Case Report – RCMP allowed to access flight manifest without a warrant

On November 6th, the Nova Scotia Court of Appeal held that the RCMP did not conduct an unreasonable search by reviewing a WestJet passenger manifest without a warrant and without making a formal request.

The context and the background

The issue of law enforcement’s access to personal information held by business organizations has arisen in a number of recent criminal cases, and it is becoming common for courts to judge the reasonableness of a police search in light of standards set by PIPEDA. PIPEDA restricts regulated organizations from disclosing personal information without consent, but includes the following key exemption:

7(3) For the purposes of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge and consent of the individual only if the disclosure is…

(c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that

(i) it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs,

(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or

(iii) the disclosure is requested for the purpose of administering any law of Canada or a province…

In this case, the RCMP reviewed a passenger manifest from a domestic flight, identified a passenger who had paid by cash shortly before the flight and who only had one piece of luggage and proceeded to search that passenger’s luggage. It found drugs and laid charges.

Trial judge finds Charter breach

In December of last year, Mr. Justice Simon MacDonald of the Nova Scotia Supreme Court held the RCMP breached PIPEDA because it did not make a “request” required by section 7(3)(c.1) given its “cozy” relationship with WestJet:

It might be a fair comment to say the officers had assumed they had permission to look at the manifest from their daily discussions and associations with the staff at Westjet.  However, in my mind that is not a satisfactory answer to the problem.  There were certain obligations upon the RCMP officers in reviewing the manifest which were legislated under PIPEDA and applied when they went to look at this manifest without a warrant.  Mr. Plimmer said Westjet put a protocol on procedures in place for the police to follow in order to see manifests.  The police were aware of the procedure they had to follow.  I find they didn’t do so in this case, but rather cavalierly walked into Westjet and simply started looking at manifests.

In addition to signaling that the procedural requirements in section 7(3)(c.1) are likely to be read strictly, the trial judgement was notable for its close consideration of WestJet’s privacy policy. The policy said that WestJet might be “required by legal authorities” to disclose personal information without consent, but did not say that WestJet would voluntarily cooperate with law enforcement. MacDonald J. said the policy “seems to emphasize that WestJet would only collect and disclose what is required by law and nothing more.” This weighed in favour of finding the search to be unreasonable and therefore unconstitutional.

MacDonald J. then excluded the evidence based on an application of the Collins test.

Court of Appeal disagrees

The Court of Appeal held that MacDonald J. erred by finding that the RCMP did not have legal authority for the collection of information and by equating a breach of PIPEDA with a breach of the Charter right to be free from unreasonable search and seizure. It then conducted its own contextual expectation of privacy analysis and held that section 8 of the Charter was not engaged in the circumstances. It noted the following in its analysis:

  • It could not infer a subjective expectation of privacy given the information used by the RCMP was not particularly private – that is, the defendant purchased a ticket from Vancouver to Halifax at the last minute with cash and checked a single bag all in public view.
  • The place searched was a third-party’s office, not a home or not even a business premises.
  • Westjet’s privacy policy, with its reference to being “required by authorities” to disclose certain information, was nonetheless a warning to passengers.
  • Given the exception to the consent rule in section 7(3)(c.1)(ii), PIPEDA does not support an expectation of privacy.
  • The police tactic was limited, in that the RCMP relied on a drug courier profile and sought only information that fit that profile.
  • The information collected by the RCMP did not go to the defendant’s “biographical core” of information. The Court said it “amounted to no more than Westjet’s record of Mr. Chehil’s public activities in transacting business with the airline.”
  • The fact that the passenger record had a space where more sensitive personal information could be entered (e.g. food preferences) did not support an expectation of privacy. The Court said this fact was too theoretical to count.

Thanks to David Fraser for the tip on this important case.

R. v. Chehil, 2009 NSCA 111.

Case Report – Another subscriber data search challenge dismissed

On February 18th, the Ontario Superior Court of Justice held that the police conducted a lawful search by asking an ISP for a subscriber’s name and residential address in order to link that information with a known IP address. Unlike in its February 10th decision in Wilson, the Court accepted that the disclosure of a subscriber’s name and residential address is revealing of the “details of the lifestyle and personal choices of [an] individual” because it allows for the identification of an anonymous internet user. The Court nonetheless held the applicant lacked a reasonable expectation of privacy in the information given the terms of the contract his mother (and co-resident) had entered into with the ISP.

R. v. Vasic, 2009 CanLII 6842 (ON S.C.).

Case Report – Ont. S.C.J. okays warrantless search of subscriber data

On February 10th, the Ontario Superior Court of Justice dismissed a Charter application that challenged a letter request made by the police to an internet service provider for the name and address of an account holder associated with a specific IP address at a specific point in time.

The Court held that the applicant had no expectation of privacy in the information disclosed, which the police used to obtain a warrant and lay child pornography charges. The Court narrowly construed the personal information collected in the search as one’s name and address (or the name and address of a cohabiting spouse) and held that this information is not “biographical information” that is protected by the Charter. It also relied on the service provider’s contract of service, which expressly permitted the transfer:

In addition, in this case the terms of the contract with the internet provider is one of the factors to be considered in assessing whether the asserted expectation of privacy is reasonable in the totality of the circumstances. That contract includes an agreement that the service provider could disclose any information necessary to satisfy any laws, regulations or other governmental request from any applicable jurisdiction. Further, the agreement contained a provision that by subscribing to the service, one consents to the collection, use and disclosure of personal information as described in the Bell Customer Privacy Policy and the Bell Code of Fair Information Practices. This privacy statement includes a provision that Bell Canada may also provide personal information to law enforcement agencies. Therefore by virtue of the contractual terms on which the internet service was provided an expectation of privacy is not reasonable

Thank you to David Fraser for digging up a copy of the decision!

R. v. Wilson (10 February 2009), 4191/08 (Ont. S.C.J.).

Case Report – Challenge to “lawful access” exemption in privacy legislation dismissed

On January 26th, the Saskatchewan Provincial Court dismissed a Charter challenge to a provision in the Saskatchewan Freedom of Information and Protection of Privacy Act that allows the Saskatchewan government and its agencies to answer law enforcement requests for personal information without obtaining individual consent.

The police identified an IP address of a computer used to share child pornography on the internet and made a warantless request for subscriber records to SaskTel in order to identify the accused as being associated with the computer. SaskTel provided the information without consent based on the exemption in section 29(2)(g) of Saskatchewan FIPPA, a relatively characteristic “lawful access” provision – i.e. one that allows an entity bound by privacy legislation to answer law enforcement requests for personal information. The accused claimed that this permissive provision allowed the police to conduct a search in violation of two Charter rights: (1) the section 7 right not to be deprived of liberty except in accordance with the principles of fundamental justice (on the basis of the provision’s overbreadth and vagueness); and (2) the section 8 right to be free from unreasonable search and seizure.

The Court dismissed both claims with little reasoning. It quoted extensively from the Crown’s factum and held that the accused person’s position was inconsistent with the Supreme Court of Canada’s judgement in R. v. Plant and the Saskatchewan Court of Appeal’s judgement in R. v. Cheung. The Court’s decision will lack authority because the Court did not fully engage in the issues, but it does show that the “lawful access” issue is very live.

R. v. Trapp, 2009 SKPC 5.

Case Report – Court excludes evidence for unlawful police access to passenger manifest

On December 19, the Nova Scotia Supreme Court excluded evidence supporting drug trafficking charges after finding that the RCMP breached PIPEDA by reviewing a WestJet passenger manifest without making a formal request.

The issue of law enforcement’s access to personal information held by business organizations has arisen in a number of recent criminal cases, and it is becoming common for courts to judge the reasonableness of a police search in light of standards set by PIPEDA. PIPEDA restricts regulated organizations from disclosing personal information without consent, but includes the following key exemption:

7(2) For the purposes of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowedge and consent of the individual only if the disclosure is…

(c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that

(i) it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs,

(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or

(iii) the disclosure is requested for the purpose of administering any law of Canada or a province…

In this case, the RCMP reviewed a passenger manifest from a domestic flight, identified a passenger who had paid by cash shortly before the flight and who only had one piece of luggage and proceeded to search that passenger’s luggage. It found drugs and laid charges.

The Court held the RCMP breached PIPEDA because it did not make a “request” required by section 7(3)(c.1) given its “cozy” relationship with WestJet:

It might be a fair comment to say the officers had assumed they had permission to look at the manifest from their daily discussions and associations with the staff at Westjet.  However, in my mind that is not a satisfactory answer to the problem.  There were certain obligations upon the RCMP officers in reviewing the manifest which were legislated under PIPEDA and applied when they went to look at this manifest without a warrant.  Mr. Plimmer said Westjet put a protocol on procedures in place for the police to follow in order to see manifests.  The police were aware of the procedure they had to follow.  I find they didn’t do so in this case, but rather cavalierly walked into Westjet and simply started looking at manifests.

In addition to signaling that the procedural requirements in section 7(3)(c.1) are likely to be read strictly, the judgement is notable for its close consideration of WestJet’s privacy policy. The policy said that WestJet might be “required by legal authorities” to disclose personal information without consent, but did not say that WestJet would voluntarily cooperate with law enforcement. The Court said the policy “seems to emphasize that WestJet would only collect and disclose what is required by law and nothing more.” This weighed in favour of finding the search to be unreasonable and therefore unconstitutional.

The Court then excluded the evidence based on an application of the Collins test. In characterizing the breach as serious it said, “It is not the rights of a drug trafficker here that I am protecting.  It is the rights of a member of society who chooses to give personal information to an airline ticket agent which is recorded on a flight manifest.”

R. v. Chehil, 2008 NSSC 357 (CanLII).

Case Report – Identifying web user through ISP does not invalidate subsequent police search

On August 8th, the Ontario Court of Justice dismissed a Charter application that was based, in part, on a challenge to an RCMP letter request to Bell Canada, who answered the request and identified the accused as being associated with several internet protocol addresses at specific points in time.  The local police later obtained a search warrant for the accused’s home, seized computers containing child pornography and laid charges.

Mr. Justice Lalande distinguished R. v. Kwok – in which the Court found a Charter breach and excluded evidence in similar circumstances earlier this year – by noting that the judge hearing Kwok did not receive any evidence about the ISP’s terms of service. Though noting that the Bell Sympatico terms of service that governed the accused referred to disclosures “required by statute or a court order,” Mr. Justice Lalande nonetheless relied heavily on them in finding that the accused’s resonable expectation of privacy was low.

Mr. Justice Lalande was also strongly driven by his characterization of the information revealed by Bell:

There exists an argument quite aside from the impact of the service agreement (and other documents) that the applicant’s name and address as a subscriber falls within a category of basic information which within a commercial contractual setting does not attract a privacy interest because it is not information which tends to reveal any intimate details of personal lifestyle and choices.

Generally speaking, in modern day society, a person’s name and address is used and shared frequently.   A privacy issue is largely contextual in that a person may not want others to share information such as whether he or she is a subscriber to the services of an Internet Provider.  It is with regard to the context (taking into account all factors including the nature of the request, the particular information sought and the subscriber or service agreements) that the court has to assess the issue of reasonable expectation of privacy.

R. v. Ward, 2008 ONCJ 355 (CanLII).

Case Report – SCC says no power to order costs of production order

Yesterday, the Supreme Court of Canada unanimously held that the Criminal Code‘s production order scheme does not allow a court to order that the police compensate a third party for the costs of compliance with a production order.

In 2004, the federal government passed Bill C-45, An Act to Amend the Criminal Code (capital markets fraud and evidence gathering). The Act created a new investigative tool called a “production order” by which third-parties may be required to produce documents, produce data or even prepare documents (based on existing data) for production. A production order is meant to be an easier-to-administer alterative to search warrants. The Department of Justice backgrounder on the Bill also says production orders are privacy-protective because they do not involve the fishing that’s associated with the execution of a search warrant.

The Court held that costs could not be ordered based on a reading of the statutory text in light of the relevant legislative history and the recognized social duty of citizens to assist in the administration of justice. It noted that the Department of Justice and the telecommunications industry had a dialogue before Bill C-45 was promulgated in which industry members requested an express jurisdiction to order costs.

The Court also held that standard for am exemption based on “unreasonable” burden should not be altered by establishing alternative criteria such as “undue hardship.” It held that reasonableness in the entire circumstances was a justiciable standard, noting that parties who are subject to frequent production orders may raise this fact as a relevant circumstance.

Tele-Mobile Company v. Ontario, 2008 SCC 12.