isearch : reasonable expectation of privacy in the digital age

1

iSearch: Reasonable

Expectation of Privacy in the

Digital Age

04/22/2023Joseph Di Luca, Di Luca Barristers

04/22/2023 2

Overview• First principles of reasonable expectation of

privacy

• Defining the reasonable expectation of privacy associated with electronic devices

• Case law update

• Litigation tips

Joseph Di Luca, Di Luca Barristers

04/22/2023 3

Apollo 11

04/22/2023 4

Cell Phone or Weapon?

04/22/2023 5

iBond

04/22/2023Joseph Di Luca, Di Luca Barristers 6

Reasonable Expectation of Privacy: First Principles

• SCC has established a purposive approach to s. 8 in which privacy is the organizing principle. “The guarantee of security from unreasonable search and seizure only protects a reasonable expectation”: Hunter v. Southam

• Examinations and investigations that do not intrude on some reasonable expectation of privacy do not engage s. 8 of the Charter and there is no obligation that such state action be reasonable or authorized by law.


Reasonable Expectation of Privacy: First Principles

• REP is to be determined on the basis of the “totality of the circumstances”: R. v. Edwards

• The analysis proceeds in two steps, asking whether the accused had a subjective expectation of privacy and whether that expectation of privacy was objectively reasonable: R. v. Tessling

• In assessing whether a REP exists, courts make a value judgement. Court to consider not only how much privacy individuals in fact experience but also how much privacy we ought to enjoy. It is a normative rather than descriptive standard: R. v. Tessling; R. v. Ward

04/22/2023 8

Crime Control

04/22/2023 9

Due Process

04/22/2023Footer Text 10

First Principles of Privacy

• R. v. Ward per Doherty J.A.• [71] Personal privacy is about more than secrecy and

confidentiality. Privacy is about being left alone by the state and not being liable to be called to account for anything and everything one does, says or thinks. Personal privacy protects an individual’s ability to function on a day-to-day basis within society while enjoying a degree of anonymity that is essential to the individual’s personal growth and the flourishing of an open and democratic society.

• I think that s. 8 encompasses the concept of “public privacy” described above.[1] Surely, if the state could unilaterally, and without restraint, gather information to identify individuals engaged in public activities of interest to the state, individual freedom and with it meaningful participation in the democratic process would be curtailed. It is hardly surprising that constant unchecked state surveillance of those engaged in public activities is a feature of many dystopian novels.

http://www.canlii.org/en/ca/laws/stat/schedule-b-to-the-canada-act-1982-uk-1982-c-11/latest/schedule-b-to-the-canada-act-1982-uk-1982-c-11.html#sec8_smooth

04/22/2023Footer Text 11

First Principles Cont’d.

• A purposive approach to s. 8 also dictates that personal privacy claims be measured as against the specific state conduct and the purpose for that conduct. Section 8 is not about protecting individual privacy at large or as between non-state actors. Section 8 focuses on personal privacy claims in relation to state intrusions said to infringe on that personal privacy: Gomboc, at para. 34, Deschamps J., concurring. Because the focus is on state intrusion and the purpose of the intrusion, Canadian jurisprudence has emphatically rejected the “risk” analysis featured in American Fourth Amendment jurisprudence.

• Despite the centrality of personal privacy to the relationship between the individual and the state under the Canadian constitution, personal privacy, like any other individual right, cannot be absolute in a democratic society. One’s right to be left alone by the state must be balanced against other legitimate competing societal interests, including the need to effectively investigate crime: Hunter, at pp. 159-160; Tessling, at paras. 17-18.





The Modern Electronic Device

04/22/2023 13

Reasonable Expectation of Privacy

It is difficult to imagine a search more intrusive, extensive, or invasive of one's privacy than the search and seizure of a personal computer.First, police officers enter your home, take possession of your computer, and carry it off for examination in a place unknown and inaccessible to you. There, without supervision or constraint, they scour the entire contents of your hard drive: your emails sent and received; accompanying attachments; your personal notes and correspondence; your meetings and appointments; your medical and financial records; and all other saved documents that you have downloaded, copied, scanned, or created. The police scrutinize as well the electronic roadmap of your cybernetic peregrinations, where you have been and what you appear to have seen on the Internet -- generally by design, but sometimes by accident.

- R. v. Morelli, [2010] 1 S.C.R. 253



Reasonable Expectation of Privacy

R. v. Polius, [2009] O.J. No. 3074 (S.C.J.):The information in a cell phone, computer or other electronic device may relate to aspects of life that are deeply personal. It may include:

* Contacts, including names, addresses, phone numbers, e-mail addresses and other personal information;

* Internet Explorer, including the history of accessing websites;

* Calendars;* Photographs and videos;* Text Messages;* Voice Mail Messages;* E-mail Messages;* Missed Calls;* Call Logs; and* Call Identification.

04/22/2023 15

REP – FactorsCapabilities of Device

• R. v. Liew, 2012 ONSC 1826 at para. 113: “Cell phones and other similar handheld communication devices in common use have the capacity to store vast amounts of highly sensitive personal, private and confidential information." The evidence on the voir dire was not as fulsome as it might have been in terms of the actual contents of [the]phone. That said, [the officer] did testify that he spent a full day reviewing the contents of the phone. That admission, together with the evidence of the call history and text messages contained in the phone, satisfies me that the phone indeed contained significant amounts of the sensitive, personal, private and confidential information.


04/22/2023 16


• Is a smartphone just a fancy briefcase?

R. v. Giles, 2007, BCSC 1147 at para. 63While I accept that this particular BlackBerry’s password protection and the double encryption characteristic mean that there is an objectively reasonable expectation of privacy in the information contained in the BlackBerry, it is not different in nature from what might be disclosed by searching a notebook, a briefcase or a purse found in the same circumstances. The capacity of this BlackBerry to potentially store volumes of information does not, in my view, change the character of the search from being lawful as incident to the arrest, into a search that required a warrant. Volume of information is not as relevant as the nature of the information, and in other situations, items seized incidental to arrest are subject to the same degree of privacy interest.


04/22/2023 17


• Is a smartphone just a fancy briefcase?R. v. Little,[2009] O.J. No. 3278 (S.C.J.)… to suggest that once the police had lawful possession of the Treo they could examine its entire contents without obtaining a warrant authorizing its search is to ignore the nature of the item. It was not simply a cellular telephone, but rather a personal electronic storage device. It was capable of storing data such as call logs, text messages, photographs and movies, any or all of which could include highly personal information. Its contents were not immediately visible to the eye, but had to be extracted by a police officer with specialized skills using specialized equipment. In this way, it was different from a notebook, briefcase or purse.


04/22/2023 18

REP – FactorsPasswords

• R. v. Fearon, 2013 ONCA 106: Ontario Court of Appeal confirmed that police, in that case, were entitled to conduct a search of a cell phone incident to arrest.

• “There was no suggestion in this case that this particular cell phone functioned as a “mini-computer” nor that its contents were not “immediately visible to the eye”. Rather, because the phone was not password protected, the photos and the text message were readily available to other users.”

• If the cell phone had been password protected or otherwise “locked” to users other than the appellant, it would not have been appropriate to take steps to open the cell phone and examine its contents without first obtaining a search warrant.


04/22/2023 19

REP – FactorsLocation of Use

• Lower expectation of privacy in a laptop computer found in a hotel room than in one found in an accused’s residence: R. v. Dragos (2009), 200 C.R.R. (2d) 227 at para. 17 (Ont. S.C.J.)


04/22/2023 20

REP – FactorsUndergoing Repair

• Expectation of privacy in the contents of a personal computer is “significantly reduced” in the circumstances where the computer’s owner brings it to a store for repair. R. v. Winchester, (2010) 73 C.R. (6th) 371 at para. 36 (Ont. S.C.J.)


04/22/2023 21

• R. v. Bahr, [2008] A.W.L.D. 2443• United States v. Ganoe, 538 F.3d 1117 (9th Cir.

2008): “although as a general matter an individual has an objectively reasonable expectation of privacy in his personal computer…we fail to see how this expectation can survive Ganoe’s decision to install and use file-sharing software, thereby opening his computer to anyone one else with the same freely available program.”


REP – FactorsUsage – File Sharing

04/22/2023 22

REP – FactorsWorkplace Computers

R. v. Cole, [2012] 3 S.C.R. 34

The Court left no doubt in R. v. Morelli,, [2010] 1 S.C.R. 253, that Canadians may reasonably expect privacy in the information contained on their own personal computers. In my view, the same applies to information on work computers, at least where personal use is permitted or reasonably expected.

Computers that are reasonably used for personal purposes — whether found in the workplace or the home — contain information that is meaningful, intimate, and touching on the user’s biographical core. Vis-à-vis the state, everyone in Canada is constitutionally entitled to expect privacy in personal information of this kind.

While workplace policies and practices may diminish an individual’s expectation of privacy in a work computer, these sorts of operational realities do not in themselves remove the expectation entirely: The nature of the information at stake exposes the likes, interests, thoughts, activities, ideas, and searches for information of the individual user.


04/22/2023 23


R. v. Cole – Factors to Consider:

• Ownership of data• Policies (not determinative)• “operational realities”: guidelines,

practices and customs of the workplace• Nature of the information (here it was

“organically connected to the biographical core”, para 58)


04/22/2023 24


R. v. ColeThe school board was, of course, legally entitled to inform the police of its

discovery of contraband on the laptop. This would doubtless have permitted the police to obtain a warrant to search the computer for the contraband. But receipt of the computer from the school board did not afford the police warrantless access to the personal information contained within it. This information remained subject, at all relevant times, to Mr. Cole's reasonable and subsisting expectation of privacy.

So……..S. 8 breach BUT law unsettled, officer had good faith intention to consider Charter rights and Cole had an existing but DIMINISHED REP, so evidence admitted under 24(2)


04/22/2023 25

Customer Name and Address• Reasonable expectation of privacy in IP addresses

and customer name and address information?

• Relevant factors: o Nature of the informationo Terms of the contract: service agreements,

acceptable use agreements, privacy policieso Privacy legislationo Police conduct


04/22/2023 26

Customer Name and AddressR. v. Ward, 2012 ONCA 660

• REP to be determined on totality of circumstances, which includes “technical, investigative, legislative and contractual components” (para 17)

• Court concludes that no REP in subscriber information BUT fact-specific assessment:o Context significant (nature of the offence) in considering ISP responseo Contract is “of critical importance” but not determinativeo Consider technology – EVIDENCE about what you actually get, what it can tell you,

what it can’t tell youo Consider subject matter – what exactly do police want and what will it tell them, alone

and in combination with other known information - name and address had “the potential to open doors into very private aspects of the appellant’s lifestyle” (paras 89, 93)

o Police conduct is considered in terms of its effect on REP (request very focused, info used in warrant application)


04/22/2023 27

Customer Name and AddressR. v. Ward, 2012 ONCA 660

I stress that the conclusion in this case is based on the specific circumstances revealed by this record and is not intended to suggest that disclosure of customer information by an ISP can never infringe the customer’s reasonable expectation of privacy. If, for example, the ISP disclosed more detailed information, or made the disclosure in relation to an investigation of an offence in which the service was not directly implicated, the reasonable expectation of privacy analysis might yield a different result. Similarly, if there was evidence that the police, armed with the subscriber’s name and address, could actually form a detailed picture of the subscriber’s Internet usage, a court might well find that the subscriber had a reasonable expectation of privacy. Those cases will be considered using the totality of the circumstances analysis when and if they arise. (para. 109)


04/22/2023 28

Litigation Tips• Building an Evidentiary Record in relation to the

Normative Standards o http://www.ipc.on.ca/english/Resources/Discussion-Papers/o http://www.priv.gc.ca/information/pub/op_index_e.asp

• Expert Evidence on the Capabilities of the Technology

• Properly Characterizing the Nature of the Information

• Arguing around Contracts


http://www.ipc.on.ca/english/Resources/Discussion-Papers/

http://www.ipc.on.ca/english/Resources/Discussion-Papers/

http://www.priv.gc.ca/information/pub/op_index_e.asp

http://www.priv.gc.ca/information/pub/op_index_e.asp

04/22/2023 29

isearch : reasonable expectation of privacy in the digital age

Documents