Supreme Court of Canada says a computer’s IP address deserves privacy protection

OTTAWA — The Supreme Court of Canada says police need judicial authorization to obtain a computer’s internet protocol address, calling the identification number a crucial link between a person and their online activity.

The top court’s 5-4 ruling came Friday in a case that began in 2017, when Calgary police investigated fraudulent online transactions from a liquor store.

The store’s third-party payment processor voluntarily gave police two IP addresses — numerical identifiers assigned by an internet service provider.

Police obtained a production order compelling the service provider to disclose the names and street addresses of the customers.

Police then got warrants to search two homes, leading to the arrest of Andrei Bykovets, who was eventually convicted on several counts.

The trial judge had rejected the argument that the police request to obtain the IP addresses violated his Charter of Rights guarantee against unreasonable search and seizure.

A majority of the Alberta Court of Appeal dismissed Bykovets’s appeal, prompting him to take his case to the Supreme Court.

Writing for a majority of the high court, Justice Andromache Karakatsanis said an IP address “is the key to unlocking a user’s internet activity and, ultimately, their identity, such that it attracts a reasonable expectation of privacy.”

IP addresses are not just meaningless numbers, she wrote. As the link that connects internet activity to a specific location, they may betray deeply personal information — including the identity of the device’s user — without ever triggering a warrant requirement.

Karakatsanis said that if the Charter provision against unreasonable search “is to meaningfully protect the online privacy of Canadians in today’s overwhelmingly digital world, it must protect their IP addresses.”

This report by The Canadian Press was first published March 1, 2024.

Jim Bronskill, The Canadian Press