For weeks, the government has been claiming that the provisions in Bill C-13 and S-4 were compatible with the law. Last week, the Supreme Court of Canada disagreed, issuing its decision in Spencer on the legality of voluntary warrantless disclosure of subscriber information. The court ruled that there was a reasonable expectation of privacy with subscriber information and that voluntary disclosure to police may constitute an illegal search.

The court’s comments are particularly striking when contrasted with claims from government ministers, MPs, and officials, who have defended C-13 and S-4 at committee.  Consider what the court said about subscriber information:

in the totality of the circumstances of this case, there is a reasonable expectation of privacy in the subscriber information. The disclosure of this information will often amount to the identification of a user with intimate or sensitive activities being carried out online, usually on the understanding that these activities would be anonymous. A request by a police officer that an ISP voluntarily disclose such information amounts to a search.

In contrast, Bob Dechert, the Parliamentary Secretary to the Minister of Justice, argued at committee that subscriber information was similar to a licence plate on a car:

Sure, it’s kind of like akin to, as I think Officer Pardy said, if you see a car driving down the street and you suspect that the driver is impaired, you copy down the licence number and provide that to police. I assume the police can also ask you for it. If I see, today, somebody harassing one of my neighbours on their front porch, and there’s a car in the driveway, I assume I can note down that licence number and provide it to police, and by the same token the police can come to my door and say, “Did you see somebody harassing your neighbour; do you have any information that would lead us to that person’s identity?” That’s true? Okay.

When Industry Minister James Moore appeared before the Senate Transport Committee to defend the expansion of voluntary disclosure of personal information, his Assistant Deputy Minister Lawrence Hanson told the committee:

So the existing provisions of PIPEDA do allow voluntary disclosure to law enforcement without a warrant, but there are a couple of really important things to note.  First of all, it is voluntary; they are not compelled to do that.  Secondly, the types of information that law enforcement could request would have to identify their lawful authority to request it, and they would be receiving what we would call basic subscriber information. This basically ties into the charter, the reasonable expectation of privacy.  In the sense of basic subscriber data, that could be obtained without a warrant.  I would distinguish that from something more intrusive like transmission data or about an electronic intercept, for example, which would require a warrant.

Hansen later added:

In the instance of PIPEDA, because of the type of information provided in a pre‑warrant phase such as basic subscriber information, it would be consistent with privacy expectations and therefore it’s not really putting telecoms, for example, in some unique position in terms of police investigations.

The court was also dismissive of arguments that consumers had consented to the disclosure of their information in their ISP user agreements:

Whether or not disclosure of personal information by Shaw is “permitted” or “required by law” in turn depends on an analysis of the applicable statutory framework. The contractual provisions, read as a whole, are confusing and equivocal in terms of their impact on a user’s reasonable expectation of privacy in relation to police initiated requests for subscriber information.

Moreover:

Given that the purpose of PIPEDA is to establish rules governing, among other things, disclosure “of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information” (s. 3), it would be reasonable for an Internet user to expect that a simple request by police would not trigger an obligation to disclose personal information or defeat PIPEDA’s general prohibition on the disclosure of personal information without consent.

But that isn’t what Moore emphasized to the Senate committee, when he argued that consumers may have agreed to the voluntary disclosures in their user agreements:

Well, if you agree to a contract, for example, with a telecommunications company, and as part of that contract you can surrender some of your capacity to have your information shared under certain circumstances, that can exist in a number of contractual situations, but that’s an individual signing a contract and agreeing to that openness in the case of a criminal investigation.

Justice Minister Peter MacKay said much the same thing when asked about immunity for voluntary disclosure at the Justice Committee hearing on C-13:

That really is an issue that is covered under the PIPEDA. It is really as well an issue of potentially contract law between the individual and the service provider, the company. But the provision provides protection for those who are voluntarily assisting police in an investigation where such assistance is not otherwise prohibited by law. So, the element of protection, if you will, or immunity has to respect the common law provision of voluntary disclosure as well as any existing contractual obligations that may exist. It must be done in a way that complies with section 25 and this other section that you’re referring to 47.

In other words, the government’s key defences for C-13 and S-4, namely that there is no reasonable expectation of privacy and that users consent to the disclosure in their agreements, were both soundy rejected by the Supreme Court of Canada.