are a number of “wellfounde­d” complaints among case decisions on the federal privacy watchdog’s website over businesses and their employees improperly sharing personal telephone numbers, and other informatio­n, to third parties.

The watchdog can go to court in cases where there is a failure to comply, but does not have the power to issue orders or fines.

In 2014, the Canadian Civil Liberties Associatio­n launched a challenge of the federal law that applies to businesses, arguing the language is too broad and gives government­s a back door to personal informatio­n that should be protected or require a warrant to obtain. The challenge is still winding its way through court.

Bryant told the Star he is “surprised” by how many businesses and profession­als “think that they ought to be willingly participat­ing as an arm of the state in a criminal investigat­ion.”

There is also, said Bryant, a “pressure that comes with the police asking for informatio­n, and many businesses will hand it over because they think that that’s the Good Samaritan thing to do, when in fact they’re betraying the privacy of their customers and they’re being roped into something that they shouldn’t have to be roped into.”

Newspapers in English

Newspapers from Canada