The Supreme Court of Canada made an important ruling on online privacy on Friday. In a narrow 5:4 decision, the Supreme Court found that users can assume that a dynamic IP address assigned to them represents a private date. The internet identifier is accompanied by a certain expectation of privacy protection within the meaning of the Charter of Rights and Freedoms, which is part of the constitution, explained the judges sitting in Ottawa. Simply determining these numbers is tantamount to a search, so an appropriate order is necessary.
Advertisement
For the majority of the panel, Judge Andromache Karakatsanis emphasized that an IP address forms “the crucial link between an Internet user and their online activity.” The subject of the search in the case under discussion was the information that these Internet identifiers could reveal “about certain Internet users, including ultimately their identity.” What should also be taken into account is what IP addresses could reveal “in combination with other available information, particularly from third-party websites”. If the charter is to meaningfully protect citizens' online privacy in today's predominantly digital world, their IP addresses would have to be covered.
“An IP address alone does not even reveal your surfing habits,” emphasized judge Suzanne Côté in the dissenting opinion on behalf of her three other colleagues. Only a user's provider is revealed. This is “hardly more private information than electricity consumption or heat emissions.”
BGH ruling: IP addresses are protected personal data
The lawsuit was filed in the case by Andrei B., who was found guilty of 14 fraud offenses in an online liquor store shop in Alberta. In 2017, Calgary police discovered that the store was conducting its e-commerce activities through the payment service Moneris. There she requested the IP address associated with the purchases without presenting a search warrant. The service provider then gave two IP addresses to the investigators. They then turned to the access provider with a court order to obtain the inventory data linked to the IP addresses in the form of names and addresses. They led to B. and his father. The suspect was arrested after an apartment search and charged with misuse of a credit card and third-party ID.
According to the broadcaster CBC, Canadian law enforcement authorities are already regretting that, as a result of the highest court decision, it makes parts of their work, such as the fight against sexual exploitation of children on the Internet, significantly more difficult. Instead, civil rights activists welcome the announcement as overdue.
On the Old Continent, the European Court of Justice (ECJ) ruled in 2016 in response to a lawsuit from data protection activist Patrick Breyer that it is sufficient for IP addresses to be linked to individuals if the provider of online media services can contact the responsible investigative authority, particularly in the event of cyber attacks. It is then up to the latter to take “the necessary steps,” for example by means of an inventory data query, “to obtain the information in question from the Internet access provider and to initiate criminal prosecution.” A little later, the Federal Court of Justice confirmed that dynamic IP addresses of website visitors are fundamentally protected personal information that may not be tracked for months without consent.
(NO)