Court sets high bar for police demanding indiscriminate records
A recent Ontario Superior Court decision may obligate companies to mount constitutional challenges to production orders that intrude on customers’ privacy.
“R. v. Rogers tells companies like telcos, banks and others that they must review production orders carefully and challenge them if they raise significant constitutional issues,” says Scott Hutchison of Henein Hutchison LLP in Toronto, who was lead counsel on the application by Rogers and Telus to quash certain production orders.
In his decision, Justice John Sproat of the Ontario Superior Court ruled that the “tower dump” orders issued by justices of the peace at the request of Peel Regional Police were too broad and amounted to unreasonable seizures under the Charter of Rights and Freedoms.
The orders would have required Telus to disclose the personal information of at least 9,000 individuals and conduct separate searches for telephone calls and text messages. Rogers estimated that it would be have to conduct 378 separate searches and retrieve approximately 200,000 records related to 34,000 subscribers.
“Tower dumps are, in a nutshell, the production of all the records of a cell phone tower at a particular time,” says David Fraser of McInnes Cooper in Halifax. “Rogers and Telus went to court because they didn’t want to incur the expense involved.”
Sproat reasoned that Canadians have a clear privacy interest in all their cellular telephone activity records. “As discussed, each subscriber has a reasonable expectation of privacy in the information sought by the [police],” Sproat added.
But he also opined that telcos have a “contractual obligation” to keep subscriber information confidential. “Each subscriber has contracted with Rogers and Telus for an assurance that subscribers’ personal information will, within certain limits, be kept confidential,” Sproat wrote.
The upshot is that telecom companies and others are not only entitled to stand up for their customers’ privacy rights in that information but may also be contractually obligated to do so. “The decision deputizes telcos and possibly others like Internet companies as the guardians of personal privacy,” Fraser says.
The precise reach of the obligation to protect customers’ privacy, however, is not clear. “Justice Sproat didn’t identify any specific contractual provision as the source of this obligation,” says Catherine Beagan Flood in the Toronto office of Blake, Cassels & Graydon LLP.
What also remains to be seen is the extent to which companies will be able to rely on the law’s benign view of judicially issued directives. “There is a presumption of legality that applies to these types of orders,” Hutchison points out.
At the very least, however, it appears that companies receiving production orders will be forced to make some judgment about the orders’ legality. As courts have acknowledged, moreover, determining whether there is a reasonable expectation of privacy is a complex endeavour. Part of the difficulty is that companies receiving production orders rarely have any insight into the information on which the order is based. “So it’s going to be an incredibly difficult task for companies to analyze what the police are doing and second-guess whether an order issued by a JP or a judge is one that meets constitutional requirements,” Beagan Flood says.
To be sure, Sproat’s ruling, which puts the spotlight on tower dumps and provide guidelines for police and justices of the peace, should serve to limit the scope of such orders. “The starting point is that if the police and the issuing justice focus on the statutory requirements and the principle of minimal intrusion, the resultant production order will be no more extensive or onerous than is reasonably necessary in order to investigate the crime in question,” Sproat wrote.
The guidance issued by Sproat requires police seeking production orders to proffer case-specific information; keep their requests as narrow as possible; consider obtaining a summary of the information sought instead of the underlying data; explain why the places and time sought are relevant; provide details that might help companies narrow their search; and confirm that the data request could be meaningfully reviewed.
However that may be, Rogers is a judgment that any Canadian business holding personal information should take note of. “The case applies to anyone, such as financial institutions and Internet companies, who receive a production order or search warrant that requests private personal data,” Beagan Flood says.