CHARTER PROTECTION FOR IP ADDRESSES

The Supreme Court of Canada says police need judicial authorization to obtain a computer user’s internet protocol (IP) address.  IP address “is the key to unlocking a user’s internet activity and, ultimately, their identity, such that it attracts a reasonable expectation of privacy.”

A majority of the Court decided that, if the Charter provision against unreasonable search “is to meaningfully protect the online privacy of Canadians in today’s overwhelmingly digital world, it must protect their IP addresses.”

The Court reasoned - First, as the link that connects specific internet activity to a specific location, an IP address may betray deeply personal information, even before police try to link the address to the user’s identity, she said.

Second, activity associated with the IP address can be correlated with other online activity associated with that address available to the state – with particularly concerning consequences when coupled with access to information held by third parties.

Finally, an IP address can set the state on a trail of internet activity that leads directly to a user’s identity, even without a subsequent warrant.

The Court reasoned that, When linked to financial intermediaries like Moneris or PayPal, an IP address can reveal all of a user’s transactions on that intermediary over the period the IP address was assigned to them.  In turn, these purchases might reveal an array of personal information, from the restaurants someone visits to the hobbies they enjoy and the health supplements they use.

The Court went on, “An internet user’s history on medical, political, or other similar online chatrooms can reveal their health concerns or political views.

“If an IP address is not protected, this information is freely available to the state without the protection of the Charter whether or not it relates to the investigation of a particular crime.”

BY JIM BRONSKILL, THE CANADIAN PRESS ON MARCH 1, 2024