Periodically on Thursdays, we present a significant excerpt, usually from a recently published book or journal article. In every case the proper permissions have been obtained. If you are a publisher who would like to participate in this feature, please let us know via the site’s contact form.
Authors: Gerald Chan and Susan Magotiaux
Foreword: The Honorable Thomas A. Cromwell
General Editors: Justice Vincenzo Rondinelli and Brian H. Greenspan
Publisher: Emond Publishing
Page Count: 235
Publication Date: November, 2017
Regular Price: $99
Series Subscription Price: $85
© 2017 Irwin Law. All rights reserved.
Excerpt: Chapter 1, pgs. 4-6.
The contents of this excerpt may be also be downloaded in PDF format.
PART 1 (Search and Seizure)
“Reasonable Expectation of Privacy in Digital Data”
A search or seizure occurs when police action intrudes on a “reasonable expectation of privacy.”1 A reasonable expectation of privacy includes both a subjective and an objective component. It is a finding based on the totality of circumstances and a key battleground of litigation in the digital era.
Totality of circumstance is a very broad umbrella. The mass of digital information potentially available relating to any given person is unquestionably vast. Every bank transaction, email, wi-fi connection, purchase, membership, job, hobby, friend, and event may be captured in some form or another. It is no surprise, then, that the inquiry into what is expected and what is objectively reasonable in modern society is a challenging one. Ownership, access, and control, all concepts traditionally applied in privacy analysis, have different meanings in a digital world of connectivity and anonymity. These concepts have evolved through careful consideration by Canadian courts to adapt to new understandings of what we want, hope, and need to keep from state eyes.
This chapter explores the basics of defining a privacy interest in digital data and the application of those concepts to different types of information (e.g., subscriber information versus content) and different contexts such as home and office computers, online activity, and sent communications. For counsel working in this area, the significance of the determination of a reasonable expectation of privacy cannot be overstated. It opens or ends the section 8 analysis. Lawyers need to understand the first principles of privacy in order to effectively argue about appropriate extensions of those principles and the attendant rights and state obligations in digital contexts.
II. Defining Privacy
Privacy may be physical, territorial, or informational. Digital evidence most commonly engages concerns over informational privacy. Courts sometimes comment on territorial concerns, where, for example, a computer is used or found in a bedroom or a workplace, but given the mobility of technology and the accessibility of digital data from multiple locations, the spatial boundaries to privacy are increasingly meaningless. A bedroom tablet may also be a mobile phone and a platform for office videoconferencing. Files created in a home setting may be intended for and broadcast immediately to a worldwide audience. Individuals’ expectations of privacy in digital data relate less to where they use devices and more to what they use them for. Practically, that means that arguments should focus less on where the device is stored or found or used and more on what information the state is accessing.
Traditional privacy analysis focused largely on the tangible factors of control and access to locations where evidence was seized. In R v Edwards, the Supreme Court of Canada (SCC) set out a flexible framework with key questions to ask in assessing privacy interests.2 The non-exhaustive list of factors identified as instructive for the privacy analysis in Edwards is as follows:
(i) presence [of the accused] at the time of the search;
(ii) possession or control of the property or place searched;
(iii) ownership of the property or place;
(iv) historical use of the property or item;
(v) the ability to regulate access, including the right to admit or exclude others from the place;
(vi) the existence of a subjective expectation of privacy; and
(vii) the objective reasonableness of the expectation.3
Edwards dealt with a claim of privacy over evidence found in an apartment that the accused did not own. However, despite the territorial privacy at issue in that case, the Edwards framework remains relevant and has been adapted to a modern context and to claims of informational privacy.4
Several modifications of the totality of circumstances test have been articulated to organize analysis in a given fact scenario. For example, in R v Patrick, Binnie J listed factors similar to those in Edwards but geared toward addressing situations where territorial and information privacy overlap.5 Patrick dealt with garbage bags put out for collection and retrieved by police. In R v Spencer, which dealt with informational privacy relating to Internet service subscriber data in the hands of third-party companies, Cromwell J, for the court, organized the expectation of privacy analysis into four general areas: (1) the subject matter of the alleged search; (2) the claimant’s interest in the subject matter; (3) the claimant’s subjective expectation of privacy; and (4) whether this subjective expectation of privacy was objectively reasonable, having regard to the totality of the circumstances.6 None of these tests are inconsistent; they are articulations of the same overarching concerns grouped differently as suited to a particular inquiry. Again, argument on what data were seized, not on where the machine sat at seizure or during use, is the best focus.
A primary factor to consider under any privacy rubric is the nature of the information obtained and the extent to which it falls within the “biographical core of personal information which individuals in a free and democratic society would wish to maintain and control from dissemination to the state.”7 This factor can often be determinative of the analysis. Courts adopt a broad and purposive approach in defining the subject matter of a privacy claim. Defence counsel push as much as they can into that core, and Crown counsel try to narrowly restrict it. It is worth it for counsel to spend time to properly characterize the digital evidence at issue.
In R v Plant, the SCC first defined the protected zone of privacy as encompassing information touching on a biographical core. The Plant court held that electricity consumption records held by electrical utility companies did not fall within the “biographical core”; while they revealed the pattern of one’s electricity consumption in the residence, they did not reveal any intimate details of personal lifestyle or private decisions.8 Thus, section 8 of the Charter9 did not apply to the access that police gained to a computer terminal set up by the utility to allow police to look up the appellant’s electrical consumption records.
In R v Gomboc, however, information of a similar nature had a different hue.10 Six out of nine judges of the SCC in Gomboc found that the installation of a digital recording ammeter (DRA) on the appellant’s power line by the utility company (at the request of the police) engaged the “biographical core” of personal information belonging to the appellant (although seven of nine judges ultimately held that the appellant did not have a reasonable expectation of privacy as a result of other factors in the totality of the circumstances). The difference between the DRA in Gomboc and the electricity records in Plant is that the former revealed electricity consumption patterns at a much higher level detail, such that stronger inferences could be drawn about the precise household activities giving rise to those consumption patterns (e.g., marijuana grow operation). The strength of the inference that the information supports is critical.11 Crown counsel would want to argue that electrical consumption never changes—it is not core data. But defence counsel may find traction, as in Gomboc, in arguing that data reveal more about the target than a simply metric output. The more defence counsel can tie the data obtained to intimate lifestyle choices and features, the more likely a court is to see it as falling under the core umbrella and worthy of section 8 protection.
1 Hunter v Southam Inc,  2 SCR 145 at 159.
2  1 SCR 128 at para 45.
4 See e.g. R v Plant,  3 SCR 281 at para 45; R v Tessling, 2004 SCC 67,  3 SCR 432 at para 32; R v Cole, 2012 SCC 53,  3 SCR 34 at paras 39-58; R v Patrick, 2009 SCC 17,  1 SCR 579 at para 27.
5 Supra note 4 at para 27.
6 2014 SCC 43,  2 SCR 212 at para 18.
7 Plant, supra note 4 at para 20.
9 Part I of the Constitution Act, 1982, Schedule B to the Canada Act 1982 (UK), 1982, c 11.
10 2010 SCC 55 at para 38,  3 SCR 211, per Deschamps J; para 81, per Abella J; and paras 128-32, per McLachlin CJ and Fish J, dissenting.
11 See discussion of Gomboc by the court in Spencer, supra note 6 at para 30.
12 2017 ONCA 649 at paras 75-76.
13 Orlandis-Habsburgo, supra note 12; R v AM, 2008 SCC 19,  1 SCR 569, at paras 67-68.
14 Supra note 6.
15 Ibid at para 24.
16 Ibid at para 66.