In an important privacy ruling Justice John R. Sproat of the Ontario Superior Court of Justice recently held that “tower dump” production orders requiring Rogers Communications and Telus Communications to hand over the personal information of about 43,000 customers to the police breached s. 8 of the Charter of Rights. Here’s the story.

On April 11, 2014, the Peel Regional Police in Ontario obtained production orders under s. 487.012 of the Criminal Code [now s. 487.014] from a justice of the peace during an investigation into a string of jewelry store heists. In the ruling reported as R v Rogers Communications, 2016 ONSC 70 Justice Sproat described some of the personal information to be seized, at para. 42:

• information relating not only to the cell phone subscriber proximate to the crime scene but also the personal information and location of the other party to the call who may have been hundreds or thousands of miles removed from the crime scene;
• bank and credit card information which, if it had any relevance at all in locating an individual, could have been sought in a follow-up application for a small number of actual suspects; and,
• personal information pertaining to over 40,000 subscribers when all the police were really interested in was information, which could have been provided in a report, listing the few individuals, if any, utilizing a cell phone proximate to more than one robbery location.

In a previous ruling reported as R v Rogers Communications, 2014 ONSC 3853 Justice Sproat decided that Rogers and Telus were entitled to proceed with the application even though the orders that were initially challenged were revoked. The challenge to the original production orders became moot because the police decided to seek a narrower order so that the investigation would not be delayed. The state therefore argued that there was no search and seizure, Charter s. 8 was not engaged and a remedy was not available under s. 24(1). The applications, however, also sought a declaration that the orders were unreasonable and inconsistent with s. 8. Justice Sproat concluded, at para. 34, that the unavailability of a s. 24(1) remedy was not an impediment to granting a declaratory judgment.

Relying on the landmark decisions of the Supreme Court of Canada in Hunter v Southam, [1984] 2 SCR 145 and R v Vu, [2013] 3 SCR 657 Justice Sproat concluded that the production orders were overly broad and thus in breach of the principle that a search and seizure, to be constitutional, must be no more intrusive than is reasonably necessary to achieve its objectives.

What is particularly concerning in this case is, not only that the police applied for such blatantly unconstitutional orders, but that a judicial officer granted them. In a post to Canadian Privacy Law Blog titled Tower dump case raises troubling questions about law enforcement and privacy dated January 18, 2016, Halifax lawyer David Fraser argued, at p. 2, that the police, “…can’t go for everything they can get and then hide behind the judge’s signature.” It is an important point. But whether we agree with it or not, the police are always pushing the legal limits of their investigative techniques. That is why judicial authority acts as the gatekeeper.

Justice Sproat noted, at paras. 13-15, that Detective Douglas Cole of the York Regional Police Service, who was cross-examined on an affidavit, testified that his practice is to limit the information sought in an initial production order to ensure that the amount of data is “manageable and can be meaningfully reviewed”. Let’s stop here and consider that testimony.

Det. Cole said that the concern of the police in getting a tower dump is the manageability and meaningfulness of the information. That is a resource and manpower concern. Police resources are not limitless and data has to be managed by investigators and capable of being meaningfully reviewed. That was the concern of the police here – not whether the seizure was constitutional in the first place. On that point – the constitutionality of the seizure – the justice of the peace was asleep at the switch. Justice Sproat described the privacy interest of all Canadians this way, at paras. 19-21:

“Common sense indicates that Canadians have a reasonable expectation of privacy in the records of their cellular telephone activity. Whether and when someone chooses to contact a divorce lawyer, a suicide prevention hot line, a business competitor or a rehabilitation clinic obviously implicates privacy concerns. The location of a person at a particular time also raises privacy concerns. Was the person at the Blue Jays game instead of at work?

Admittedly this type of information is in the vast majority of cases innocuous. It remains that in a number of cases it will be quite sensitive. It is also not tenable to reason that since only the police will be in possession of this information any sensitive information will never see the light of day. One needs only read a daily newspaper to be aware of the fact that governments and large corporations, presumably with state of the art computer systems, are frequently ‘hacked’ resulting in confidential information being stolen and sometimes posted on-line.

I appreciate that cell phone data is not right up there with Wikileaks and Ashley Madison in terms of information likely to be hacked and published. It remains that it is information Canadians certainly regard as private. The law supports this conclusion.”

Scott Hutchinson, counsel for Rogers and Telus, argued that the court should take the opportunity to provide the police and issuing justices with guidance on the parameters for confining these types of expansive seizures. Justice Sproat thus went on, at paras. 63-5, to set out guidelines for what should be contained in applications for production orders as there is “an obligation on the part of the police and the issuing justices to know the law”. Here they are:

1. a statement or explanation that demonstrates that the officer seeking the production order is aware of the principles of incrementalism and minimal intrusion and has tailored the requested order with that in mind;
2. an explanation as to why all of the named locations or cell towers, and all of the requested dates and time parameters, are relevant to the investigation;
3. an explanation as to why all of the types of records sought are relevant;
4. any other details or parameters which might permit the target of the production order to conduct a narrower search and produce fewer records;
5. a request for a report based on specified data instead of a request for the underlying data itself;
6. if there is a request for the underlying data there should be a justification for that request; and,
7. confirmation that the types and amounts of data that are requested can be meaningfully reviewed.

Mr. Hutchinson also argued that tower dump production orders must address the retention, use and disclosure of data seized by the police. However, Justice Sproat concluded that although Canadian law makers have been active in privacy legislation, there is no legislation addressing the retention of tower dump records or other more intrusive collections of personal information such as wiretap evidence. He therefore declined, at para. 60, to say anything about post-seizure safeguards based on the record before the court.

It appears that Justice Sproat overlooked s. 487.019(1) of the Code which specifically provides that a production order “may contain any conditions” that the issuing judge considers appropriate. This sub-section uses similar wording as the predecessor s. 487.012(4) that employed the phrase “may contain any terms and conditions” which was in force when these orders issued. Both mirror, to some extent, s. 186(4)(d) which empowers a judge to include in a wiretap authorization “such terms and conditions as the judge considers advisable in the public interest”. By using the language “may contain any conditions” in s. 487.019(1), Parliament has conferred on judges who issue production orders a sufficiently broad discretion to incorporate terms that address the retention, use and disclosure of data seized by the police.

I have commented previously on this blog about the rights of innocent third parties that historically grew out of wiretap law – the rights of people who are not targets of police investigations but are trapped by the implementation of electronic surveillance. The vast amounts of personal information that are seized under production orders was highlighted, again in argument in this case, where Mr. Hutchinson stressed that 99.9% of the records seized in a tower dump will relate to innocent people who are not suspected of any crime.  There is a heightened need to protect their privacy interests.

Rogers estimated that, to comply with the production order, it would have been required to conduct 378 separate searches and retrieve approximately 200,000 records. Telus estimated that it would have to disclose the personal information of at least 9,000 people. There was no issue here that both providers have contractual obligations to keep subscriber information confidential. And, to make it worse, there was nothing in the orders about how customer information was to be safeguarded nor a restriction on how the police could use the information.

It is remarkable that a justice of the peace in Canada would grant these production orders with such apparent disregard for the constitutional requirement of proportionality that is a basic tenet of search and seizure law. After all, the Supreme Court of Canada did not decide Hunter yesterday.