Transcript iSearch: There’s an APP for That

iSearch: Reasonable
Expectation of Privacy
in the Digital Age
Joseph Di Luca, Di Luca Barristers
7/17/2015
1
Overview
• First principles of reasonable expectation of privacy
• Defining the reasonable expectation of privacy
associated with electronic devices
• Case law update
• Litigation tips
Joseph Di Luca, Di Luca Barristers
7/17/2015
2
Apollo 11
7/17/2015
3
Cell Phone or Weapon?
7/17/2015
4
iBond
7/17/2015
5
Reasonable Expectation of Privacy:
First Principles
• SCC has established a purposive approach to s. 8 in
which privacy is the organizing principle. “The
guarantee of security from unreasonable search
and seizure only protects a reasonable
expectation”: Hunter v. Southam
• Examinations and investigations that do not intrude
on some reasonable expectation of privacy do not
engage s. 8 of the Charter and there is no
obligation that such state action be reasonable or
authorized by law.
Joseph Di Luca, Di Luca Barristers
7/17/2015
6
Reasonable Expectation of Privacy:
First Principles
• REP is to be determined on the basis of the “totality of
the circumstances”: R. v. Edwards
• The analysis proceeds in two steps, asking whether the
accused had a subjective expectation of privacy and
whether that expectation of privacy was objectively
reasonable: R. v. Tessling
• In assessing whether a REP exists, courts make a value
judgement. Court to consider not only how much
privacy individuals in fact experience but also how
much privacy we ought to enjoy. It is a normative rather
than descriptive standard: R. v. Tessling; R. v. Ward
Joseph Di Luca, Di Luca Barristers
7/17/2015
7
Crime Control
7/17/2015
8
Due Process
7/17/2015
9
First Principles of Privacy
• R. v. Ward per Doherty J.A.
• [71]
Personal privacy is about more than secrecy and
confidentiality. Privacy is about being left alone by the state
and not being liable to be called to account for anything and
everything one does, says or thinks. Personal privacy protects
an individual’s ability to function on a day-to-day basis within
society while enjoying a degree of anonymity that is essential
to the individual’s personal growth and the flourishing of an
open and democratic society.
• I think that s. 8 encompasses the concept of “public privacy”
described above.[1] Surely, if the state could unilaterally, and
without restraint, gather information to identify individuals
engaged in public activities of interest to the state, individual
freedom and with it meaningful participation in the
democratic process would be curtailed. It is hardly surprising
that constant unchecked state surveillance of those engaged
in public activities is a feature of many dystopian novels.
Footer Text
7/17/2015
10
First Principles Cont’d.
•
•
A purposive approach to s. 8 also dictates that personal privacy
claims be measured as against the specific state conduct and
the purpose for that conduct. Section 8 is not about protecting
individual privacy at large or as between non-state
actors. Section 8 focuses on personal privacy claims in relation to
state intrusions said to infringe on that personal privacy: Gomboc,
at para. 34, Deschamps J., concurring. Because the focus is on
state intrusion and the purpose of the intrusion, Canadian
jurisprudence has emphatically rejected the “risk” analysis
featured in American Fourth Amendment jurisprudence.
Despite the centrality of personal privacy to the relationship
between the individual and the state under the Canadian
constitution, personal privacy, like any other individual right,
cannot be absolute in a democratic society. One’s right to be
left alone by the state must be balanced against other legitimate
competing societal interests, including the need to effectively
investigate crime: Hunter, at pp. 159-160; Tessling, at paras. 17-18.
Footer Text
7/17/2015
11
The Modern
Electronic Device
Joseph Di Luca, Di Luca Barristers
7/17/2015
12
Reasonable Expectation of Privacy
It is difficult to imagine a search more intrusive, extensive, or invasive of
one's privacy than the search and seizure of a personal computer.
First, police officers enter your home, take possession of your
computer, and carry it off for examination in a place unknown and
inaccessible to you. There, without supervision or constraint, they scour
the entire contents of your hard drive: your emails sent and received;
accompanying attachments; your personal notes and
correspondence; your meetings and appointments; your medical and
financial records; and all other saved documents that you have
downloaded, copied, scanned, or created. The police scrutinize as
well the electronic roadmap of your cybernetic peregrinations, where
you have been and what you appear to have seen on the Internet -generally by design, but sometimes by accident.
- R. v. Morelli, [2010] 1 S.C.R. 253
Joseph Di Luca, Di Luca Barristers
7/17/2015
13
Reasonable Expectation of Privacy
R. v. Polius, [2009] O.J. No. 3074 (S.C.J.):
The information in a cell phone, computer or other electronic
device may relate to aspects of life that are deeply personal. It
may include:
* Contacts, including names, addresses, phone numbers, e-mail
addresses and other personal information;
* Internet Explorer, including the history of accessing websites;
* Calendars;
* Photographs and videos;
* Text Messages;
* Voice Mail Messages;
* E-mail Messages;
* Missed Calls;
* Call Logs; and
* Call Identification.
Joseph Di Luca, Di Luca Barristers
7/17/2015
14
REP – Factors
Capabilities of Device
• R. v. Liew, 2012 ONSC 1826 at para. 113: “Cell phones and
other similar handheld communication devices in common
use have the capacity to store vast amounts of highly sensitive
personal, private and confidential information." The evidence
on the voir dire was not as fulsome as it might have been in
terms of the actual contents of [the]phone. That said, [the
officer] did testify that he spent a full day reviewing the
contents of the phone. That admission, together with the
evidence of the call history and text messages contained in
the phone, satisfies me that the phone indeed contained
significant amounts of the sensitive, personal, private and
confidential information.
Joseph Di Luca, Di Luca Barristers
7/17/2015
15
REP – Factors
Capabilities of Device
•
Is a smartphone just a fancy briefcase?
R. v. Giles, 2007, BCSC 1147 at para. 63
While I accept that this particular BlackBerry’s password protection and
the double encryption characteristic mean that there is an objectively
reasonable expectation of privacy in the information contained in the
BlackBerry, it is not different in nature from what might be disclosed by
searching a notebook, a briefcase or a purse found in the same
circumstances. The capacity of this BlackBerry to potentially store
volumes of information does not, in my view, change the character of
the search from being lawful as incident to the arrest, into a search that
required a warrant. Volume of information is not as relevant as the
nature of the information, and in other situations, items seized incidental
to arrest are subject to the same degree of privacy interest.
Joseph Di Luca, Di Luca Barristers
7/17/2015
16
REP – Factors
Capabilities of Device
• Is a smartphone just a fancy briefcase?
R. v. Little,[2009] O.J. No. 3278 (S.C.J.)
… to suggest that once the police had lawful possession of the
Treo they could examine its entire contents without obtaining a
warrant authorizing its search is to ignore the nature of the item.
It was not simply a cellular telephone, but rather a personal
electronic storage device. It was capable of storing data such
as call logs, text messages, photographs and movies, any or all of
which could include highly personal information. Its contents
were not immediately visible to the eye, but had to be extracted
by a police officer with specialized skills using specialized
equipment. In this way, it was different from a notebook,
briefcase or purse.
Joseph Di Luca, Di Luca Barristers
7/17/2015
17
REP – Factors
Passwords
•
R. v. Fearon, 2013 ONCA 106: Ontario Court of Appeal confirmed
that police, in that case, were entitled to conduct a search of a
cell phone incident to arrest.
•
“There was no suggestion in this case that this particular cell
phone functioned as a “mini-computer” nor that its contents
were not “immediately visible to the eye”. Rather, because the
phone was not password protected, the photos and the text
message were readily available to other users.”
•
If the cell phone had been password protected or otherwise
“locked” to users other than the appellant, it would not have
been appropriate to take steps to open the cell phone and
examine its contents without first obtaining a search warrant.
Joseph Di Luca, Di Luca Barristers
7/17/2015
18
REP – Factors
Location of Use
• Lower expectation of privacy in a laptop computer
found in a hotel room than in one found in an
accused’s residence: R. v. Dragos (2009), 200 C.R.R.
(2d) 227 at para. 17 (Ont. S.C.J.)
Joseph Di Luca, Di Luca Barristers
7/17/2015
19
REP – Factors
Undergoing Repair
• Expectation of privacy in the contents of a personal
computer is “significantly reduced” in the
circumstances where the computer’s owner brings
it to a store for repair. R. v. Winchester, (2010) 73
C.R. (6th) 371 at para. 36 (Ont. S.C.J.)
Joseph Di Luca, Di Luca Barristers
7/17/2015
20
REP – Factors
Usage – File Sharing
• R. v. Bahr, [2008] A.W.L.D. 2443
• United States v. Ganoe, 538 F.3d 1117 (9th Cir. 2008):
“although as a general matter an individual has an
objectively reasonable expectation of privacy in his
personal computer…we fail to see how this
expectation can survive Ganoe’s decision to install
and use file-sharing software, thereby opening his
computer to anyone one else with the same freely
available program.”
Joseph Di Luca, Di Luca Barristers
7/17/2015
21
REP – Factors
Workplace Computers
R. v. Cole, [2012] 3 S.C.R. 34
The Court left no doubt in R. v. Morelli,, [2010] 1 S.C.R. 253, that
Canadians may reasonably expect privacy in the information contained
on their own personal computers. In my view, the same applies to
information on work computers, at least where personal use is permitted
or reasonably expected.
Computers that are reasonably used for personal purposes — whether
found in the workplace or the home — contain information that is
meaningful, intimate, and touching on the user’s biographical core. Visà-vis the state, everyone in Canada is constitutionally entitled to expect
privacy in personal information of this kind.
While workplace policies and practices may diminish an individual’s
expectation of privacy in a work computer, these sorts of operational
realities do not in themselves remove the expectation entirely: The
nature of the information at stake exposes the likes, interests, thoughts,
activities, ideas, and searches for information of the individual user.
Joseph Di Luca, Di Luca Barristers
7/17/2015
22
REP – Factors
Workplace Computers
R. v. Cole – Factors to Consider:
• Ownership of data
• Policies (not determinative)
• “operational realities”: guidelines, practices
and customs of the workplace
• Nature of the information (here it was
“organically connected to the biographical
core”, para 58)
Joseph Di Luca, Di Luca Barristers
7/17/2015
23
REP – Factors
Workplace Computers
R. v. Cole
The school board was, of course, legally entitled to inform the police of its
discovery of contraband on the laptop. This would doubtless have
permitted the police to obtain a warrant to search the computer for the
contraband. But receipt of the computer from the school board did not
afford the police warrantless access to the personal information
contained within it. This information remained subject, at all relevant
times, to Mr. Cole's reasonable and subsisting expectation of privacy.
So……..
S. 8 breach BUT law unsettled, officer had good faith intention
to consider Charter rights and Cole had an existing but
DIMINISHED REP, so evidence admitted under 24(2)
Joseph Di Luca, Di Luca Barristers
7/17/2015
24
Customer Name and Address
• Reasonable expectation of privacy in IP addresses
and customer name and address information?
• Relevant factors:
o Nature of the information
o Terms of the contract: service agreements,
acceptable use agreements, privacy policies
o Privacy legislation
o Police conduct
Joseph Di Luca, Di Luca Barristers
7/17/2015
25
Customer Name and Address
R. v. Ward, 2012 ONCA 660
• REP to be determined on totality of circumstances, which
includes “technical, investigative, legislative and contractual
components” (para 17)
• Court concludes that no REP in subscriber information BUT
fact-specific assessment:
o Context significant (nature of the offence) in considering ISP response
o Contract is “of critical importance” but not determinative
o Consider technology – EVIDENCE about what you actually get, what it can tell
you, what it can’t tell you
o Consider subject matter – what exactly do police want and what will it tell
them, alone and in combination with other known information - name and
address had “the potential to open doors into very private aspects of the
appellant’s lifestyle” (paras 89, 93)
o Police conduct is considered in terms of its effect on REP (request very focused,
info used in warrant application)
Joseph Di Luca, Di Luca Barristers
7/17/2015
26
Customer Name and Address
R. v. Ward, 2012 ONCA 660
I stress that the conclusion in this case is based on the specific
circumstances revealed by this record and is not intended to
suggest that disclosure of customer information by an ISP can never
infringe the customer’s reasonable expectation of privacy. If, for
example, the ISP disclosed more detailed information, or made the
disclosure in relation to an investigation of an offence in which the
service was not directly implicated, the reasonable expectation of
privacy analysis might yield a different result. Similarly, if there was
evidence that the police, armed with the subscriber’s name and
address, could actually form a detailed picture of the subscriber’s
Internet usage, a court might well find that the subscriber had a
reasonable expectation of privacy. Those cases will be considered
using the totality of the circumstances analysis when and if they
arise. (para. 109)
Joseph Di Luca, Di Luca Barristers
7/17/2015
27
Litigation Tips
• Building an Evidentiary Record in relation to the
Normative Standards
o http://www.ipc.on.ca/english/Resources/Discussion-Papers/
o http://www.priv.gc.ca/information/pub/op_index_e.asp
• Expert Evidence on the Capabilities of the
Technology
• Properly Characterizing the Nature of the
Information
• Arguing around Contracts
Joseph Di Luca, Di Luca Barristers
7/17/2015
28
7/17/2015
29