Article written by: Ulfa Ismail
About Dr. Irma Spahiu
Dr. Irma Spahiu (BA, LLB, MBA, LLM, PhD) is an Assistant Professor in the Department of Political Science at the University of Toronto Scarborough. She teaches various undergraduate courses in the field of public law including POLC36 “Law and the Public Policy” POLC32 “The Canadian Judicial System” and POLC30 “Law, Politics and Technology”.
Professor Spahiu specializes in informational and technology law. She supports student groups on campus, such as the Law Society of UTSC, by judging undergraduate moots and supporting publication initiatives for students interested in the legal field.
R. v. Bykovets: A Summary
An Internet Protocol (IP) address is a string of numbers associated with a specific computer or computer network. IP addresses allow computers to send and receive information. On the other hand, Internet service providers (ISPs) hold the subscriber information, that is, the name and address of the customer registered to each IP address.
As per the Supreme Court of Canada’s 2014 decision in R. v. Spencer, law enforcement officers are required to obtain a unique warrant, called a Spencer warrant, prior to accessing subscriber information from ISPs.
In a September 2017 investigation into fraudulent liquor store purchases, Calgary Police obtained two IP addresses from Moneris, a payment processing company. After obtaining the IPs linked to these purchases, police obtained a Spencer warrant, compelling the internet service provider Telus to identify the person(s) registered to each IP address. Mr. Andrei Bykovets was one of two people responsible for these purchases. He was arrested and charged with 33 offences related to the possession and use of third parties’ credit cards and personal identification documents as well as the possession and storage of firearms. At trial, he was convicted of 14 of these offences.
On appeal, Bykovets argued that in requesting IP addresses from Moneris without a warrant, police had violated his Section 8 Charter rights, which protect against unreasonable search and seizure. The Alberta Court of Appeal rejected the appeal, agreeing with the trial judge who ruled that Bykovets had no "reasonable expectation" of privacy to his IP addresses.
Bykovets appealed to the Supreme Court of Canada in 2024, arguing again that police infringed upon his Section 8 rights. Since IP addresses can reveal personal and biographical information, he had a reasonable expectation of privacy to his IP address. The majority of the court (in a ratio 5:4) agreed, resulting in his appeal being accepted, effectively setting aside his convictions and ordering a new trial.
As a result, Canadian law enforcers must now seek permission from the courts, through a warrant, in order to obtain an IP address. Interestingly, prior to this decision, private companies would typically provide law enforcers with IP addresses as requested.
R. v. Bykovets: A conversation with Professor Spahiu
Ulfa Ismail: What are the main issues of R. v. Bykovets? Did the majority and dissenting judges at the Supreme Court of Canada define these issues differently?
Irma Spahiu:
This case redefines the legal understanding of the reasonable expectation of privacy. The courts consider various factors to determine whether a reasonable expectation of privacy exists in specific situations.
The main issues in this case revolve around what constitutes private information and whether or not IP (Internet Protocol) addresses fall into this category. In Bykovets, two key factors were central: (1) the subject matter of the search (whether information was private and therefore an expectation of privacy existed) and (2) whether Mr. Bykovets' subjective expectation of privacy was objectively reasonable. In defining the subject matter of the search, the Court emphasized that judges must consider both the information itself and the further personal details it may reveal or infer. An IP address serves as a digital footprint that enables the state to trace an individual’s Internet activity. While an IP address alone may not disclose personal information, it is "the key" to uncovering a user’s identity and online behavior. This potential to reveal personal or biographical information is sufficient to engage Section 8 of the Charter.
Applying this framework, the majority concluded that under Section 8 of the Charter, Canadians have a reasonable expectation of privacy concerning their IP addresses.
The understanding of the legal expectation of privacy helps clarify the technical legal issue concerning the warrant process and procedural fairness. Specifically, [was] the warrant obtained on-time or too late in the investigation process? The majority argued that the warrant-seeking process occurred too late, raising concerns about adherence to procedural safeguards and the implications for the investigation’s legality.
It is interesting to see that judges significantly differed in their technical opinion on what is an IP address (which caused the narrow split 5:4 in the final decision). The case demonstrates that legal experts, including judges, may not always grasp the intricacies of technical processes. Yet, understanding these is crucial in a world of rapidly evolving technology...As demonstrated in this case, to render fair and informed decisions, judges must step beyond their legal expertise and embrace a broader, interdisciplinary approach.
Despite the fact that the judges shared different views on what constitutes privacy, and how IP addresses fit into that categorization, they agreed on the importance of privacy and its protection.
This case offers a unique understanding of privacy and it is the first of its kind in Canada. Although there have been lots of discussions in the past about privacy and private information, Canadian jurisprudence had never defined IP addresses as personal information. Bykovets now establishes that the IP addresses themselves attract a reasonable expectation of privacy, at least in the criminal and public authority context in relation to section 8 of the Charter.
Ulfa Ismail: What is the relationship between informational privacy and the values of protection? How does R. v. Bykovets highlight this relationship?
Irma Spahiu:
The concept of informational privacy has been central in many legal cases. It refers to the protection of personal data and the control individuals have over their own information, including the data they generate daily—whether through texts, emails, or data collected by governments, companies, and organizations. This vast amount of stored information raises the important question of who truly owns this information and who is entitled to use it.
There is a lot of research that describe informational privacy as closely tied to autonomy, independence, and dignity. Autonomy allows individuals to make decisions that shape their lives, including the enjoyment of many fundamental rights, and without the protection of personal information, these fundamental rights are undermined. Courts have recognized the importance of safeguarding personal data as a human rights issue.
Section 8 of the Charter has been broadly interpreted to support privacy protections, as highlighted in rulings like this. In addition, statutory protections have been introduced since the adoption of the Charter. For instance, privacy became a key legal focus with the Privacy Act in 1983, and later with PIPEDA [Personal Information Protection and Electronic Documents Act] in 2000, emphasizing its necessity in the digital age...Privacy breaches have legal, social, and political ramifications, and can seriously damage a person’s dignity—not only through legal consequences, as seen in the Bykovets case, but also through social implications on personal relationships and personal reputation.
Ulfa Ismail: This decision was a 5-4 split between judges, does this indicate that the balancing of privacy rights with the values of protection remains contentious in Canada?
Irma Spahiu:
Yes. The ratio in the decision indicates that judges struggled to reach an agreement in making the decision, reflecting a contentious debate. It is important to note that judges often discuss matters informally before making their decisions.
If we look back at privacy in Canada, we notice that is a relatively recent legal value, unlike other rights, such as property rights. In fact, the first case to define privacy protections was Hunter v. Southam in 1984, where the Supreme Court of Canada ruled that Section 8 includes privacy protections.
In the digital age, the consequences of sharing personal information are not fully understood, even by legal scholars. The law doesn’t recognize an absolute right to privacy, but rather an expectation of privacy, which can vary widely. One person’s expectations might differ from another person’s.
The dissenting judges argued that privacy comes with a cost. They highlighted that the need for police to obtain warrants earlier in the process contributes to delays and costs...The central issue for the judges was whether privacy protections are justified, especially when balancing urgent cases—like those involving child exploitation and pornography—that now require additional steps. This complex balancing act presents significant challenges in reconciling privacy concerns with law enforcement needs.
Ulfa Ismail: In prior jurisprudence, it was determined that “biographical core” information, which is protected under section 8, not only protects information that can reveal a person's identity, but also information that reveals the intimate details of their lifestyle and personal choices.
How can we conceptualize the right to privacy regarding internet-activity data given that the internet is a public forum? How does Artificial Intelligence (AI) play into this debate?
Irma Spahiu:
It is important to recognize that "biographical core" information goes beyond what individuals produce; it also includes details about their lifestyles that are collected through their interactions with others. A person leaves many traces while engaging in many activities, like shopping, travelling, banking, etc.
While the internet is public and facilitates rapid information spread, it also enables the creation of misleading content. In the age of AI, deepfake videos can distort reality, as seen with fake clips of political figures like Kamala Harris during the election campaign in the US. Such content can influence public opinion, with serious social, political and legal consequences.
Debate also surrounds how corporations and social media platforms collect information. They argue that data is gathered at a "meta" level, meaning it shouldn’t identify individuals. However, when various data points are combined, they can lead to someone's identification. With the proliferation of connected devices like smartphones and smart appliances, we don’t always know what data is collected or how it is used.
Individuals must be aware of their relationship with the internet. While it offers many opportunities, it also comes with significant risks. Sharing information online doesn’t guarantee privacy, and many people overlook the potential dangers in favor of the perceived benefits.
Ulfa Ismail: With police now being required to seek permission from the courts before obtaining an IP address, there’s concern that this process will slow down law enforcement and overburden the courts. What are the potential risks of this administrative burden?
Irma Spahiu:
With this case, courts [require] earlier permission (through a warrant) in an investigation, which potentially leads to delays. In time-sensitive cases, crucial information might be lost before it can be tracked down. Criminals are often skilled at erasing evidence, especially in sensitive cases like fraud, terrorism, and child pornography. While every case is unique, law enforcement’s ability to act swiftly has been restricted.
Additionally, warrants may be obtained for cases that don’t progress far, adding to the courts' burden. While not the most pressing issue, the time, resources, and costs involved in obtaining warrants contribute to the challenges faced.
Ulfa Ismail: What are the potential future implications of the Supreme Court of Canada’s decision?
Irma Spahiu:
The implications of this decision are far-reaching. By strengthening privacy protections, the majority has established a lasting precedent for safeguarding IP addresses. Given that nearly everyone, including children, uses computers, these protections are crucial. Increased judicial oversight ensures decisions are not solely reliant on police judgment, fostering fairer outcomes rooted in legal reasoning.
Supreme Court of Canada decisions often signal shifts to other branches of government. This ruling may encourage the government to prompt Parliament to amend legislation regarding IP addresses, including refining their definition and privacy protections.
Ulfa Ismail: Will these implications have disproportionate effects on Canadians?
Irma Spahiu:
Definitely. Certain groups will benefit much more than others. Research highlights systemic biases in law enforcement interactions with communities such as Black, Indigenous, and religious minorities, where abuses of power are more prevalent. Strengthened privacy protections can help curb these practices, offering marginalized groups greater safeguards against biased enforcement.
Additionally, individuals who rely heavily on the internet for work will gain enhanced protection over their data and privacy.
This decision may also impose stricter accountability on employers, ensuring they face consequences for breaches of worker privacy.
Bibliography
Supreme Court of Canada. “R. v. Bykovets - SCC Cases.” Scc-csc.ca, 2024. https://decisions.scc-csc.ca/scc-csc/scc-csc/en/item/20302/index.do.
See the full article with citations: https://docs.google.com/document/d/1x0fnFNZhdu-vm2szeGdpIl9nlUnZydfzz7_4lZ5vGbI/edit?usp=sharing
Comments