2026 ONSC 783

COURT FILE NO.: CV-14-00504139- 0000

DATE: 20260210

ONTARIO SUPERIOR COURT OF JUSTICE

BETWEEN:

CORPORATION OF THE CANADIAN

Andrew Lokan and Kartiga Thavaraj , for

CIVIL LIBERTIES ASSOCIATION and

the Applicants

CHRISTOPHER PARSONS

Applicants

• and -

HIS MAJESTY THE KING IN RIGHT OF

CANADA, as represented by THE

Andrew Law and Emmett Bisbee , for the

ATTORNEY GENERAL OF CANADA

Respondent

Respondent

ATTORNEY GENERAL OF ONTARIO

Waleed Malik and Sean Hanley , for the

Intervenor

Attorney General of Ontario, Intervenor

THE PRIVACY COMMISSIONER OF

Rebecca De Sanctis and

CANADA

Sarah Speevak , for The Privacy

Intervenor

Commissioner of Canada, Intervenor

HEARD at Toronto: December 16, 17,

and 18, 2025

J.K. PENMAN J.

REASONS FOR JUDGMENT

A. Overview

[ 1 ] The Personal Information Protection and Electronic Documents Act , S.C. 2000,

c. 5 (“PIPEDA”) establishes the legislative framework that permits a private

telecommunications service provider (“TSP”) to disclose an individual’s basic subscriber information to Canadian government authorities without the individual’s knowledge or consent, and without the need for prior judicial authorization.

[ 2 ] In specified circumstances, PIPEDA allows the government institution to withhold from the individual disclosure of the fact that the request was made. The only means by which an individual will become aware that their information has been disclosed is if they face criminal charges or make a request for the information that the government institution does not block.

[ 3 ] There is no judicial scrutiny of this process, and although the Office of the Privacy Commissioner (the “OPC”) in theory has an oversight role, in practical terms there is very little accountability or transparency.

[ 4 ] The Corporation of the Canadian Civil Liberties Association (the “CCLA”) and Christopher Parsons (the “Applicants”) commenced this Application in May of 2014, seeking declarations of invalidity of the impugned PIPEDA provisions on the basis that they violate ss. 7 , 8 , and 2(b) of the Canadian Charter of Rights and Freedoms .

[ 5 ] The Applicants argue that PIPEDA’s framework, which permits disclosures to government institutions on assertions of “lawful authority”, fails to meet constitutional standards because it lacks meaningful oversight, transparency, or mechanisms to prevent unreasonable search and seizure under s. 8 of the Charter . They argue that the provisions are vague, overbroad, and arbitrary, and that the gathering and storage of personal information violates individuals’ liberty and security of the person, contrary to

s. 7.

[ 6 ] To the extent that the provisions prevent individuals from learning about the disclosure of personal information to a government institution, the Applicants assert they also infringe s. 2 (b). They argue that these infringements are not demonstrably justified under s. 1 of the Charter .

[ 7 ] The Applicants seek declarations of invalidity of the impugned provisions, and an order that the federal government take steps to delete and destroy the information they have obtained through disclosure requests made under the impugned provisions.

[ 8 ] In June of 2014, the Supreme Court of Canada released its decision in R. v. Spencer , 2014 SCC 43 , [2014] 2 S.C.R. 212 , which held that PIPEDA is a statute whose purpose is to increase the protection of personal information and that it does not create and police search and seizure powers: at para. 73.

[ 9 ] The Respondent, the Attorney General of Canada (“AG Canada”), argues that PIPEDA does not engage s. 8 of the Charter . AG Canada relies on Spencer and the decision of the Court of Appeal for Ontario in R. v. Orlandis-Habsburgo , 2017 ONCA 649 , 352 C.C.C. (3d) 525 , in which the Court confirmed that s. 8 protections only apply to statues that authorize a search and seizure, and PIPEDA does not provide any search power: at paras. 122-124. AG Canada argues I am bound by the decisions in Spencer and Orlandis-Habsburgo and must find that section 8 of the Charter is not engaged in this case.

[ 10 ] AG Canada also argues that the s. 7 arguments are simply the s. 8 arguments “re- packaged”, and the same reasoning in Orlandis-Habsburgo applies. They argue further that a discretionary power to refuse access to government information does not infringe

s. 2(b) of the Charter .

[ 11 ] The Attorney General of Ontario (“AG Ontario”) intervened as of right and adopted the position of AG Canada. AG Ontario also argued that the Applicants do not have the evidence or standing to justify the remedy sought.

[ 12 ] The Privacy Commissioner of Canada intervened and took no position on the constitutional issues raised but provided information and context as to the Commissioner’s oversight role in relation to the impugned provisions.

[ 13 ] The Applicants urged me to find that the decision in Orlandis-Habsburgo does not apply in this case for three reasons. First, they argue the Court’s discussion of PIPEDA was obiter , and therefore not binding on me. Second, they argue the Court in Orlandis-

Habsburgo did not have any legislative fact evidence before it. Third, they argue that it was in response to an “unserious” challenge brought by an individual accused and was not fully argued.

[ 14 ] The issues for me to determine in this application involve a consideration of the ambit and effect of searches under the PIPEDA regime. The specific questions I must answer are as follows:

• Am I bound by the findings in Orlandis-Habsburgo , that s. 8 of the Charter is not engaged because PIPEDA does not provide any search or seizure authority?

• Do the impugned PIPEDA provisions engage s. 7 privacy interests beyond what is protected under s. 8 of the Charter ?

• Do the PIPEDA veto provisions, which allow the government to bar the disclosure of information about their requests to the people whose privacy interests are engaged, violate s. 2(b) by limiting meaningful public discussion about the government’s collection of information?

[ 15 ] For the following reasons, I find that I am bound by the decision of the Court of Appeal in Orlandis-Habsburgo , that PIPEDA does not authorize a search or seizure, and its disclosure provisions do not, therefore, engage s. 8 privacy protections. However, if I were not bound by Orlandis-Habsburgo , based on the record before me, I would have significant concerns that the lack of oversight, accountability, and transparency renders the gathering of information within the PIPEDA framework constitutionally suspect.

[ 16 ] I also find that the PIPEDA provisions do not engage s. 7 privacy interests beyond what would be covered by s. 8 , and, in this case, is determined by the findings in Orlandis- Habsburgo .

[ 17 ] Finally, I find that s. 2 (b) is not infringed because I am not satisfied that the PIPEDA veto provisions, which bar the disclosure of information about government requests to the people whose privacy interests are engaged, violate s. 2(b) by limiting meaningful public discussion about the government’s collection of information.

[ 18 ] Before addressing the substantive Charter issues, I will provide a summary of the facts to put the argument in context. Next, I will outline the statutory framework of PIPEDA and the Privacy Act , R.S.C., 1985, c. P-21, followed by my analysis and findings with respect to the specific issues raised in this application.

B. Summary of the Facts

[ 19 ] Before 2014, government institutions requested and received personal information at volumes estimated at roughly 1.2 million requests annually. This rested on an assumption that PIPEDA itself authorized such disclosures.

[ 20 ] In 2014, the Supreme Court of Canada released Spencer , which found that PIPEDA does not create any police search and seizure powers: at para. 73. After the decision in Spencer , requests declined substantially but still remain significant— approximately 200,000 annually.

[ 21 ] The Canada Border Services Agency (the “CBSA”), Royal Canadian Mounted Police (“RCMP”), Canadian Security Intelligence Service (“CSIS”), Communications Security Establishment Canada (“CSE”), Canada Revenue Agency (“CRA”), and the Competition Bureau account for most of these requests.

[ 22 ] Government institutions seek and collect personal information from TSPs in support of criminal, national security, and intelligence investigations. The information shared with government institutions can be shared with other domestic or foreign agencies in connection with matters of national security and international affairs, or for purposes of law enforcement in a foreign jurisdiction.

[ 23 ] The government institution only has to assert that they have “lawful authority” to obtain the information. The Supreme Court in Spencer examined the scope of “lawful authority” and found that “lawful authority” must refer to something other than a subpoena or search warrant. “Lawful authority” may include the common law authority of the police to ask questions relating to matters that are not subject to a reasonable expectation of privacy, as well as the authority of the police to conduct warrantless searches under “exigent circumstances” or where authorized by a reasonable law: see para. 71.

[ 24 ] PIPEDA provides no mechanism by which a TSP can verify the government’s assertion of “lawful authority” or confirm exigent circumstances. What the various TSPs consider “emergency”, or “exigent circumstances” varies, and includes everything from missing persons, to harm, to property.

[ 25 ] Because PIPEDA is permissive, it is up to the TSPs to consider each request and determine whether the criteria have been met. TSPs vary considerably—from national corporations with legal departments to small providers with limited capacity—creating unpredictable and inconsistent decision-making.

[ 26 ] Most individuals will only learn that their TSP disclosed subscriber information to the government if they face criminal charges or if they proactively seek out the information and the government does not block their request.

[ 27 ] While the government has instituted Transparency Report Guidelines to provide for transparency and accountability, the reporting mechanism is not mandatory, and there is no consistency in the form or content of the reports.

[ 28 ] There is no judicial oversight of the process.

Statutory Framework

[ 29 ] Where an organization makes disclosure to a government institution, both PIPEDA and the Privacy Act are engaged. This case is specifically concerned with TSPs, although “organization” as defined in PIPEDA has a broader reach and is defined to include an association, a partnership, a person, and a trade union.

[ 30 ] PIPEDA governs the handling of personal information by the private sector, and the Privacy Act governs the handling of personal information by government institutions. The Privacy Commissioner is empowered to investigate both sides of the “information flow”. These mechanisms, however, are complaint-driven, requiring an individual to either suspect or have the knowledge to make a request.

i) PIPEDA

[ 31 ] PIPEDA governs how private sector organizations collect, use, and disclose private information. Pursuant to s. 4(1)(a), PIPEDA applies, with some exceptions, to all organizations that collect, use, or disclose personal information in the “course of commercial activities”.

[ 32 ] Section 3 of PIPEDA recognizes that individuals have a right of privacy with respect to their personal information, while also recognizing the need of organizations to collect, use, or disclose personal information for purposes that “a reasonable person would consider appropriate”.

[ 33 ] Section 2(1) of PIPEDA defines “personal information” as “information about an identifiable individual”.

[ 34 ] PIPEDA sets out rules that allow for the disclosure of personal information without the knowledge or consent of an individual in a variety of circumstances. These are the provisions at issue in this application.

The Impugned Provisions

[ 35 ] Section 7(3)(c.1) allows private sector organizations to disclose personal information to a government institution in a variety of circumstances. This section creates an exception to the requirement that an organization must obtain the consent of an individual prior to disclosing their personal information.

[ 36 ] Section 7(3)(c.1) permits an organization to disclose personal information to a “government institution” without the individual’s knowledge or consent if the government institution has identified its “lawful authority to obtain the information” and made the request in one of the four circumstances enumerated in ss. (c.1)(i-iv), which generally relate to national security and law enforcement, and read as follows:

(i) it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs,

(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law,

(iii) the disclosure is requested for the purpose of administering any law of Canada or a province, or

(iv) the disclosure is requested for the purpose of communicating with the next of kin or authorized representative of an injured, ill or deceased individual.

[ 37 ] Sections 9(2.1), 9(2.2), 9(2.3), and 9(2.4), the “veto provisions”, limit what an individual can learn about disclosure requests that are made by government institutions. The private organization must notify the government institution if an individual requests information from the organization regarding disclosure of their personal information. The section does not permit the private organization to disclose or withhold disclosure of a request without first notifying the government institution of the request.

[ 38 ] A government institution can then prohibit a private organization from notifying an individual that their personal information has been disclosed to a government institution if it is, pursuant to s. 9(2.3), “of the opinion” that the disclosure could reasonably be expected to be injurious to:

(a) national security, the defence of Canada or the conduct of international affairs;

(a.1) the detection, prevention or deterrence of money laundering or the financing of terrorist activities; or

(b) the enforcement or investigation of any law of Canada, a province of foreign jurisdiction, or the gathering of intelligence for such purpose.

[ 39 ] If the government institution objects to disclosure being provided to the individual, the organization shall refuse the request and shall not disclose to the individual any information relating to the disclosed information, the notification of the government institution, and its objection. In other words, while an individual can ask the TSP whether their personal information has been disclosed to a government institution, there is no guarantee their request will be answered.

[ 40 ] The organization must notify the Privacy Commissioner, in writing and without delay, if the government institution objects to the organization complying with the request:

s. 9(2.4)(b). PIPEDA is silent on what the Privacy Commissioner is to do once they receive the notification.

[ 41 ] Under s. 11(1), individuals may file complaints with the OPC alleging a contravention of the Act. Under s. 11(2), the Commissioner may initiate a complaint if it is satisfied that “there are reasonable grounds to investigate a matter”. Commissioner- initiated investigations are rare.

ii) The Privacy Act

[ 42 ] The Privacy Act requires that no personal information is to be collected by a government institution unless it relates directly to an operating program or activity of that institution. The Act establishes that, with limited exceptions, a government institution may only collect personal information intended to be used for an administrative purpose directly from the individual to whom it relates.

[ 43 ] The Privacy Act requires that government institutions develop and maintain Personal Information Banks (“PIBs”), which are a collection or grouping of personal information under the control of a particular government institution.

[ 44 ] Section 12 requires that an individual shall be given a right of access to any personal information contained in a PIB. While an individual may make a request for his or her personal information held in a PIB, they must first identify the government agency that may have collected the information, identify a specific PIB within that agency, and then make a request for information through that specific PIB.

[ 45 ] Section 22 provides that a government institution may refuse to disclose any personal information if it would be “injurious” to law enforcement or the security of penal institutions.

[ 46 ] Under s. 29, an individual who is aware, or suspects that a federal government institution has collected their personal information that was disclosed to it pursuant to

s. 12(1), can file a complaint against the government institution and the OPC would investigate whether the collection was in accordance with the Privacy Act .

C. Oversight Mechanisms

Office of the Privacy Commissioner of Canada

[ 47 ] The OPC is responsible for overseeing compliance with both PIPEDA and the Privacy Act . Individuals may file complaints with the OPC alleging that an organization has improperly disclosed their personal information to a government institution without consent.

[ 48 ] Upon receiving such a complaint, the OPC determines whether a disclosure occurred and whether it was authorized by meaningful consent or satisfied the statutory grounds permitting disclosure without consent. Under PIPEDA, however, the OPC has no oversight mandate respecting a government institution’s collection of the information once disclosed.

[ 49 ] The OPC’s oversight is limited to the legislative framework established by PIPEDA. The OPC acknowledges that the nature of the impugned provisions “hinders an individual’s ability to file complaints”. Disclosures under s. 7(3)(c.1) occur without the individual’s knowledge or consent, and organizations have no obligation to notify the OPC when they make such disclosures.

[ 50 ] If an individual has no reason to suspect that their personal information has been disclosed to a government institution, it is unlikely they would file a complaint.

[ 51 ] The OPC’s ability to initiate audits or to commence Commissioner-initiated complaints under PIPEDA is discretionary, subject to statutory thresholds, and resource-intensive.

[ 52 ] To initiate an investigation under s. 11(2), the Commissioner needs to be satisfied that there are “reasonable grounds to investigate a matter”. Commissioner initiated investigations are rare.

[ 53 ] Section 12 provides the OPC a broad range of powers in the conduct of an investigation, including the ability to compel witnesses to give evidence and produce records, and the ability to enter premises occupied by an organization. Under s. 13(1), the OPC is to provide a report to the complainant and organization within one year of the complaint.

[ 54 ] Following an investigation, the Commissioner may issue non-binding findings and recommendations. The OPC does not have the power to grant binding remedies; it cannot compel an organization to accept findings or follow recommendations, nor can it order an organization to disclose personal information.

[ 55 ] Under s. 14, after receiving the OPC report, the complainant or the Commissioner may apply to the Federal Court for a hearing. At the conclusion of the hearing, the Court may order an organization to correct its practices or publish a notice of any action it has taken.

[ 56 ] While the Commissioner can publish guidance or best practices, these are also non-binding. The Commissioner cannot order organizations to adopt certain practices, including publishing Transparency Reports.

[ 57 ] Under the Privacy Act , the Commissioner may investigate how an institution has collected, used, disclosed or otherwise handled an individual’s personal information, as well as allegations of denial of access to personal information.

[ 58 ] Complaints filed by individuals under the Privacy Act are also dependent on the individual having some knowledge, doubt, or suspicion that an institution has collected their personal information before they could file a complaint with the OPC.

[ 59 ] If an individual has some degree of knowledge, they can file an access request under the Privacy Act . However, the individual would need to identify a PIB established by the specific government institution that they believe contains their information or be

able to provide sufficiently specific information on the location of the information as to render it “reasonably retrievable” by the government institution.

[ 60 ] Section 34 provides the Privacy Commissioner with investigative powers, including the ability to summon and enforce the appearance of witnesses, compel them to give evidence and produce records, or enter premises occupied by an organization. A report is to be provided to the government institution if the complaint is “well-founded”.

[ 61 ] If access is still not provided to the individual, the complainant or the Privacy Commissioner can apply to the Federal Court for a review of the matter.

[ 62 ] While the Commissioner has broad investigative powers, similar to PIPEDA, government institutions are not bound by the Commissioner’s findings following an investigation.

Transparency Reports

[ 63 ] In 2015, the government introduced guidelines for the creation of Transparency Reports. The guidelines were prepared to help private organizations be open with their customers regarding the management and sharing of their personal information with government, while respecting the work of law enforcement, national security agencies, and regulatory authorities.

[ 64 ] The guidelines provide that organizations may choose to report the number of disclosures made to government authorities in specified categories and may choose to include the number of requests received, the number of requests fulfilled, the number of requests rejected or contested; and the number of persons or accounts whose information was disclosed.

[ 65 ] There is, however, no requirement that TSPs prepare or publish Transparency Reports. The Transparency Reports differ markedly in form, content, and methodology. There is no standardized reporting framework, and each TSP independently determines how to categorize and count disclosure requests.

[ 66 ] The Applicants filed three affidavits from Mr. Parsons, who has spent years studying the disclosure of personal information by TSPs, and the extent to which government agencies access and use such information for policing and security purposes. In his affidavits, Mr. Parsons opined on the efficacy of the Transparency Reports. The Applicants also filed copies of the Transparency Reports.

[ 67 ] AG Canada objected to the admissibility of Mr. Parsons’ opinions but did not object to the admissibility of the Transparency Reports. It is not necessary for me to rule on the admissibility of Mr. Parsons’ opinion because I can review the Transparency Reports and draw my own conclusions as to their efficacy, which I have done. I have not relied on the opinions provided by Mr. Parsons in his affidavits.

[ 68 ] The reports group government demands for information into broad headings— such as warrants, court orders, emergency requests, or voluntary disclosures—without identifying the specific statutory authority invoked, or the particular agencies seeking the information. This lack of granularity makes it impossible to ascertain which institutions are requesting subscriber data, the legal basis relied upon, or the nature of the data sought.

[ 69 ] The reports are similarly silent on refusals. They do not disclose how often requests for information are denied, on what grounds, or how many subscribers are affected by either granted or refused requests. In some cases, TSPs combine the number of disclosure requests and the number of affected subscribers into a single category, further obscuring the scope of government access.

[ 70 ] The reports also provide no insight into how TSPs interpret and apply concepts such as “lawful authority” or “exigent circumstances”, despite significant differences in the internal resources and expertise available to large versus small providers.

[ 71 ] Compounding these challenges is the inconsistency in what TSPs classify as basic subscriber information. While some limit this category to names and addresses, others include highly sensitive identifiers such as dates of birth, government-issued identification numbers, email addresses, and even credit card data.

[ 72 ] Finally, several TSPs will not provide details about their disclosure practices without specific information or the payment of fees, or if the retrieval of records is burdensome. Many offer only generic descriptions of the data they may collect, retain, or disclose.

[ 73 ] Taken together, these variations undermine the usefulness of Transparency Reports and limit their ability to meaningfully inform the public or the courts about the scale and nature of state access to subscriber information.

D. Analysis

Am I bound by the findings in Orlandis-Habsburgo that s. 8 of the Charter is not engaged because PIPEDA does not provide any search or seizure authority?

[ 74 ] I find that I am bound by the finding in Orlandis-Habsburgo that PIPEDA does not authorize a search or seizure, and the disclosure provisions of PIPEDA do not engage

s. 8 privacy protections.

[ 75 ] In Orlandis-Habsburgo , the appellants were operating a commercial-sized marijuana grow operation. Their energy provider noted a pattern of electricity use that was believed to be consistent with that of a grow operation. It forwarded this information to the police, who obtained a warrant, in part relying on this information. At trial, the defence argued that the police violated the appellant’s rights under s. 8 of the Charter and also challenged the constitutionality of various provisions of the Municipal Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. M.56 (“MFIPPA”) and PIPEDA. The trial judge rejected the s. 8 claim and found that the various privacy legislation provisions were not inconsistent with the Charter .

[ 76 ] The appeal proceeded on two grounds. The first concerned whether the police’s use of the shared energy consumption data violated s. 8. Second, the appellants challenged the constitutionality of various provisions in MFIPPA and PIPEDA. On the first ground, the Court of Appeal found a s. 8 violation in the examination and use of the data. The evidence, however, was not excluded.

[ 77 ] On the second ground, Doherty J.A. referred to the appellants’ constitutional challenge of a “myriad” of provisions of MFIPPA and PIPEDA. It is clear from a reading

of the whole reasons that the Court is referring to the provisions in s. 7(3)(c.1) of PIPEDA. Doherty J.A. went on to indicate that “[v]ery little time was spent in oral argument” on the constitutionality of the provisions: at paras. 120-121.

[ 78 ] Importantly, however, Doherty J.A. confirmed that PIPEDA does not create any police search or seizure power, but rather that the PIPEDA provisions are permissive and “in no way determinative of any s. 8 claim advanced in respect of the disclosure of the information to the police”. Rather, the terms of the legislation are one of many factors that “informs the court’s determination of whether a reasonable expectation of privacy exists, and if so, the nature and extent of that expectation.”: at paras. 122-123, referring to Spencer , at para. 71 ; R. v. Ward , 2012 ONCA 660 , 112 O.R. (3d) 321 , at paras. 46 -

[ 79 ] Doherty J.A., at para. 124, did not accept that PIPEDA could still violate s. 8 , notwithstanding that it is not a statute that authorizes any search or seizure:

In their factum, the appellants acknowledge that neither PIPEDA nor MFIPPA creates police powers of search or seizure. However, the appellants go on to challenge various provisions in those statutes on the basis that they fail to meet the requirements set down in Hunter v. Southam Inc ., [1984]

2 S.C.R. 145 . Hunter does not, however, create a freestanding constitutional standard. Rather, Hunter identifies standards applicable to statutes that authorize searches or seizures. As neither PIPEDA nor MFIPPA authorize a search or seizure, compliance with the Hunter standard is irrelevant to the constitutionality of those provisions.

[ 80 ] The constitutional challenge was dismissed on this basis.

[ 81 ] The Applicants argue that these findings are obiter , the court having already found a breach of s. 8 . I do not agree. There were two separate and independent s. 8 grounds of appeal: First, the s. 8 challenge to the specific police conduct seeking exclusion of evidence; and second, a separate claim for declarations of unconstitutionality of

provisions of PIPEDA. This is evident in the opening paragraphs of the judgment where both challenges are outlined as separate grounds of appeal. Each of the grounds was analyzed separately, and I do not accept that the findings are not binding because the reasons are brief, or that it was based on an unserious challenge and not fully argued.

[ 82 ] Stare decisis can only be departed from in two situations. First, a trial judge can consider and decide arguments based on Charter provisions that were not raised in the earlier case. Second, the matter may be revisited if new legal issues are raised because of significant developments in the law, or if there is a change in the circumstances or evidence that fundamentally shifts the parameters of the debate: Canada (Attorney General) v. Bedford , 2013 SCC 72 , [2013] 3 S.C.R. 1101 , at para. 42 . More or different evidence is not enough.

[ 83 ] I am not persuaded that there has been a fundamental shift in the way that courts conceive of the legal framework at issue in this case. In my view, the brevity of Doherty J.A.’s reasons do not mean that the conclusion is incorrect. They are brief because the legal conclusion that PIPEDA does not create any police search or seizure power is well established: see Ward , at paras. 46-47 ; Spencer , at para. 71 ; Royal Bank of Canada v. Ren , 2009 ONCA 48 , 93 O.R. (3d) 403 , at para. 21 , leave to appeal refused, [2009] S.C.C.A. No. 111; R. v. Croft , 2013 ABQB 665 , 573 A.R. 363 , at para. 45 .

[ 84 ] I am also not persuaded on the record before me that there has been a fundamental shift of legislative or social fact that would justify departing from a binding decision of the Court of Appeal. The Applicants also argue that there is a different evidentiary record before this Court that includes legislative fact evidence.

[ 85 ] There is no indication in the reasons what evidentiary record was before the Court of Appeal, nor does Doherty J.A. qualify his conclusion with language to the effect of “based on the record before me”. In any event, most of the evidence that was led in this case pre-dates the Orlandis-Habsburgo decision.

[ 86 ] There is no basis in the evidence before me to find Doherty J.A.’s interpretation of PIPEDA was incorrect.

[ 87 ] I am also not persuaded by the Applicants’ argument that Orlandis-Habsburgo conflicts with the Supreme Court decision of Goodwin v. British Columbia (Superintendent of Motor Vehicles) , 2015 SCC 46 , [2015] 3 S.C.R. 250 . In that case, the province had established an automatic roadside prohibition (“ARP”) scheme under the Motor Vehicle Act , R.S.B.C. 1996, c. 318 (“MVA”), aimed at removing impaired drivers from the road through license suspensions, penalties, and remedial programs.

[ 88 ] Instead of relying on the use of breathalyzer tests at the police station, driving prohibitions would now be issued following a roadside analysis, using an ASD. On appeal, it was argued that the ARP regime violated s. 8 as an unreasonable search and seizure.

[ 89 ] The province argued that s. 8 did not apply because the search was not authorized by the MVA but by the Criminal Code , R.S.C. 1985, c. C-46. The Supreme Court disagreed, finding that the purpose and consequences of the seizure are established under the ARP scheme, and it is the ARP scheme that authorizes the search of the breath sample. “The seizure thus takes its colour from the provincial legislation and cannot be read in isolation from that scheme”: at para. 54.

[ 90 ] The ARP scheme dictates why the search was being done, what the consequences are, and what state interest was being advanced. The seizure, although authorized by a different statute, is entirely anchored in the provincial scheme.

[ 91 ] This is not the case with PIPEDA, which operates as a permissive scheme that does not incorporate or provide any search powers. PIPEDA does not establish the purpose, consequence, or the state interest being advanced by the search.

[ 92 ] For all these reasons, I am satisfied that Orlandis-Habsburgo is dispositive of the Applicants’ s. 8 challenge.

Constitutional Concerns with the Existing Scheme

[ 93 ] If I were not bound by the decision in Orlandis-Habsburgo , I would be concerned that the lack of prior judicial authorization, oversight, accountability, and transparency renders the gathering of information within the PIPEDA framework constitutionally

suspect. These deficiencies engage the fundamental constitutional value that individuals are to be free from unjustified state intrusion.

[ 94 ] Prior judicial authorization operates as an essential safeguard. It ensures that when law enforcement or governmental bodies seek to obtain an individual’s information or property, the process occurs under judicial oversight. This safeguard is grounded in the core constitutional principle that individuals are entitled to protection against unjustified state intrusion, which, in turn, necessitates prior authorization.

[ 95 ] Despite this system of prior authorization, Canadian courts have on many occasions found search and seizures conducted pursuant to prior judicial authorization to be unreasonable and have excluded evidence as a result. This reality is significant. In cases where prior authorization exists, even judicial scrutiny at the outset is not enough to prevent unreasonable searches.

[ 96 ] In the present context, law enforcement and government actors operate to seek and obtain an individual’s basic subscriber information without any judicial scrutiny.

[ 97 ] Judicial scrutiny is important for two reasons. First, it provides for a review of the authorization to ensure that it meets constitutional standards. Second, the fact that authorizations are subject to judicial scrutiny provides an incentive for the applying party to ensure attention and compliance with these standards.

[ 98 ] It is reasonable to infer that, at the margins, this absence of any meaningful oversight fosters or can foster a degree of carelessness even where good faith is present. While employees may work as well in the absence of supervision, our experience has taught us that supervision encourages diligence.

[ 99 ] It is also clear that some requests for judicial authorization are rejected in the first instance. Even with the knowledge of scrutiny, some applications are deficient.

[ 100 ] Against that backdrop, when such a large number of requests are conducted by law enforcement and government actors without legislation or jurisprudence on the limits of their authority to request information, without any prior judicial authorization, and

without the discipline that such oversight imposes, it is virtually certain that some will not be truly urgent nor provide a proper basis for authorization.

[ 101 ] If even one in one hundred searches is unconstitutional, then in the context of hundreds or thousands of requests, the number of unreasonable intrusions becomes significant.

[ 102 ] There is nothing in PIPEDA that ensures that a government institution’s assertions of “lawful authority” could withstand judicial scrutiny. PIPEDA does not contain a mechanism by which a TSP can verify the government’s lawful authority underlying its information request, and there is no means by which a TSP can confirm exigent circumstances exist.

[ 103 ] It is up to the individual TSPs to determine whether the criteria have been met. TSPs range from major corporations with large compliance departments to small operations that rely on one or two people to process disclosure requests, creating unpredictable and inconsistent decision-making.

[ 104 ] The concept of basic subscriber information is crucial for any s. 8 analysis involving a request for such information. The nature of the information sought is one factor in what must be a contextual analysis that informs whether a reasonable expectation of privacy exists: see Spencer at paras. 54-66 .

[ 105 ] Basic subscriber information is not a defined term in PIPEDA. Mr. Parsons testified that the concept of basic subscriber information is “vague, fluid, and contested”, and can also include more revealing data, including Internet protocol addresses, financial information, and cellphone identifiers.

[ 106 ] Michael Geist, professor at the University of Ottawa and Canada Research Chair in Internet and E-Commerce Law, said the following when asked about a definition for basic subscriber information:

I don’t think there is a strict definition. I think that’s one of the challenges of the area, is that it often means something different to different people.

It can include, as I said, everything from name and address. To email address, IP address, billing information, and then a series of identifiers that might be attached to your device or your computer, and it all depends on who you’re talking to about what gets included within BSI.

[ 107 ] Whether a search for basic subscriber information interferes with a reasonable expectation of privacy will vary. However, for the purposes of this application, the range of information that may be disclosed in a request for basic subscriber information necessarily involves a substantial risk that the information disclosed could attract a reasonable expectation of privacy.

[ 108 ] Courts now recognize that the Internet retains a large amount of data available about a user, and the connections that can be drawn by an aggregation of those data points is substantial. Individuals are often unaware of how much of their information has been left on the Internet, or who may be tracking their online behaviour: R. v. Bykovets , 2024 SCC 6 , at paras. 73-78 .

[ 109 ] As the Supreme Court noted in Bykovets , at para. 67 :

We would not want the social media profiles we linger on to become the knowledge of the state. Nor would we want the intimately private version of ourselves revealed by the collection of key terms we have recently entered into a search engine to spill over into the offline world. Those who use the Internet should be entitled to expect that the state does not access this information without a proper constitutional basis.

[ 110 ] Disclosure of personal information may occur without the individual’s knowledge or consent, and there is no statutory obligation on an organization to notify the OPC when such disclosure takes place.

[ 111 ] The OPC’s oversight framework is premised on an affected individual becoming aware of, or suspecting, that their information has been disclosed. Because the OPC process is complaint-driven, its oversight is neither comprehensive nor sufficiently transparent.

[ 112 ] The Privacy Commissioner is empowered to investigate when an organization provides disclosure to a government institution. The provisions themselves, however, almost inevitably ensure that an individual will never know or suspect that their information has been disclosed.

[ 113 ] Although the Privacy Act permits an individual to request access to his or her personal information contained in a PIB, this mechanism does not function as a practical form of oversight.

[ 114 ] TSP Transparency Reports lack standardization, using broad, inconsistent categories that obscure which agencies seek subscriber data, as well as under what legal authority and for what purpose they do so.

[ 115 ] It is almost inevitable that TSPs will disclose basic subscriber information in situations where law enforcement agencies are “pushing the envelope” and exceed the bounds of their lawful authority. The absence of meaningful oversight adds to the concern that there is nothing to prevent the privacy interests of people in Canada from being infringed.

Does PIPEDA engage s. 7 beyond what is protected under s. 8?

[ 116 ] Privacy interests are protected by both s. 7 and s. 8 of the Charter .: see R. v. O’Connor , [1995] 4 S.C.R. 411 , at para. 110 ; Cheskies v. Ontario (Attorney General) (2007) , 87 O.R. (3d) 581 (S.C.) , at para. 82 ; Cash Converters Canada Inc. v. Oshawa (City) 2007 ONCA 502 , 86 O.R. (3d) 401 , at para. 29 .

[ 117 ] The privacy rights guaranteed by s. 8 are a “specific instance” of the broader rights entrenched in s. 7: R. v. Généreux , [1992] 1 S.C.R. 259 , at p. 310 . Section 7 plays a role complementary to s. 8 because it provides protections that go beyond protections offered by specific guarantees: R. v. Brunelle , 2024 SCC 3 , at para. 68 .

[ 118 ] The fundamental question, however, is whether there is a s. 7 claim in this case that is not encompassed by the specific guarantee in s. 8.

[ 119 ] The Applicants argue that the impugned provisions violate s. 7 on the basis that state-induced disclosure of an individual’s basic subscriber information increases an individual’s risk of harm to their liberty and security of the person interests.

[ 120 ] The Applicants’ position is that there are three ways in which the s. 7 right is greater than the s. 8 right, thereby providing a broader constitutional home than s. 8 . First, s. 7 protects a more substantive interest, in this case the freedom from an individual person’s information being released without accountability. Second, it protects an individual’s right to engage in online activities free from a concern about being identified, and with a measure of autonomy and dignity. And third, s. 7 is the appropriate lens through which to assess the legal regime that, by design and cumulative effect, undermines privacy in a way that an individual search may not.

[ 121 ] I am not persuaded by these arguments. I am satisfied that the s. 7 argument as articulated in this case is simply a “re-packaging” of the s. 8 arguments.

[ 122 ] The Applicants’ s. 7 claim, as articulated in their materials, is that PIPEDA “allows the state to obtain basic subscriber information from TSPs in a manner that lacks accountability”. Basic subscriber information linked to information such as location history, contact networks, and other anonymous metadata can identify and reveal intimate details about an individual’s life.

[ 123 ] The Applicants assert that s. 7 is engaged beyond s. 8 in that the state’s obtaining of this information increases a person’s risk of psychological harm, prosecution, and harm from deprivation to liberty and personal security. In my view, these concerns all fit within the scope of s. 8 . The risk of imprisonment as an eventual consequence of a search would turn virtually every s. 8 challenge into a s. 7 challenge: R. v. Bogaerts , 2019 ONCA 876 , 389 C.C.C. (3d) 227 , at para. 50 .

[ 124 ] I find that s. 8 provides a more specific and complete illustration of the s. 7 right even where there is a claim of state imposed psychological harm. This claim properly

falls within s. 8 because a reasonable search respects the principles of fundamental justice: see Bogaerts , at para. 54 , citing R. v. Rodgers , 2006 SCC 15 , 1 S.C.R. 554, at para. 23 ; R. v. Mills , [1999] 3 S.C.R. 668, at paras. 87-88 .

[ 125 ] While there are legitimate oversight and accountability issues, the Supreme Court has also confirmed these issues are best dealt with under s. 8 because oversight and accountability concerns form part of the reasonableness analysis: R. v. Tse , 2012 SCC 16 , [2012] 1 S.C.R. 531 , at para. 82 ; Wakeling v. United States of America, 2014 SCC

72, 2014 SCC 72 , [2014] 3 S.C.R. 549, at paras. 48- 52 .

[ 126 ] As Doherty J.A. found in Orlandis-Habsburgo , PIPEDA does not confer on its own, any authority on the state to obtain information that might engage a s. 7 interest. The power to obtain basic subscriber information must exist outside the statute: at para. 71.

[ 127 ] For these reasons, I am not persuaded that there is a s. 7 interest that is engaged beyond what is captured by s. 8 . This challenge is more properly considered under s. 8 , which in this case, is determined by the findings in Orlandis-Habsburgo .

Do the PIPEDA veto provisions impede meaningful public discussion about the government’s collection of basic subscriber information, violating the right to freedom of expression in s. 2(b) of the Charter ?

[ 128 ] The Applicants argue that the veto provisions violate freedom of expression in

s. 2(b) because the denial of access substantially impedes meaningful public discussion and criticism on matters of public interest. AG Canada argues that s. 2 (b) guarantees freedom of expression, not access to information.

[ 129 ] The Supreme Court of Canada, in R. v. National Post , 2010 SCC 16 , [2010] 1

S.C.R. 477, at para. 28, confirmed that freedom of expression protects “readers and listeners as well as writers and speakers”.

[ 130 ] Access to documents in government hands is constitutionally protected only where, without the desired access, meaningful public discussion and criticism on matters of public interest would be substantially impeded. In Ontario (Public Safety and Security)

v. Criminal Lawyers’ Association , 2010 SCC 23 , [2010] 1 S.C.R. 815 , the Supreme Court

confirmed that information is a “derivative right which may arise where it is a necessary precondition of meaningful expression on the functioning of government”: at para. 30.

[ 131 ] To establish that access would further the purposes of s. 2 (b), a claimant must show that access is necessary for the meaningful exercise of free expression on matters of public or political interest: Criminal Lawyers’ Association , at para. 36 .

[ 132 ] The Applicants suggest that the veto provisions operate to prevent the TSP from telling and allowing an individual to learn that their personal information has been disclosed, and that this is a barrier to freedom of expression. I do not dispute that this is how the veto provisions can operate. A proper characterization, however, of the veto provisions is that they are discretionary. Section 9(2.3) of PIPEDA allows but does not require a government institution to object to disclosure by a TSP.

[ 133 ] The Applicants point to Mr. Parsons’ evidence that 50,000 to 60,000 people visited the website titled “Access My Information”, by which members of the public could seek information from their TSPs. This suggests that there is significant public interest in obtaining information about these practices.

[ 134 ] However, the PIPEDA veto provisions incorporate a discretion which requires the government institution to weigh the considerations for and against disclosure, including the public interest in disclosure.

[ 135 ] The Supreme Court, in Criminal Lawyers’ Association , found that a discretion which provides for a proper balancing of the interests at stake, including the public interest in disclosure, does not, on its own, preclude meaningful commentary. The exercise of discretion is based on a weighing of all valid considerations, including the public interest in disclosure: at paras. 42-52.

[ 136 ] While limited, there is also oversight in that the OPC does have the ability to oversee or challenge how government institutions assert this veto. Again, while not without its limitations, the Privacy Act also offers alternate procedural protections. The Privacy Commissioner can receive and investigate complaints of any access refusal, as

well as provide the right to review any such refusal in Federal Court: Ruby v. Canada (Solicitor General) , 2002 SCC 75 , [2002] 4 S.C.R. 3 , at para. 47 .

[ 137 ] There is no denial of meaningful commentary on matters of public interest in these circumstances.

[ 138 ] In addition, the second component of the s. 2 (b) access test requires the claimant to show that the protection is not removed by countervailing considerations inconsistent with production: see Criminal Lawyers’ Association , at para. 38 .

[ 139 ] Under s. 9(2.3) of PIPEDA, a government institution may only object if disclosure could reasonably be expected to be injurious to an important public interest, such as national security, defence, prevention of terrorist financing, and other law enforcement.

[ 140 ] I accept that there is a legitimate public interest in preventing persons under investigation from learning of that fact and potentially altering their behaviour to avoid detection or destroy evidence. As the Supreme Court confirmed, “there is a strong public interest in protecting documents relating to law enforcement”: Criminal Lawyers’ Association , at para. 44 .

[ 141 ] The provisions are discretionary, and to the extent that the government has the ability to deny access, I am not satisfied this substantially impedes meaningful discussion and criticism on matters of public interest.

[ 142 ] The Applicants have not established that the PIPEDA s. 9 veto provisions infringe the right of freedom of expression under s. 2(b) of the Charter .

Admissibility Issue concerning Order Paper Questions and Parliamentary Privilege

[ 143 ] Mr. Parsons made requests directly to the TSPs for information about the nature and number of requests made by the government under PIPEDA for personal information. Mr. Parsons also worked with a legislative aide to Member of Parliament, Charmaine Borg, to develop a series of questions designed to obtain information on how often federal agencies request information from TSPs. Those questions largely mirrored the questions Mr. Parsons posed in his requests to the TSPs.

[ 144 ] On January 27, 2014, Ms. Borg placed a series of questions on the Order Paper. On March 24, 2014, responses were received to Ms. Borg’s questions.

[ 145 ] On May 22, 2014, Member of Parliament, Irwin Cotler placed questions on the Order Paper raising many of the same issues. Responses to these questions were provided by the government on September 16, 2014. Ms. Borg placed another series of questions on the Order Paper on June 18, 2014. The responses were signed by individual Members of Parliament acting on behalf of the particular government agency. These responses were included in the Applicants’ materials.

[ 146 ] Most of the responses received pre-date the Supreme Court of Canada’s decision in Spencer . As a result, they do not reflect the current state of requests for personal information under PIPEDA.

[ 147 ] AG Canada has asserted privilege over the answers that were provided by the government: Canada (House of Commons) v. Vaid , 2005 SCC 30 , [2005] 1 S.C.R. 667 ,

at para. 29; Hudson v. Canada , 2025 FC 485 , at paras. 36- 38 .

[ 148 ] The Applicants have conceded that the evidence over which AG Canada has claimed Parliamentary privilege is duplicative of other evidence in the record. The contested evidence is also very dated and therefore, of limited value. The Applicants did not press the issue of its admissibility at the hearing of this application. In those circumstances, I decline to make any finding as to whether the responses to the questions on the Order Paper are subject to Parliamentary privilege. I find the evidence is not necessary or relevant to my resolution of the constitutionality of the scheme.

E. Disposition

[ 149 ] The application to declare that ss. 7(3)(c.1), 9(2.1), 9(2.2), 9(2.3), and 9(2.4) of PIPEDA violate ss. 8 , 7 , or 2(b) of the Charter is dismissed.

F. Costs

[ 150 ] I would encourage the parties to try to settle costs of the application. If they cannot, the Respondent may serve and file written cost submissions within 20 days of the release of these Reasons for Judgment, followed by the Applicants’ written cost submissions

within a further 15 days. The costs submissions shall not exceed three pages in length, excluding the Bill of Costs.

Released: February 10, 2026

2026 ONSC 783

COURT FILE NO.: CV-14-00504139- 0000

DATE: 20260210

ONTARIO SUPERIOR COURT OF JUSTICE

BETWEEN:

CORPORATION OF THE CANADIAN CIVIL LIBERTIES ASSOCIATION and CHRISTOPHER PARSONS Applicants - and - HIS MAJESTY THE KING IN RIGHT OF CANADA, as represented by THE ATTORNEY GENERAL OF CANADA Respondent - and - ATTORNEY GENERAL OF ONTARIO Intervenor - and- THE PRIVACY COMMISSIONER OF CANADA Intervenor

REASONS FOR JUDGMENT

J.K. Penman J.

Released: February 10, 2026