2014 SCC 43

SUPREME COURT OF CANADA

Date: 20140613 Docket: 34644

Between:

Matthew David Spencer

Appellant

and

Her Majesty The Queen

Respondent

and

Director of Public Prosecutions,

Attorney General of Ontario,

Attorney General of Alberta,

Privacy Commissioner of Canada,

Canadian Civil Liberties Association and

Criminal Lawyers’ Association of Ontario

Interveners

Coram: McLachlin C.J. and LeBel, Abella, Rothstein, Cromwell, Moldaver, Karakatsanis and Wagner JJ.

Reasons for Judgment: (paras. 1 to 87)

Cromwell J. (McLachlin C.J. and LeBel, Abella, Rothstein, Moldaver, Karakatsanis and Wagner JJ. concurring)

r. v. spencer, 2014 SCC 43, [2014] S.C.R. 212

Matthew David Spencer Appellant

v.

Her Majesty The Queen Respondent

and

Director of Public Prosecutions,

Attorney General of Ontario,

Attorney General of Alberta,

Privacy Commissioner of Canada,

Canadian Civil Liberties Association and

Criminal Lawyers’ Association of Ontario Interveners

Indexed as: R. v. Spencer

2014 SCC 43

File No.: 34644.

2013: December 9; 2014: June 13. *

Present: McLachlin C.J. and LeBel, Abella, Rothstein, Cromwell, Moldaver, Karakatsanis and Wagner JJ.

on appeal from the court of appeal for saskatchewan

Constitutional law — Charter of Rights — Search and seizure — Privacy — Police having information that IP address used to access or download child pornography — Police asking Internet service provider to voluntarily provide name and address of subscriber assigned to IP address — Police using information to obtain search warrant for accused’s residence — Whether police conducted unconstitutional search by obtaining subscriber information matching IP address — Whether evidence obtained as a result should be excluded — Whether fault element of making child pornography available requires proof of positive facilitation — Criminal Code, R.S.C. 1985, c. C-46, ss. 163.1(3) , (4) , 487.014(1) — Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, s. 7(3) (c.1)(ii) — Canadian Charter of Rights and Freedoms, s. 8 .

The police identified the Internet Protocol (IP) address of a computer that someone had been using to access and store child pornography through an Internet file-sharing program. They then obtained from the Internet Service Provider (ISP), without prior judicial authorization, the subscriber information associated with that IP address. The request was purportedly made pursuant to s. 7(3) ( c. 1)(ii) of the Personal Information Protection and Electronic Documents Act ( PIPEDA ). This led them to the accused. He had downloaded child pornography into a folder that was accessible to other Internet users using the same file-sharing program. He was charged and convicted at trial of possession of child pornography and acquitted on a charge of making it available. The Court of Appeal upheld the conviction, however set aside the acquittal on the making available charge and ordered a new trial.

Held : The appeal should be dismissed.

Whether there is a reasonable expectation of privacy in the totality of the circumstances is assessed by considering and weighing a large number of interrelated factors. The main dispute in this case turns on the subject matter of the search and whether the accused’s subjective expectation of privacy was reasonable. The two circumstances relevant to determining the reasonableness of his expectation of privacy in this case are the nature of the privacy interest at stake and the statutory and contractual framework governing the ISP’s disclosure of subscriber information.

When defining the subject matter of a search, courts have looked not only at the nature of the precise information sought, but also at the nature of the information that it reveals. In this case, the subject matter of the search was not simply a name and address of someone in a contractual relationship with the ISP. Rather, it was the identity of an Internet subscriber which corresponded to particular Internet usage.

The nature of the privacy interest engaged by the state conduct turns on the privacy of the area or the thing being searched and the impact of the search on its target, not the legal or illegal nature of the items sought. In this case, the primary concern is with informational privacy. Informational privacy is often equated with secrecy or confidentiality, and also includes the related but wider notion of control over, access to and use of information. However, particularly important in the context of Internet usage is the understanding of privacy as anonymity. The identity of a person linked to their use of the Internet must be recognized as giving rise to a privacy interest beyond that inherent in the person’s name, address and telephone number found in the subscriber information. Subscriber information, by tending to link particular kinds of information to identifiable individuals, may implicate privacy interests relating to an individual’s identity as the source, possessor or user of that information. Some degree of anonymity is a feature of much Internet activity and depending on the totality of the circumstances, anonymity may be the foundation of a privacy interest that engages constitutional protection against unreasonable search and seizure. In this case, the police request to link a given IP address to subscriber information was in effect a request to link a specific person to specific online activities. This sort of request engages the anonymity aspect of the informational privacy interest by attempting to link the suspect with anonymously undertaken online activities, activities which have been recognized in other circumstances as engaging significant privacy interests.

There is no doubt that the contractual and statutory framework may be relevant to, but not necessarily determinative of, whether there is a reasonable expectation of privacy. In this case, the contractual and statutory frameworks overlap and the relevant provisions provide little assistance in evaluating the reasonableness of the accused’s expectation of privacy. Section 7(3) ( c. 1)(ii) of PIPEDA cannot be used as a factor to weigh against the existence of a reasonable expectation of privacy since the proper interpretation of the relevant provision itself depends on whether such a reasonable expectation of privacy exists. It would be reasonable for an Internet user to expect that a simple request by police would not trigger an obligation to disclose personal information or defeat PIPEDA ’s general prohibition on the disclosure of personal information without consent. The contractual provisions in this case support the existence of a reasonable expectation of privacy. The request by the police had no lawful authority in the sense that while the police could ask, they had no authority to compel compliance with that request. In the totality of the circumstances of this case, there is a reasonable expectation of privacy in the subscriber information. Therefore, the request by the police that the ISP voluntarily disclose such information amounts to a search.

Whether the search in this case was lawful will be dependent on whether the search was authorized by law. Neither s. 487.014(1) of the Criminal Code , nor PIPEDA creates any police search and seizure powers. Section 487.014(1) is a declaratory provision that confirms the existing common law powers of police officers to make enquiries. PIPEDA is a statute whose purpose is to increase the protection of personal information. Since in the circumstances of this case the police do not have the power to conduct a search for subscriber information in the absence of exigent circumstances or a reasonable law, the police do not gain a new search power through the combination of a declaratory provision and a provision enacted to promote the protection of personal information. The conduct of the search in this case therefore violated the Charter . Without the subscriber information obtained by the police, the warrant could not have been obtained. It follows that if that information is excluded from consideration as it must be because it was unconstitutionally obtained, there were not adequate grounds to sustain the issuance of the warrant and the search of the residence was therefore unlawful and violated the Charter .

The police, however, were acting by what they reasonably thought were lawful means to pursue an important law enforcement purpose. The nature of the police conduct in this case would not tend to bring the administration of justice into disrepute. While the impact of the Charter -infringing conduct on the Charter -protected interests of the accused weighs in favour of excluding the evidence, the offences here are serious. Society has a strong interest in the adjudication of the case and also in ensuring the justice system remains above reproach in its treatment of those charged with these serious offences. Balancing the three factors, the exclusion of the evidence rather than its admission would bring the administration of justice into disrepute. The admission of the evidence is therefore upheld.

There is no dispute that the accused in a prosecution under s. 163.1(3) of the Criminal Code must be proved to have had knowledge that the pornographic material was being made available. This does not require however, that the accused must knowingly, by some positive act, facilitate the availability of the material. The offence is complete once the accused knowingly makes pornography available to others. Given that wilful blindness was a live issue and that the trial judge’s error in holding that a positive act was required to meet the mens rea component of the making available offence resulted in his not considering the wilful blindness issue, the error could reasonably be thought to have had a bearing on the trial judge’s decision to acquit. The order for a new trial is affirmed.

Cases Cited

Referred to: R. v. Ward , 2012 ONCA 660 , 112 O.R. (3d) 321 ; Hunter v. Southam Inc. , 1984 33 (SCC) , [1984] 2 S.C.R. 145; R. v. Dyment , 1988 10 (SCC) , [1988] 2 S.C.R. 417; R. v. Plant , 1993 70 (SCC) , [1993] 3 S.C.R. 281; R. v. Tessling , 2004 SCC 67 , [2004] 3 S.C.R. 432; Alberta (Information and Privacy Commissioner) v. United Food and Commercial Workers, Local 401 , 2013 SCC 62 , [2013] 3 S.C.R. 733; R. v. Patrick , 2009 SCC 17 , [2009] 1 S.C.R. 579; R. v. Cole , 2012 SCC 53 , [2012] 3 S.C.R. 34; R. v. Gomboc , 2010 SCC 55 , [2010] 3 S.C.R. 211; R. v. Trapp , 2011 SKCA 143 , 377 Sask. R. 246; R. v. Kang-Brown , 2008 SCC 18 , [2008] 1 S.C.R. 456; R. v. A.M. , 2008 SCC 19 , [2008] 1 S.C.R. 569; Dagg v. Canada (Minister of Finance) , 1997 358 (SCC) , [1997] 2 S.C.R. 403; McInerney v. MacDonald , 1992 57 (SCC) , [1992] 2 S.C.R. 138 ; R. v. Duarte , 1990 150 (SCC) , [1990] 1 S.C.R. 30 ; R. v. Wise , 1992 125 (SCC) , [1992] 1 S.C.R. 527 ; R. v. Morelli , 2010 SCC 8 , [2010] 1 S.C.R. 253; R. v. Vu , 2013 SCC 60 , [2013] 3 S.C.R. 657; R. v. Collins , 1987 84 (SCC) , [1987] 1 S.C.R. 265 ; R. v. McNeice , 2010 BCSC 1544 () ; R. v. Grant , 2009 SCC 32 , [2009] 2 S.C.R. 353 ; R. v. Briscoe , 2010 SCC 13 , [2010] 1 S.C.R. 411 ; R. v. Graveline , 2006 SCC 16 , [2006] 1 S.C.R. 609 .

Statutes and Regulations Cited

Canadian Charter of Rights and Freedoms , ss. 8, 24(2) .

Criminal Code , R.S.C. 1985, c. C-46, ss. 163.1(3), (4) , 487.014 .

Freedom of Information and Protection of Privacy Act , S.S. 1990-91, c. F-22.01, s. 29(2)(g).

Personal Information Protection and Electronic Documents Act , S.C. 2000, c. 5, ss. 3, 5(3) , 7 , Sch. 1, cl. 4.3.

Authors Cited

Canada. Report of the Task Force established by the Department of Communications/Department of Justice. Privacy and Computers . Ottawa: Information Canada, 1972.

Gleicher, Nathaniel. “Neither a Customer Nor a Subscriber Be: Regulating the Release of User Information on the World Wide Web” (2009), 118 Yale L.J. 1945.

Gutterman, Melvin. “A Formulation of the Value and Means Models of the Fourth Amendment in the Age of Technologically Enhanced Surveillance” (1988), 39 Syracuse L. Rev. 647.

Hubbard, Robert W., Peter DeFreitas and Susan Magotiaux. “The Internet — Expectations of Privacy in a New Context” (2002), 45 Crim. L.Q. 170.

Hunt, Chris D. L. “Conceptualizing Privacy and Elucidating its Importance: Foundational Considerations for the Development of Canada’s Fledgling Privacy Tort” (2011), 37 Queen’s L.J. 167.

Paton-Simpson, Elizabeth. “Privacy and the Reasonable Paranoid: The Protection of Privacy in Public Places” (2000), 50 U.T.L.J. 305.

Slane, Andrea, and Lisa M. Austin. “What’s In a Name? Privacy and Citizenship in the Voluntary Disclosure of Subscriber Information in Online Child Exploitation Investigations” (2011), 57 Crim. L.Q. 486.

Westin, Alan F. Privacy and Freedom . New York: Atheneum, 1970.

APPEAL from a judgment of the Saskatchewan Court of Appeal (Cameron, Ottenbreit and Caldwell JJ.A.), 2011 SKCA 144 , 377 Sask. R. 280, 528 W.A.C. 280, [2012] 4 W.W.R. 425, 283 C.C.C. (3d) 384, [2011] S.J. No. 729 (QL), 2011 CarswellSask 786, affirming the accused’s conviction for possession of child pornography and setting aside the accused’s acquittal for making available child pornography entered by Foley J., 2009 SKQB 341 , 361 Sask. R. 1, [2009] S.J. No. 798 (QL), 2009 CarswellSask 905, and ordering a new trial. Appeal dismissed.

Aaron A. Fox , Q.C. , and Darren Kraushaar , for the appellant.

Anthony B. Gerein , for the respondent.

Ronald C. Reimer and David Schermbrucker , for the intervener the Director of Public Prosecutions.

Susan Magotiaux and Allison Dellandrea , for the intervener the Attorney General of Ontario.

Jolaine Antonio , for the intervener the Attorney General of Alberta.

Mahmud Jamal , Patricia Kosseim , Daniel Caron and Sarah Speevak , for the intervener the Privacy Commissioner of Canada.

Anil K. Kapoor and Lindsay L. Daviau , for the intervener the Canadian Civil Liberties Association.

Jonathan Dawe and Jill R. Presser , for the intervener the Criminal Lawyers’ Association of Ontario.

The judgment of the Court was delivered by

Cromwell J. —

I. Introduction

[ 1 ] The Internet raises a host of new and challenging questions about privacy. This appeal relates to one of them.

[ 2 ] The police identified the Internet Protocol (IP) address of a computer that someone had been using to access and store child pornography through an Internet file-sharing program. They then obtained from the Internet Service Provider (ISP), without prior judicial authorization, the subscriber information associated with that IP address. This led them to the appellant, Mr. Spencer. He had downloaded child pornography into a folder that was accessible to other Internet users using the same file-sharing program. He was charged and convicted at trial of possession of child pornography and acquitted on a charge of making it available.

[ 3 ] At trial, Mr. Spencer claimed that the police had conducted an unconstitutional search by obtaining subscriber information matching the IP address and that the evidence obtained as a result should be excluded. He also testified that he did not know that others could have access to the shared folder and argued that he therefore did not knowingly make the material in the folder available to others. The trial judge concluded that there had been no breach of Mr. Spencer’s right to be secure against unreasonable searches and seizures. However, he was of the view that the “making available” offence required some “positive facilitation” of access to the pornography, which Mr. Spencer had not done, and further he believed Mr. Spencer’s evidence that he did not know that others could access his folder so that the fault element ( mens rea ) of the offence had not been proved. The judge therefore convicted Mr. Spencer of the possession offence, but acquitted him of the making available charge.

[ 4 ] The Court of Appeal upheld the conviction for possession of child pornography, agreeing with the trial judge that obtaining the subscriber information was not a search and holding that even if it were a search, it would have been reasonable. The court, however, set aside the acquittal on the making available charge on the basis that the trial judge had been wrong to require proof of positive facilitation of access by others to the material. A new trial was ordered on this charge.

[ 5 ] The appeal to this Court raises four issues which I would resolve as follows:

1. Did the police obtaining the subscriber information matching the IP address from the ISP constitute a search?

In my view, it did.

2. If so, was the search authorized by law?

In my view, it was not.

3. If not, should the evidence obtained as a result be excluded?

In my view, the evidence should not be excluded.

4. Did the trial judge err with respect to the fault element of the “making available” offence?

The judge did err and I would uphold the Court of Appeal’s order for a new trial.

II. Analysis

A. Did the Police Obtaining the Subscriber Information Matching the IP Address From the ISP Constitute a Search?

[ 6 ] Mr. Spencer maintains that the police were conducting a search when they obtained the subscriber information associated with the IP address from the ISP, Shaw Communications Inc. The respondent Crown takes the opposite view. I agree with Mr. Spencer on this point. I will first set out a summary of the relevant facts then turn to the legal analysis.

(1) Facts and Judicial History

[ 7 ] Mr. Spencer, who lived with his sister, connected to the Internet through an account registered in his sister’s name. He used the file-sharing program LimeWire on his desktop computer to download child pornography from the Internet. LimeWire is a free peer-to-peer file-sharing program that, at the time, anyone could download onto their computer. Peer-to-peer systems such as LimeWire allow users to download files directly from the computers of other users. LimeWire does not have one central database of files, but instead relies on its users to share their files directly with others. It is commonly used to download music and movies and can also be used to download both adult and child pornography. It was Mr. Spencer’s use of the file-sharing software that brought him to the attention of the police and which ultimately led to the search at issue in this case.

[ 8 ] Det. Sgt. Darren Parisien (then Cst.) of the Saskatoon Police Service, by using publicly available software, searched for anyone sharing child pornography. He could access whatever another user of the software had in his or her shared folder. In other words, he could “see” what other users of the file-sharing software could “see”. He could also obtain two numbers related to a given user: the IP address that corresponds to the particular Internet connection through which a computer accesses the Internet at the time and the globally unique identifier (GUID) number assigned to each computer using particular software. The IP address of the computer from which shared material is obtained is displayed as part of the file-sharing process. There is little information in the record about the nature of IP addresses in general or the IP addresses provided by Shaw to its subscribers. There is a description in R. v. Ward , 2012 ONCA 660 , 112 O.R. (3d) 321, at paras. 21-26 , which also notes some of the differences that may exist among IP addresses. For the purposes of this case, what we know is that the IP address obtained by Det. Sgt. Parisien matched computer activity at the particular point in time that he was observing that activity.

[ 9 ] Det. Sgt. Parisien generated a list of IP addresses for computers that had shared what he believed to be child pornography. He then ran that list of IP addresses against a database which matches IP addresses with approximate locations. He found that one of the IP addresses was suspected to be in Saskatoon, with Shaw as the ISP.

[ 10 ] Det. Sgt. Parisien then determined that Mr. Spencer’s computer was online and connected to LimeWire. As a result, he (along with any LimeWire user) was able to browse the shared folder. He saw an extensive amount of what he believed to be child pornography. What he lacked was knowledge of where exactly the computer was and who was using it.

[ 11 ] To connect the computer usage to a location and potentially a person, investigators made a written “law enforcement request” to Shaw for the subscriber information including the name, address and telephone number of the customer using that IP address. The request, which was purportedly made pursuant to s. 7(3) ( c. 1)(ii) of the Personal Information Protection and Electronic Documents Act , S.C. 2000, c. 5 ( PIPEDA ), indicated that police were investigating an offence under the Criminal Code , R.S.C. 1985, c. C-46, pertaining to child pornography and the Internet and that the subscriber information was being sought as part of an ongoing investigation. (The full text of the relevant statutory provisions is set out in an Appendix.) Investigators did not have or try to obtain a production order (i.e. the equivalent of a search warrant in this context).

[ 12 ] Shaw complied with the request and provided the name, address and telephone number of the customer associated with the IP address, Mr. Spencer’s sister. With this information in hand, the police obtained a warrant to search Ms. Spencer’s home (where Mr. Spencer lived) and seize his computer, which they did. The search of Mr. Spencer’s computer revealed about 50 child pornography images and two child pornography videos.

[ 13 ] Mr. Spencer was charged with possessing child pornography contrary to s. 163.1(4) of the Criminal Code and making child pornography available over the Internet contrary to s. 163.1(3) . There is no dispute that the images found in his shared folder were child pornography.

[ 14 ] At trial, Mr. Spencer sought to exclude the evidence found on his computer on the basis that the police actions in obtaining his address from Shaw without prior judicial authorization amounted to an unreasonable search contrary to s. 8 of the Canadian Charter of Rights and Freedoms . The trial judge rejected this contention and convicted Mr. Spencer of the possession count. On appeal, the Saskatchewan Court of Appeal upheld the judge’s decision with respect to the search issue.

(2) Was the Request to Shaw a Search?

[ 15 ] Under s. 8 of the Charter , “[e]veryone has the right to be secure against unreasonable search or seizure.” This Court has long emphasized the need for a purposive approach to s. 8 that emphasizes the protection of privacy as a prerequisite to individual security, self-fulfilment and autonomy as well as to the maintenance of a thriving democratic society: Hunter v. Southam Inc. , 1984 33 (SCC) , [1984] 2 S.C.R. 145, at pp. 156-57; R. v. Dyment , 1988 10 (SCC) , [1988] 2 S.C.R. 417, at pp. 427-28; R. v. Plant , 1993 70 (SCC) , [1993] 3 S.C.R. 281, at pp. 292-93; R. v. Tessling , 2004 SCC 67 , [2004] 3 S.C.R. 432, at paras. 12-16 ; Alberta (Information and Privacy Commissioner) v. United Food and Commercial Workers, Local 401 , 2013 SCC 62 , [2013] 3 S.C.R. 733, at para. 22 .

[ 16 ] The first issue is whether this protection against unreasonable searches and seizures was engaged here. That depends on whether what the police did to obtain the subscriber information matching the IP address was a search or seizure within the meaning of s. 8 of the Charter . The answer to this question turns on whether, in the totality of the circumstances, Mr. Spencer had a reasonable expectation of privacy in the information provided to the police by Shaw. If he did, then obtaining that information was a search.

[ 17 ] We assess whether there is a reasonable expectation of privacy in the totality of the circumstances by considering and weighing a large number of interrelated factors. These include both factors related to the nature of the privacy interests implicated by the state action and factors more directly concerned with the expectation of privacy, both subjectively and objectively viewed, in relation to those interests: see, e.g., Tessling , at para. 38 ; Ward , at para. 65 . The fact that these considerations must be looked at in the “totality of the circumstances” underlines the point that they are often interrelated, that they must be adapted to the circumstances of the particular case and that they must be looked at as a whole.

[ 18 ] The wide variety and number of factors that may be considered in assessing the reasonable expectation of privacy can be grouped under four main headings for analytical convenience: (1) the subject matter of the alleged search; (2) the claimant’s interest in the subject matter; (3) the claimant’s subjective expectation of privacy in the subject matter; and (4) whether this subjective expectation of privacy was objectively reasonable, having regard to the totality of the circumstances: Tessling , at para. 32 ; R. v. Patrick , 2009 SCC 17 , [2009] 1 S.C.R. 579, at para. 27 ; R. v. Cole , 2012 SCC 53 , [2012] 3 S.C.R. 34, at para. 40 . However, this is not a purely factual inquiry. The reasonable expectation of privacy standard is normative rather than simply descriptive: Tessling , at para. 42 . Thus, while the analysis is sensitive to the factual context, it is inevitably “laden with value judgments which are made from the independent perspective of the reasonable and informed person who is concerned about the long-term consequences of government action for the protection of privacy”: Patrick , at para. 14 ; see also R. v. Gomboc , 2010 SCC 55 , [2010] 3 S.C.R. 211, at para. 34 , and Ward , at paras. 81-85 .

[ 19 ] I can deal quite briefly with two aspects of the appeal. The trial judge in this case held that there was no subjective expectation of privacy in this case: 2009 SKQB 341 , 361 Sask. R. 1, at para. 18 . However, as I will explain below, the trial judge reached this conclusion by incorrectly defining the subject matter of the search. On the proper understanding of the scope of the search, Mr. Spencer’s subjective expectation of privacy in his online activities can readily be inferred from his use of the network connection to transmit sensitive information: Cole , at para. 43 . Mr. Spencer’s direct interest in the subject matter of the search is equally clear. Though he was not personally a party to the contract with the ISP, he had access to the Internet with the permission of the subscriber and his use of the Internet was by means of his own computer in his own place of residence.

[ 20 ] The main dispute in this case thus turns on the subject matter of the search and whether Mr. Spencer’s subjective expectation of privacy was reasonable. The two circumstances relevant to determining the reasonableness of his expectation of privacy in this case are the nature of the privacy interest at stake and the statutory and contractual framework governing the ISP’s disclosure of subscriber information.

[ 21 ] In this case, I have found it helpful to look first at the subject matter of the search, then at the nature of the privacy interests implicated by the state actions and then finally at the governing contractual and statutory framework. While these subjects are obviously interrelated, approaching the analysis under these broad headings provides a degree of focus while permitting full examination of the “totality of the circumstances”.

(a) The Subject Matter of the Search

[ 22 ] Mr. Spencer alleges that the police request to Shaw is a state action that constitutes a search or seizure for the purposes of s. 8 of the Charter . We must therefore consider what the subject matter of that request was in order to be able to identify the privacy interests that were engaged by it.

[ 23 ] In many cases, defining the subject matter of the police action that is alleged to be a search is straightforward. In others, however, it is not. This case falls into the latter category. The parties and the courts below have markedly divergent perspectives on this important issue, a divergence which is reflected in the jurisprudence: see, for example, the authorities reviewed in Ward , at para. 3 .

[ 24 ] Mr. Spencer contends that the subject matter of the alleged search was core biographical data, revealing intimate and private information about the people living at the address provided by Shaw which matched the IP address. The Crown, on the other hand, maintains that the subject matter of the alleged search was simply a name, address and telephone number matching a publicly available IP address.

[ 25 ] These divergent views were reflected in the decisions of the Saskatchewan courts. The trial judge adopted the Crown’s view that what the police sought and obtained was simply generic information that does not touch on the core of Mr. Spencer’s biographical information. Ottenbreit J.A. in the Court of Appeal was of largely the same view. For him, the information sought by the police in this case simply established the identity of the contractual user of the IP address. The fact that this information might eventually reveal a good deal about the activity of identifiable individuals on the Internet was, for him, “neither here nor there”: 2011 SKCA 144 , 377 Sask. R. 280, at para. 110 (see also R. v. Trapp , 2011 SKCA 143 , 377 Sask. R. 246, at paras. 119-24 and 134 ). In contrast to this approach, Caldwell J.A. (Cameron J.A. concurring on this point) held that in characterizing the subject matter of the alleged search, it is important to look beyond the “mundane” subscriber information such as name and address (para. 22). The potential of that information to reveal intimate details of the lifestyle and personal choices of the individual must also be considered: see also Trapp , per Cameron J.A., at paras. 33-37.

[ 26 ] I am in substantial agreement with Caldwell and Cameron JJ.A. on this point. While, in many cases, defining the subject matter of the search will be uncontroversial, in cases in which it is more difficult, the Court has taken a broad and functional approach to the question, examining the connection between the police investigative technique and the privacy interest at stake. The Court has looked at not only the nature of the precise information sought, but also at the nature of the information that it reveals.

[ 27 ] A number of decisions of the Court reflect this approach. I begin with Plant . There, the Court, dealing with informational privacy, stressed the strong claim to privacy in relation to information that is at the “biographical core of personal information which individuals in a free and democratic society would wish to maintain and control from dissemination to the state”: p. 293. Importantly, the Court went on to make clear that s. 8 protection is accorded not only to the information which is itself of that nature, but also to “information which tends to reveal intimate details of the lifestyle and personal choices of the individual”: ibid. (emphasis added).

[ 28 ] Tessling took the same approach, although it led to a different conclusion. The subject matter of the alleged search was held to be the heat emitted from the surface of a building. The Forward Looking Infra-Red (FLIR) imaging technique was used to help assess the activities that transpired inside a house, but the heat emissions by themselves could not distinguish between one heat source and another. In short, the heat emanations were, on their own, meaningless because they did not permit any inferences about the precise activity giving rise to the heat: paras. 35-36. The critical question was: what inferences about activity inside the home — admittedly a highly private zone — did the FLIR images support?

[ 29 ] I turn next to R. v. Kang-Brown , 2008 SCC 18 , [2008] 1 S.C.R. 456, and the companion appeal in R. v. A.M. , 2008 SCC 19 , [2008] 1 S.C.R. 569. While the Court divided on other points, it was unanimous in holding that the dog sniff of Mr. Kang-Brown’s bag constituted a search. As explained by both Deschamps and Bastarache JJ., the dog sniffing at the air in the vicinity of the bag functioned as an investigative procedure that allowed for a “strong, immediate and direct inference” about what was or was not inside the bag: Deschamps J., at paras. 174-75; Bastarache J., at para. 227. Thus, while the “information” obtained by the sniffer dog was simply the smell of the air outside the bag, the dog’s reaction to it provided the police with a strong inference as to what was inside. As Binnie J. put it in A.M . (which concerned a dog sniff of the accused’s backpack), “[b]y use of the dog, the policeman could ‘see’ through the concealing fabric of the backpack”: para. 67.

[ 30 ] How to characterize the subject matter of an alleged search was addressed by the Court most recently in Gomboc . While the Court was divided on other matters, it was unanimous about the framework that must be applied in considering the subject matter of a “search”. The Court considered the strength of the inference between data derived from a digital recording ammeter (DRA) and particular activities going on in a residence in assessing whether use of the DRA constituted a search. Abella J. (Binnie and LeBel JJ. concurring) took into account “the strong and reliable inference that can be made from the patterns of electricity consumption . . . as to the presence within the home of one particular activity”: para. 81 (emphasis added). The Chief Justice and Fish J. referred to the fact that the DRA data “sheds light on private activities within the home”: para. 119. Deschamps J. (Charron, Rothstein and Cromwell JJ. concurring) spoke in terms of the extent to which the DRA data was revealing of activities in the home: para. 38.

[ 31 ] Thus, it is clear that the tendency of information sought to support inferences in relation to other personal information must be taken into account in characterizing the subject matter of the search. The correct approach was neatly summarized by Doherty J.A. in Ward , at para. 65 . When identifying the subject matter of an alleged search, the court must not do so “narrowly in terms of the physical acts involved or the physical space invaded, but rather by reference to the nature of the privacy interests potentially compromised by the state action”: ibid.

[ 32 ] Applying this approach to the case at hand, I substantially agree with the conclusion reached by Cameron J.A. in Trapp and adopted by Caldwell J.A. in this case. The subject matter of the search was not simply a name and address of someone in a contractual relationship with Shaw. Rather, it was the identity of an Internet subscriber which corresponded to particular Internet usage. As Cameron J.A. put it, at para. 35 of Trapp :

To label information of this kind as mere “subscriber information” or “customer information”, or nothing but “name, address, and telephone number information”, tends to obscure its true nature. I say this because these characterizations gloss over the significance of an IP address and what such an address, once identified with a particular individual, is capable of revealing about that individual, including the individual’s online activity in the home.

[ 33 ] Here, the subject matter of the search is the identity of a subscriber whose Internet connection is linked to particular, monitored Internet activity.

(b) Nature of the Privacy Interest Potentially Compromised by the State Action

[ 34 ] The nature of the privacy interest engaged by the state conduct is another facet of the totality of the circumstances and an important factor in assessing the reasonableness of an expectation of privacy. The Court has previously emphasized an understanding of informational privacy as confidentiality and control of the use of intimate information about oneself. In my view, a somewhat broader understanding of the privacy interest at stake in this case is required to account for the role that anonymity plays in protecting privacy interests online.

[ 35 ] Privacy is admittedly a “broad and somewhat evanescent concept”: Dagg v. Canada (Minister of Finance) , 1997 358 (SCC) , [1997] 2 S.C.R. 403, at para. 67 . Scholars have noted the theoretical disarray of the subject and the lack of consensus apparent about its nature and limits: see, e.g., C. D. L. Hunt, “Conceptualizing Privacy and Elucidating its Importance: Foundational Considerations for the Development of Canada’s Fledgling Privacy Tort” (2011), 37 Queen’s L.J. 167, at pp. 176-77. Notwithstanding these challenges, the Court has described three broad types of privacy interests — territorial, personal, and informational — which, while often overlapping, have proved helpful in identifying the nature of the privacy interest or interests at stake in particular situations: see, e.g., Dyment , at pp. 428-29; Tessling , at paras. 21-24 . These broad descriptions of types of privacy interests are analytical tools, not strict or mutually-exclusive categories.

[ 36 ] The nature of the privacy interest does not depend on whether, in the particular case, privacy shelters legal or illegal activity. The analysis turns on the privacy of the area or the thing being searched and the impact of the search on its target, not the legal or illegal nature of the items sought. To paraphrase Binnie J. in Patrick , the issue is not whether Mr. Spencer had a legitimate privacy interest in concealing his use of the Internet for the purpose of accessing child pornography, but whether people generally have a privacy interest in subscriber information with respect to computers which they use in their home for private purposes: Patrick , at para. 32 .

[ 37 ] We are concerned here primarily with informational privacy. In addition, because the computer identified and in a sense monitored by the police was in Mr. Spencer’s residence, there is an element of territorial privacy in issue as well. However, in this context, the location where the activity occurs is secondary to the nature of the activity itself. Internet users do not expect their online anonymity to cease when they access the Internet outside their homes, via smartphones, or portable devices. Therefore, here as in Patrick , at para. 45 , the fact that a home was involved is not a controlling factor but is nonetheless part of the totality of the circumstances: see, e.g., Ward , at para. 90 .

[ 38 ] To return to informational privacy, it seems to me that privacy in relation to information includes at least three conceptually distinct although overlapping understandings of what privacy is. These are privacy as secrecy, privacy as control and privacy as anonymity.

[ 39 ] Informational privacy is often equated with secrecy or confidentiality. For example, a patient has a reasonable expectation that his or her medical information will be held in trust and confidence by the patient’s physician: see, e.g., McInerney v. MacDonald , 1992 57 (SCC) , [1992] 2 S.C.R. 138, at p. 149.

[ 40 ] Privacy also includes the related but wider notion of control over, access to and use of information, that is, “the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others”: A. F. Westin, Privacy and Freedom (1970), at p. 7, cited in Tessling , at para. 23 . La Forest J. made this point in Dyment . The understanding of informational privacy as control “derives from the assumption that all information about a person is in a fundamental way his own, for him to communicate or retain for himself as he sees fit” ( Dyment , at p. 429, quoting from Privacy and Computers , the Report of the Task Force established by the Department of Communications/Department of Justice (1972), at p. 13). Even though the information will be communicated and cannot be thought of as secret or confidential, “situations abound where the reasonable expectations of the individual that the information shall remain confidential to the persons to whom, and restricted to the purposes for which it is divulged, must be protected” (pp. 429-30); see also R. v. Duarte , 1990 150 (SCC) , [1990] 1 S.C.R. 30, at p. 46.

[ 41 ] There is also a third conception of informational privacy that is particularly important in the context of Internet usage. This is the understanding of privacy as anonymity. In my view, the concept of privacy potentially protected by s. 8 must include this understanding of privacy.

[ 42 ] The notion of privacy as anonymity is not novel. It appears in a wide array of contexts ranging from anonymous surveys to the protection of police informant identities. A person responding to a survey readily agrees to provide what may well be highly personal information. A police informant provides information about the commission of a crime. The information itself is not private — it is communicated precisely so that it will be communicated to others. But the information is communicated on the basis that it will not be identified with the person providing it. Consider situations in which the police want to obtain the list of names that correspond to the identification numbers on individual survey results or to which the defence in a criminal case wants to obtain the identity of the informant who has provided information that has been disclosed to the defence. The privacy interest at stake in these examples is not simply the individual’s name, but the link between the identified individual and the personal information provided anonymously. As the intervener the Canadian Civil Liberties Association urged in its submissions, “maintaining anonymity can be integral to ensuring privacy”: factum, at para. 7.

[ 43 ] Westin identifies anonymity as one of the basic states of privacy. Anonymity permits individuals to act in public places but to preserve freedom from identification and surveillance: pp. 31-32; see A. Slane and L. M. Austin, “What’s In a Name? Privacy and Citizenship in the Voluntary Disclosure of Subscriber Information in Online Child Exploitation Investigations” (2011), 57 Crim. L.Q. 486, at p. 501. The Court’s decision in R. v. Wise , 1992 125 (SCC) , [1992] 1 S.C.R. 527, provides an example of privacy in a public place. The Court held that the ubiquitous monitoring of a vehicle’s whereabouts on public highways amounted to a violation of the suspect’s reasonable expectation of privacy. It could of course have been argued that the electronic device was simply a convenient way of keeping track of where the suspect was driving his car, something that he was doing in public for all to see. But the Court did not take that approach.

[ 44 ] La Forest J. (who, while dissenting on the issue of exclusion of the evidence under s. 24(2) , concurred with respect to the existence of a reasonable expectation of privacy), explained that “[i]n a variety of public contexts, we may expect to be casually observed, but may justifiably be outraged by intensive scrutiny. In these public acts we do not expect to be personally identified and subject to extensive surveillance, but seek to merge into the ‘situational landscape’ ”: p. 558 (emphasis added), quoting M. Gutterman, “A Formulation of the Value and Means Models of the Fourth Amendment in the Age of Technologically Enhanced Surveillance” (1988), 39 Syracuse L. Rev. 647, at p. 706. The mere fact that someone leaves the privacy of their home and enters a public space does not mean that the person abandons all of his or her privacy rights, despite the fact that as a practical matter, such a person may not be able to control who observes him or her in public. Thus, in order to uphold the protection of privacy rights in some contexts, we must recognize anonymity as one conception of privacy: see E. Paton-Simpson, “Privacy and the Reasonable Paranoid: The Protection of Privacy in Public Places” (2000), 50 U.T.L.J. 305, at pp. 325-26; Westin, at p. 32; Gutterman, at p. 706.

[ 45 ] Recognizing that anonymity is one conception of informational privacy seems to me to be particularly important in the context of Internet usage. One form of anonymity, as Westin explained, is what is claimed by an individual who wants to present ideas publicly but does not want to be identified as their author: p. 32. Here, Westin, publishing in 1970, anticipates precisely one of the defining characteristics of some types of Internet communication. The communication may be accessible to millions of people but it is not identified with its author.

[ 46 ] Moreover, the Internet has exponentially increased both the quality and quantity of information that is stored about Internet users. Browsing logs, for example, may provide detailed information about users’ interests. Search engines may gather records of users’ search terms. Advertisers may track their users across networks of websites, gathering an overview of their interests and concerns. “Cookies” may be used to track consumer habits and may provide information about the options selected within a website, which web pages were visited before and after the visit to the host website and any other personal information provided: see N. Gleicher, “Neither a Customer Nor a Subscriber Be: Regulating the Release of User Information on the World Wide Web” (2009), 118 Yale L.J. 1945, at pp. 1948-49; R. W. Hubbard, P. DeFreitas and S. Magotiaux, “The Internet — Expectations of Privacy in a New Context” (2002), 45 Crim. L.Q. 170, at pp. 189-91. The user cannot fully control or even necessarily be aware of who may observe a pattern of online activity, but by remaining anonymous — by guarding the link between the information and the identity of the person to whom it relates — the user can in large measure be assured that the activity remains private: see Slane and Austin, at pp. 500-3.

[ 47 ] In my view, the identity of a person linked to their use of the Internet must be recognized as giving rise to a privacy interest beyond that inherent in the person’s name, address and telephone number found in the subscriber information. A sniffer dog provides information about the contents of the bag and therefore engages the privacy interests relating to its contents. DRA readings provide information about what is going on inside a home and therefore may engage the privacy interests relating to those activities. Similarly, subscriber information, by tending to link particular kinds of information to identifiable individuals, may implicate privacy interests relating not simply to the person’s name or address but to his or her identity as the source, possessor or user of that information.

[ 48 ] Doherty J.A. made this point with his usual insight and clarity in Ward . “Personal privacy” he wrote “protects an individual’s ability to function on a day-to-day basis within society while enjoying a degree of anonymity that is essential to the individual’s personal growth and the flourishing of an open and democratic society”: para. 71. He concluded that some degree of anonymity is a feature of much Internet activity and that, “[d]epending on the totality of the circumstances, . . . anonymity may enjoy constitutional protection under s. 8”: para. 75. I agree. Thus, anonymity may, depending on the totality of the circumstances, be the foundation of a privacy interest that engages constitutional protection against unreasonable search and seizure.

[ 49 ] The intervener the Director of Public Prosecutions raised the concern that recognizing a right to online anonymity would carve out a crime-friendly Internet landscape by impeding the effective investigation and prosecution of online crime. In light of the grave nature of the criminal wrongs that can be committed online, this concern cannot be taken lightly. However, in my view, recognizing that there may be a privacy interest in anonymity depending on the circumstances falls short of recognizing any “right” to anonymity and does not threaten the effectiveness of law enforcement in relation to offences committed on the Internet. In this case, for example, it seems clear that the police had ample information to obtain a production order requiring Shaw to release the subscriber information corresponding to the IP address they had obtained.

[ 50 ] Applying this framework to the facts of the present case is straightforward. In the circumstances of this case, the police request to link a given IP address to subscriber information was in effect a request to link a specific person (or a limited number of persons in the case of shared Internet services) to specific online activities. This sort of request engages the anonymity aspect of the informational privacy interest by attempting to link the suspect with anonymously undertaken online activities, activities which have been recognized by the Court in other circumstances as engaging significant privacy interests: R. v. Morelli , 2010 SCC 8 , [2010] 1 S.C.R. 253, at para. 3 ; Cole , at para. 47 ; R. v. Vu , 2013 SCC 60 , [2013] 3 S.C.R. 657, at paras. 40-45 .

[ 51 ] I conclude therefore that the police request to Shaw for subscriber information corresponding to specifically observed, anonymous Internet activity engages a high level of informational privacy. I agree with Caldwell J.A.’s conclusion on this point:

. . . a reasonable and informed person concerned about the protection of privacy would expect one’s activities on one’s own computer used in one’s own home would be private. . . . In my judgment, it matters not that the personal attributes of the Disclosed Information pertained to Mr. Spencer’s sister because Mr. Spencer was personally and directly exposed to the consequences of the police conduct in this case. As such, the police conduct prima facie engaged a personal privacy right of Mr. Spencer and, in this respect, his interest in the privacy of the Disclosed Information was direct and personal. [para. 27]

(c) Reasonable Expectation of Privacy

[ 52 ] The next question is whether Mr. Spencer’s expectation of privacy was reasonable. The trial judge found that there could be no reasonable expectation of privacy in the face of the relevant contractual and statutory provisions (para. 19), a conclusion with which Caldwell J.A. agreed on appeal: para. 42. Cameron J.A., however, was doubtful that the contractual and statutory terms had this effect in the context of this case: para. 98.

[ 53 ] In this Court, Mr. Spencer maintains that the contractual and statutory terms did not undermine a reasonable expectation of privacy with respect to the subscriber information. He submits that the contractual provisions do nothing more than suggest that the information will not be provided to police unless required by law and that PIPEDA , whose purpose is to protect privacy rights, supports rather than negates the reasonableness of an expectation of privacy in this case. The Crown disagrees and supports the position taken on this point by Caldwell J.A. in the Court of Appeal.

[ 54 ] There is no doubt that the contractual and statutory framework may be relevant to, but not necessarily determinative of, whether there is a reasonable expectation of privacy. So, for example in Gomboc , Deschamps J. writing for four members of the Court, found that the terms governing the relationship between the electricity provider and its customer were “highly significant” to Mr. Gomboc’s reasonable expectation of privacy, but treated it as “one factor amongst many which must be weighed in assessing the totality of the circumstances”: paras. 31-32. She also emphasized that when dealing with contracts of adhesion in the context of a consumer relationship, it was necessary to “procee[d] with caution” when determining the impact that such provision would have on the reasonableness of an expectation of privacy: para. 33. The need for caution in this context was pointedly underlined in the dissenting reasons of the Chief Justice and Fish J. in that case: paras. 138-42.

[ 55 ] The contractual and statutory frameworks overlap in the present case because the Shaw Joint Terms of Service make reference to PIPEDA , and the scope of permitted disclosure under PIPEDA turns partly on whether the customer has consented to the disclosure of personal information. I must first set out the details of these schemes before turning to their impact on the reasonable expectations analysis. In doing so, it becomes apparent that the relevant provisions provide little assistance in evaluating the reasonableness of Mr. Spencer’s expectation of privacy.

[ 56 ] Shaw provides Internet services to its customers under a standard form “Joint Terms of Service” agreement. Additional terms and conditions are provided in Shaw’s “Acceptable Use Policy” and its “Privacy Policy”. The terms of these agreements are posted online on Shaw’s website and change from time to time. The investigators sought the subscriber information for the IP address used on August 31, 2007 in their request to Shaw.

[ 57 ] Mr. Spencer was not personally a party to these agreements, as he accessed the Internet through his sister’s subscription. It is common practice for multiple users to share a common Internet connection. A reasonable user would be aware that the use of the service would be governed by certain terms and conditions, and those terms and conditions were readily accessible through Shaw’s website. This case does not require us to decide whether Mr. Spencer was bound by the terms of the contract with Shaw. Quite apart from contractual liability, the terms on which he gained access to the Internet are a relevant circumstance in assessing the reasonableness of his expectation of privacy. There are three relevant sets of provisions which, taken as a whole, provide a confusing and unclear picture of what Shaw would do when faced with a police request for subscriber information. The Joint Terms of Service at first blush appear to permit broad disclosure because they provide, among other things, that “Shaw may disclose any information as is necessary to . . . satisfy any legal, regulatory or other governmental request”. This general provision, however, must be read in light of the more specific provision relating to disclosure of IP addresses and other identifying information in the context of criminal investigations contained in the Acceptable Use Policy, which in turn is subject to the Privacy Policy.

[ 58 ] The Acceptable Use Policy (last updated on June 18, 2007) provides that Shaw is authorized to cooperate with law enforcement authorities in the investigation of criminal violations, including supplying information identifying a subscriber in accordance with its Privacy Policy . The provision reads as follows:

You hereby authorize Shaw to cooperate with (i) law enforcement authorities in the investigation of suspected criminal violations, and/or (ii) system administrators at other Internet service providers or other network or computing facilities in order to enforce this Agreement. Such cooperation may include Shaw providing the username, IP address, or other identifying information about a subscriber, in accordance with the guidelines set out in Shaw’s Privacy Policy . [Emphasis added.]

[ 59 ] The Privacy Policy in the record (last updated on November 12, 2008) states that Shaw is committed to protecting personal information, which is defined as information about an identifiable individual. One of the ten principles set out in the Privacy Policy deals with limiting the disclosure of personal information (principle 5). The policy limits the circumstances under which personal information will be disclosed without the customer’s knowledge or consent to “exceptional circumstances, as permitted by law”. Shaw may disclose information to its partners in order to provide its services and, in such cases, the information is governed by “strict confidentiality standards and policies” to keep the information secure and to ensure it is treated in accordance with PIPEDA . The Privacy Policy also provides that “Shaw may disclose Customer’s Personal Information to: . . . a third party or parties, where the Customer has given Shaw Consent to such disclosure or if disclosure is required by law , in accordance with The Personal Information Protection and Electronic Documents Act ” (emphasis added).

[ 60 ] Whether or not disclosure of personal information by Shaw is “permitted” or “required by law” in turn depends on an analysis of the applicable statutory framework. The contractual provisions, read as a whole, are confusing and equivocal in terms of their impact on a user’s reasonable expectation of privacy in relation to police initiated requests for subscriber information. The statutory framework provided by PIPEDA is not much more illuminating.

[ 61 ] Shaw’s collection, use, and disclosure of the personal information of its subscribers is subject to PIPEDA , which protects personal information held by organizations engaged in commercial activities from being disclosed without the knowledge or consent of the person to whom the information relates: Sch. 1, clause 4.3. Section 7 contains several exceptions to this general rule and permits organizations to disclose personal information without consent. The exception relied on in this case is s. 7(3)( c. 1)(ii). It permits disclosure to a government institution that has requested the disclosure for the purpose of law enforcement and has stated its “lawful authority” for the request. The provisions of PIPEDA are not of much help in determining whether there is a reasonable expectation of privacy in this case. They lead us in a circle.

[ 62 ] Section 7(3)( c. 1)(ii) allows for disclosure without consent to a government institution where that institution has identified its lawful authority to obtain the information. But the issue is whether there was such lawful authority which in turn depends in part on whether there was a reasonable expectation of privacy with respect to the subscriber information. PIPEDA thus cannot be used as a factor to weigh against the existence of a reasonable expectation of privacy since the proper interpretation of the relevant provision itself depends on whether such a reasonable expectation of privacy exists. Given that the purpose of PIPEDA is to establish rules governing, among other things, disclosure “of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information” (s. 3), it would be reasonable for an Internet user to expect that a simple request by police would not trigger an obligation to disclose personal information or defeat PIPEDA ’s general prohibition on the disclosure of personal information without consent.

[ 63 ] I am aware that I have reached a different result from that reached in similar circumstances by the Ontario Court of Appeal in Ward , where the court held that the provisions of PIPEDA were a factor which weighed against finding a reasonable expectation of privacy in subscriber information. This conclusion was based on two main considerations. The first was that an ISP has a legitimate interest in assisting in law enforcement relating to crimes committed using its services: para. 99. The second was the grave nature of child pornography offences, which made it reasonable to expect that an ISP would cooperate with a police investigation: paras. 102-3. While these considerations are certainly relevant from a policy perspective, they cannot override the clear statutory language of s. 7(3) ( c. 1)(ii) of PIPEDA , which permits disclosure only if a request is made by a government institution with “lawful authority” to request the disclosure. It is reasonable to expect that an organization bound by PIPEDA will respect its statutory obligations with respect to personal information. The Court of Appeal in Ward held that s. 7(3) ( c. 1)(ii) must be read in light of s. 5(3), which states that “[a]n organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances”. This rule of “reasonable disclosure” was used as a basis to invoke considerations such as allowing ISPs to cooperate with the police and preventing serious crimes in the interpretation of PIPEDA . Section 5(3) is a guiding principle that underpins the interpretation of the various provisions of PIPEDA . It does not allow for a departure from the clear requirement that a requesting government institution possess “lawful authority” and so does not resolve the essential circularity of using s. 7(3) ( c. 1)(ii) as a factor in determining whether a reasonable expectation of privacy exists.

[ 64 ] I also note with respect to an ISP’s legitimate interest in preventing crimes committed through its services that entirely different considerations may apply where an ISP itself detects illegal activity and of its own motion wishes to report this activity to the police. Such a situation falls under a separate, broader exemption in PIPEDA , namely s. 7(3) ( d ). The investigation in this case was begun as a police investigation and the disclosure of the subscriber information arose out of the request letter sent by the police to Shaw.

[ 65 ] The overall impression created by these terms is that disclosure at the request of the police would be made only where required or permitted by law. Such disclosure is only permitted by PIPEDA in accordance with the exception in s. 7 , which in this case would require the requesting police to have “lawful authority” to request the disclosure. For reasons that I will set out in the next section, this request had no lawful authority in the sense that while the police could ask, they had no authority to compel compliance with that request. I conclude that, if anything, the contractual provisions in this case support the existence of a reasonable expectation of privacy, since the Privacy Policy narrowly circumscribes Shaw’s right to disclose the personal information of subscribers.

[ 66 ] In my view, in the totality of the circumstances of this case, there is a reasonable expectation of privacy in the subscriber information. The disclosure of this information will often amount to the identification of a user with intimate or sensitive activities being carried out online, usually on the understanding that these activities would be anonymous. A request by a police officer that an ISP voluntarily disclose such information amounts to a search.

[ 67 ] The intervener the Attorney General of Alberta raised a concern that if the police were not permitted to request disclosure of subscriber information, then other routine inquiries that might reveal sensitive information about a suspect would also be prohibited, and this would unduly impede the investigation of crimes. For example, when the police interview the victim of a crime, core biographical details of a suspect’s lifestyle might be revealed. I do not agree that this result follows from the principles set out in these reasons. Where a police officer requests disclosure of information relating to a suspect from a third party, whether there is a search depends on whether, in light of the totality of the circumstances, the suspect has a reasonable expectation of privacy in that information: Plant , at p. 293; Gomboc , at paras. 27-30 , per Deschamps J. In Duarte , the Court distinguished between a person repeating a conversation with a suspect to the police and the police procuring an audio recording of the same conversation. The Court held that the danger is “not the risk that someone will repeat our words but the much more insidious danger inherent in allowing the state, in its unfettered discretion, to record and transmit our words”: at pp. 43-44. Similarly in this case, the police request that the ISP disclose the subscriber information was in effect a request to link Mr. Spencer with precise online activity that had been the subject of monitoring by the police and thus engaged a more significant privacy interest than a simple question posed by the police in the course of an investigation.

B. Was the Search Lawful?

[ 68 ] A warrantless search, such as the one that occurred in this case, is presumptively unreasonable: R. v. Collins , 1987 84 (SCC) , [1987] 1 S.C.R. 265. The Crown bears the burden of rebutting this presumption. A search will be reasonable if (a) it was authorized by law, (b) the law itself was reasonable, and (c) the search was carried out in a reasonable manner: p. 278. Mr. Spencer has not challenged the constitutionality of the laws that purportedly authorized the search. He did raise concerns about the reasonableness of the manner, but in my view, these are groundless. Accordingly, we need only consider whether the search was authorized by law.

[ 69 ] The Crown supports the conclusions of Caldwell and Cameron JJ.A. in the Court of Appeal that any search was lawful, relying on the combined effect of s. 487.014 of the Criminal Code and s. 7(3) ( c. 1)(ii) of PIPEDA . I respectfully do not agree.

[ 70 ] Section 487.014(1) of the Criminal Code provides that a peace officer does not need a production order “to ask a person to voluntarily provide to the officer documents, data or information that the person is not prohibited by law from disclosing”. PIPEDA prohibits disclosure of the information unless the requirements of the law enforcement provision are met, including that the government institution discloses a lawful authority to obtain , not simply to ask for the information: s. 7(3)( c. 1)(ii). On the Crown’s reading of these provisions, PIPEDA ’s protections become virtually meaningless in the face of a police request for personal information: the “lawful authority” is a simple request without power to compel and, because there was a simple request, the institution is no longer prohibited by law from disclosing the information.

[ 71 ] “Lawful authority” in s. 7(3) ( c. 1)(ii) of PIPEDA must be contrasted with s. 7(3) ( c ), which provides that personal information may be disclosed without consent where “required to comply with a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with rules of court relating to the production of records”. The reference to “lawful authority” in s. 7(3)( c. 1)(ii) must mean something other than a “subpoena or [search] warrant”. “Lawful authority” may include several things. It may refer to the common law authority of the police to ask questions relating to matters that are not subject to a reasonable expectation of privacy. It may refer to the authority of police to conduct warrantless searches under exigent circumstances or where authorized by a reasonable law: Collins . As the intervener the Privacy Commissioner of Canada submitted, interpreting “lawful authority” as requiring more than a bare request by law enforcement gives this term a meaningful role to play in the context of s. 7(3) and should be preferred over alternative meanings that do not do so. In short, I agree with the Ontario Court of Appeal in Ward on this point that neither s. 487.014(1) of the Criminal Code , nor PIPEDA creates any police search and seizure powers: para. 46.

[ 72 ] I recognize that this conclusion differs from that of the Saskatchewan Court of Appeal in Trapp , at para. 66 , and the British Columbia Supreme Court in R. v. McNeice , 2010 BCSC 1544 () , at para. 43 . The Court of Appeal in Trapp read s. 487.014(1) together with s. 29(2) (g) of The Freedom of Information and Protection of Privacy Act , S.S. 1990-91, c. F-22.01, an analogous provision to s. 7(3) ( c. 1)(ii) of PIPEDA , although one from which the “lawful authority” requirement is absent. The court held that s. 487.014(1) gave the police a power to make any inquiries that were not otherwise prohibited by law. The court in McNeice took the same approach, although that case concerned s. 7(3) ( c. 1)(ii) of PIPEDA , the same provision at issue in this case.

[ 73 ] With respect, I cannot accept that this conclusion applies to s. 7(3) ( c. 1)(ii) of PIPEDA . Section 487.014(1) is a declaratory provision that confirms the existing common law powers of police officers to make enquiries, as indicated by the fact that the section begins with the phrase “[f]or greater certainty”: see Ward , at para. 49 . PIPEDA is a statute whose purpose, as set out in s. 3 , is to increase the protection of personal information. Since in the circumstances of this case the police do not have the power to conduct a search for subscriber information in the absence of exigent circumstances or a reasonable law, I do not see how they could gain a new search power through the combination of a declaratory provision and a provision enacted to promote the protection of personal information.

[ 74 ] The subscriber information obtained by police was used in support of the Information to Obtain which led to the issuance of a warrant to search Ms. Spencer’s residence. Without that information, the warrant could not have been obtained. It follows that if that information is excluded from consideration as it must be because it was unconstitutionally obtained, there were not adequate grounds to sustain the issuance of the warrant, and the search of the residence was therefore unlawful. I conclude, therefore, that the conduct of the search of Ms. Spencer’s residence violated the Charter : Plant , at p. 296; Hunter v. Southam , at p. 161. Nothing in these reasons addresses or diminishes any existing powers of the police to obtain subscriber information in exigent circumstances such as, for example, where the information is required to prevent imminent bodily harm. There were no such circumstances here.

C. Should the Evidence Have Been Excluded

[ 75 ] Neither the trial judge nor the Court of Appeal found a breach of s. 8 in this case and, therefore, did not have to consider the question of whether the evidence obtained in a manner that violated Mr. Spencer’s Charter rights should be excluded under s. 24(2) of the Charter . The question is whether the admission of the evidence would bring the administration of justice into disrepute. I accept, as both Mr. Spencer and the Crown agree, that we can determine this issue on the record before us. However, I disagree with Mr. Spencer’s submission that the evidence should be excluded. In my view, it should not.

[ 76 ] The test for applying s. 24(2) is set out in R. v. Grant , 2009 SCC 32 , [2009] 2 S.C.R. 353. The court must “assess and balance the effect of admitting the evidence on society’s confidence in the justice system having regard to: (1) the seriousness of the Charter -infringing state conduct . . ., (2) the impact of the breach on the Charter -protected interests of the accused . . ., and (3) society’s interest in the adjudication of the case on its merits”: para. 71.

[ 77 ] Turning first to the seriousness of the state conduct, my view is that it cannot be characterized as constituting either “[w]ilful or flagrant disregard of the Charter ”: Grant , at para. 75 . Det. Sgt. Parisien testified that he believed the request to Shaw was authorized by law and that Shaw could consent to provide the information to him. He also testified, however, that he was aware that there were decisions both ways on the issue of whether this was a legally acceptable practice. While I would not want to be understood to be encouraging the police to act without warrants in “gray areas”, in light of the fact that the trial judge and three judges of the Court of Appeal concluded that Det. Sgt. Parisien had acted lawfully, his belief was clearly reasonable. In short, the police were acting by what they reasonably thought were lawful means to pursue an important law enforcement purpose. There is no challenge to any other aspect of the information to obtain the search warrant. The nature of the police conduct in this case would not tend to bring the administration of justice into disrepute.

[ 78 ] The second Grant factor is the impact of the Charter -infringing conduct on Mr. Spencer’s Charter -protected interests. That impact here was serious. As discussed above, anonymity is an important safeguard for privacy interests online. The violation of that anonymity exposed personal choices made by Mr. Spencer to be his own and subjected them to police scrutiny as such. This weighs in favour of excluding the evidence.

[ 79 ] That brings me to the final factor, society’s interest in an adjudication on the merits. As explained in Grant ,

while the public has a heightened interest in seeing a determination on the merits where the offence charged is serious, it also has a vital interest in having a justice system that is above reproach, particularly where the penal stakes for the accused are high. [para. 84]

[ 80 ] The offences here are serious and carry minimum prison sentences. Society has both a strong interest in the adjudication of the case and also in ensuring that the justice system remains above reproach in its treatment of those charged with these serious offences. If the evidence is excluded, the Crown will effectively have no case. The impugned evidence (the electronic files containing child pornography) is reliable and was admitted by the defence at trial to constitute child pornography. Society undoubtedly has an interest in seeing a full and fair trial based on reliable evidence, and all the more so for a crime which implicates the safety of children.

[ 81 ] Balancing the three factors, my view is that exclusion of the evidence rather than its admission would bring the administration of justice into disrepute, and I would uphold its admission.

D. The Fault Element of the “Making Available” Offence

[ 82 ] The Court of Appeal ordered a new trial on the “making available” count on the basis that the trial judge had erred in his analysis of the fault requirement for the offence. It found that the trial judge had erred by finding that the making available offence required that Mr. Spencer knew that some positive act on his part facilitated access by others to the pornography. This error, in the Court of Appeal’s view, led the judge to fail to consider whether Mr. Spencer had been wilfully blind to the fact that the pornography was being made available to others through the shared folder. I respectfully agree with the Court of Appeal on both points and would affirm the order for a new trial.

[ 83 ] There is no dispute that the accused in a prosecution under s. 163.1(3) of the Criminal Code must be proved to have had knowledge that the pornographic material was being made available. This does not require, however, as the trial judge suggested, that the accused must knowingly, by some positive act, facilitate the availability of the material. I accept Caldwell J.A.’s conclusion that the offence is complete once the accused knowingly makes pornography available to others. As he put it,

[i]n the context of a file sharing program, the mens rea element of making available child pornography under s. 163.1(3) requires proof of the intent to make computer files containing child pornography available to others using that program or actual knowledge that the file sharing program makes files available to others. [para. 87]

While the trial judge’s reasons may perhaps be open to more than one interpretation on this point, reading his reasons as a whole, I also agree with Caldwell J.A. that the trial judge erred in deciding that a positive act was required to satisfy the mens rea component of the making available offence: para. 81.

[ 84 ] I further agree with Caldwell J.A. that wilful blindness was a live issue on the evidence and that it was because of the trial judge’s error in relation to positive facilitation that he did not turn his mind to the evidence that could support an inference of wilful blindness. Wilful blindness is a substitute for knowledge. As explained by Charron J. in R. v. Briscoe , 2010 SCC 13 , [2010] 1 S.C.R. 411, at para. 21 ,

[w]ilful blindness does not define the mens rea required for particular offences. Rather, it can substitute for actual knowledge whenever knowledge is a component of the mens rea . The doctrine of wilful blindness imputes knowledge to an accused whose suspicion is aroused to the point where he or she sees the need for further inquiries, but deliberately chooses not to make those inquiries. See Sansregret v. The Queen , 1985 79 (SCC) , [1985] 1 S.C.R. 570, and R. v. Jorgensen , 1995 85 (SCC) , [1995] 4 S.C.R. 55. As Sopinka J. succinctly put it in Jorgensen (at para. 103 ), “[a] finding of wilful blindness involves an affirmative answer to the question: Did the accused shut his eyes because he knew or strongly suspected that looking would fix him with knowledge?” [Emphasis added.]

[ 85 ] The evidence calling for consideration of wilful blindness included, for example, evidence that in Mr. Spencer’s statement to police he acknowledged the following: that LimeWire is a file-sharing program; that he had changed at least one default setting in LimeWire; that when LimeWire is first installed on a computer, it displays information notifying the user that it is a file-sharing program; that at the start of each session, LimeWire notifies the user that it is a file-sharing program and warns of the ramifications of file-sharing; and that LimeWire contains built-in visual indicators that show the progress of the uploading of files by others from the user’s computer: paras. 88-89.

[ 86 ] Given that wilful blindness was a live issue and that the trial judge’s error in holding that a positive act was required to meet the mens rea component of the making available offence resulted in his not considering the wilful blindness issue, I agree with Caldwell J.A. that the error could reasonably be thought to have had a bearing on his decision to acquit: para. 93; R. v. Graveline , 2006 SCC 16 , [2006] 1 S.C.R. 609, at para. 14 .

III. Disposition

[ 87 ] I would dismiss the appeal, affirm the conviction on the possession count and uphold the Court of Appeal’s order for a new trial on the making available count.

Appendix

Personal Information Protection and Electronic Documents Act , S.C. 2000, c. 5

7. . . .

(3) [Disclosure without knowledge or consent] For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is

( c ) required to comply with a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with rules of court relating to the production of records;

( c. 1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that

(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or

( d ) made on the initiative of the organization to an investigative body, a government institution or a part of a government institution and the organization

(i) has reasonable grounds to believe that the information relates to a breach of an agreement or a contravention of the laws of Canada, a province or a foreign jurisdiction that has been, is being or is about to be committed, or

(ii) suspects that the information relates to national security, the defence of Canada or the conduct of international affairs;

Criminal Code , R.S.C. 1985, c. C-46

163.1 . . .

(3) [Distribution, etc. of child pornography] Every person who transmits, makes available, distributes, sells, advertises, imports, exports or possesses for the purpose of transmission, making available, distribution, sale, advertising or exportation any child pornography is guilty of

( a ) an indictable offence and liable to imprisonment for a term not exceeding ten years and to a minimum punishment of imprisonment for a term of one year; or

( b ) an offence punishable on summary conviction and is liable to imprisonment for a term not exceeding two years less a day and to a minimum punishment of imprisonment for a term of six months.

487.014 (1) [Power of peace officer] For greater certainty, no production order is necessary for a peace officer or public officer enforcing or administering this or any other Act of Parliament to ask a person to voluntarily provide to the officer documents, data or information that the person is not prohibited by law from disclosing.

Appeal dismissed.

Solicitors for the appellant: McDougall Gauley, Regina.

Solicitor for the respondent: Attorney General for Saskatchewan, Regina.

Solicitor for the intervener the Director of Public Prosecutions: Public Prosecution Service of Canada, Edmonton and Halifax.

Solicitor for the intervener the Attorney General of Ontario: Attorney General of Ontario, Toronto.

Solicitor for the intervener the Attorney General of Alberta: Attorney General of Alberta, Calgary.

Solicitors for the intervener the Privacy Commissioner of Canada: Osler, Hoskin & Harcourt, Toronto.

Solicitors for the intervener the Canadian Civil Liberties Association: Kapoor Barristers, Toronto.

Solicitors for the intervener the Criminal Lawyers’ Association of Ontario: Dawe & Dineen, Toronto; Schreck Presser, Toronto.

• A motion to amend the reasons was granted on November 6, 2014, amending para. 12. The amendments are included in these reasons.