Is an IP address personal information? According to the Supreme Court of Canada, it is.
Here’s an interesting question: is an IP address considered personal information? Surprisingly, opinion does vary on this. For those who are into the privacy side of things, you’ll probably find that, more often then not, people will say that this information is, in fact, personal information. In some other circles, however, opinions can be more mixed with some thinking that an IP address isn’t personal information. After all, in order to access a website, an IP address is needed to access it (whether it’s your IP address or the IP address of the proxy server you use).
Personally, over the last several years, I thought an IP address is personal information, though it wasn’t necessarily something that has been decided by a court. So, we are operating on a sort of legal grey area where it probably is personal information, but there isn’t much in the way of caselaw that confirms this.
Recently, however, that has changed. The Supreme Court of Canada has made a ruling saying that, yes, an IP address is personal information. From the CBC:
The Supreme Court of Canada made a key privacy ruling Friday that means police must now first have a warrant or court order to obtain the numbers making up a person or organization’s IP address.
The top court was asked to consider whether an IP address alone, without any of the personal information attached to it, was protected by an expectation of privacy under the Charter.
If you happen to be looking at this kind of ruling and find yourself going back and forth on it, well, you aren’t alone. The Supreme Court of Canada was actually split on this decision. In fact, it was a 5 to 4 decision, meaning that this was a very narrow ruling. More from the CBC:
Writing for the majority, Justice Andromache Karakatsanis wrote that an IP address is “the crucial link between an internet user and their online activity.”
“Thus, the subject matter of this search was the information these IP addresses could reveal about specific internet users including, ultimately, their identity.”
Writing for the four dissenting judges, Justice Suzanne Côté disagreed with that central point, saying there should be no expectation of privacy around an IP address alone.
So, this wasn’t exactly an easy question for the Supreme Court to answer.
The thing is, the background of the case is a bit clearer which direction the courts should’ve gone in my opinion.
The court’s decision is based on the case of Andrei Bykovets, who was convicted of 14 online fraud offences, for purchases made from an Alberta liquor store.
In 2017, the Calgary Police Service investigating the alleged crime discovered that the store’s online sales were managed by Moneris, a third-party payment processing company.
Police contacted Moneris and asked for the IP address associated with the purchases, without providing a court order or warrant. Moneris gave two IP addresses to the police.
Yeah, for something like that, a court order would naturally be needed. Essentially, the core question is, does police need a warrant to obtain subscriber information? This is a question that has been around since the very beginning of my news writing career. For instance, just check out my article on the Lawful Access debate clear back in 2007. Back in those ancient times, we were still grappling with the question of whether or not authorities needed a warrant to obtain subscriber information.
This revolved around the concept of “lawful access” which was part of the surveillance legislation tabled by the Paul Martin Liberal government (yeah, THAT long ago!). It was a hugely controversial debate at the time, but it also eventually became apparent that it was also a non-partisan issue. This is thanks to the Harper Conservative government eventually taking over and tabling a nearly identical bill (which, fortunately, never passed). As expected, the bill got considerable pushback.
There were plenty of interested stakeholders including the then-called Canadian Recording Industry Association (CRIA). At the time, they were hoping to import mass file-sharing lawsuits into Canada from the United States and sue their music fans en-mass. A precedent that says that an IP address and subscriber information can be obtained, unhindered, would’ve been huge for them because they were just tasting the concept of turning fans into walking dollar signs.
Luckily, mass file-sharing lawsuits were shot down in the courts and those surveillance bills never came to be. Indeed, in the years since, there have been efforts to just shirk the laws and just demand subscriber information since then. Those efforts have run into roadblocks, however.
What this recent court ruling did was actually grant a significant layer of privacy for internet users. In order for police to be surveilling you, they need a warrant first. Honestly, this is how it should be. Police generally need a warrant to enter into a dwelling without the homeowners permission. The same should be said for tracking online activity.
Obviously, the thing to remember is that, although this is significant, it doesn’t mean that Canadian’s are suddenly going to find that their personal information is protected, full stop. After all, Canadian privacy laws are quite toothless. If privacy laws are broken, the only real repercussion is strongly worded letters from the privacy commissioners. Beyond that, the victims have to file a lawsuit in order to hold a company financially accountable.
This is why I have been a strong advocate for real privacy reform for years now. It has been badly needed since at least 2018 and, so far, the Canadian government has been reluctant to table and pass critically basic privacy laws that takes into account how things work in the modern era.
Drew Wilson on Twitter: @icecube85 and Facebook.
