Police acted with legal justification when they obtained the identity of a suspected consumer of child pornography from his Internet service provider, the Ontario Court of Appeal has ruled.
The court's decision constitutes the highest authority to date on the key question of whether privacy rights prevent police from using evidence furnished by ISPs.
With the issue arising in an increasing number of prosecutions, Tuesday's ruling is likely to be appealed to the Supreme Court.
The case involved a Sudbury man, David Ward, who was arrested after German police discovered a large cache of pornography on a legitimate website where users exchanged information.
German authorities provided their Canadian counterparts with IP addresses of individuals in Canada who had been accessing the pornographic material.
In an increasingly common move, police asked the ISP associated with one of these individuals, Bell Sympatico, to divulge his identity.
Bell did so, enabling the police to seek a search warrant for Mr. Ward's home. When they executed it, they found 30,000 images of child pornography along with 373 videos containing child porn.
Mr. Ward was charged with one count of possessing child pornography and one count of accessing child pornography. He was later convicted and sentenced to 11 months in prison and three years probation.
Mr. Ward appealed his conviction to the Ontario Court of Appeal based on one primary ground – that police had violated his Charter right against unfair search and seizure by obtaining his identity so that they could enter his house and search his computer.
The Crown argued in response that Mr. Ward had no reasonable expectation of privacy in regard to subscriber information held by Bell Sympatico.
Writing for a 3-0 majority, Mr. Justice David Doherty emphasized it is critical to tread warily when it comes to highly personal computer-related information.
At the same time, he said: "One's right to be left alone by the state must be balanced against other legitimate competing societal interests, including the need to effectively investigate crime."
"These offences are extremely serious," Judge Doherty said. "They victimize children, a very vulnerable element of the community and one which the community, as a whole, has a responsibility to protect. Further, Bell Sympatico's service was an integral and essential component of the offences being investigated.
"In a very real sense, the power and anonymity of the Internet allows these kinds of offences to be committed," he said, writing on behalf of Chief Justice Warren Winkler and Mr. Justice Stephen Goudge.
Judge Doherty said that what is "reasonable" depends largely on the circumstances of an individual offence and the nature of the information sought.
"The question is not whether the appellant had a reasonable expectation that he could access and possess child pornography anonymously," Judge Doherty said. "The question is whether the appellant had a reasonable expectation that he could anonymously access the Internet on his computer without the state – with the co-operation of the appellant's ISP – being able to find out what he had accessed." He said that simply divulging a name and address is on the low end of the intrusion scale and does not constitute a wholesale pillaging of an individual's identity and privacy.
Moreover, the wording of a user agreement between an ISP and a customer can be vitally important.
In the Ward case, Bell Sympatico's user agreement stated that it could refuse to protect a customer's confidentiality in instances of criminal behaviour.
"Unlike, for example, a doctor-patient relationship, there was nothing inherently confidential in the relationship between Bell Sympatico and the appellant," Judge Doherty said.
"Bell Sympatico was not compelled by any statute to provide the information to the police," he added. "It chose to do so when faced with a very specific and narrow request, and when it was made aware of the nature of the investigation."
Other ISPs are less clear about how they will deal with requests for information on subscribers, the court said.
Judge Doherty left open the possibility that some police intrusions could involve such sensitive, personal information that they would be illegal.
Scott Hutchison, a privacy expert at Stockwoods LLP, said the question of privacy and the Internet has presented courts with tremendous challenges.
"The technology is new and constantly changing," Mr. Hutchison said. "This decision shows the difficulty in making privacy rules which evolved to deal with paper and pen work in the age of a ubiquitous and global computer network."
Mr. Hutchison said that a recent Saskatchewan Court of Appeal decision differed in finding that an individual did have a reasonable expectation of privacy under similar circumstances. In a key difference, however, the ISP in that case did not have a clear policy that permitted it to divulge information to police.
"What Justice Doherty focuses on – properly I think – is the reality of the relationship between the customer and the ISP and the nature of the relationship between the ISP and the police," Mr. Hutchison said.