Gone are the days when hard boiled detectives sat at their desks in smokey offices banging out reports on a Remington typewriter immortalized in film noir. In the digital world law enforcement now regularly hoovers personal information from smartphones, computers and social media. Data bases maintained by government and private corporations contain troves of personal data often exploited for the asking. It has been estimated that eighty-five per cent of police investigations now involve some form of digital evidence. (here) What, then, are the privacy implications when the police seize personally identifiable information from a government data base without a warrant?

1. Introduction

There are two kinds of warrantless seizures of personal information that frequently crop up, particularly in drug investigations, that I will comment on in this post: (a) information collected by the government of Alberta for the purpose of regulating the issuance of drivers’ licences and retained in the Motor Vehicle System data base; and, (b) information harvested by bars and night clubs under the “Bar Watch” program authorized in Alberta by s. 69.1 of the Gaming, Liquor and Cannabis Act. (here) The former involves the surrender of personal information and a photograph that appears on all drivers’ licences. The latter involves the scanning of drivers’ licences by bars and night clubs, and the retention of that data by private corporations contracted with government.

2. The Constitutional Paradigm

The reasonable expectation of privacy is the “dominant organizing principle” of s. 8 of the Charter of Rights and Freedoms which guarantees the right to be secure against unreasonable search or seizure. That is how Justice Ian Binnie described it in R. v. Tessling, writing on behalf of a unanimous Supreme Court of Canada. The purposive approach to the construction of s. 8, first stated by the same court in Hunter v. Southam, [1984] 2 S.C.R. 145 requires consideration of two things: (1) the existence of a subjective expectation of privacy; and, (2) the objective reasonableness of the expectation. Following the unanimous opinion of Justice Brian Dickson in Hunter, subsequent case law has recognized three categories of privacy interests that receive constitutional protection: (a) personal privacy; (b) territorial privacy; and, (c) information privacy.

Privacy of the person has the strongest claim to constitutional protection because it protects bodily integrity. The police cannot conduct warrantless strip searches except in narrowly defined circumstances incidental to a lawful arrest. Nor may agents of the state extract bodily substances without a warrant. In cases of territorial privacy, Canadian constitutional law recognizes a high expectation of privacy in personal residences and the perimeter space around the home. The home is the place “where our most intimate and private activities are most likely to take place”. (See: R. v. Silveira, [1995] 2 S.C.R. 297) Information privacy was defined by Professor Alan Westin, in his classic text Privacy and Freedom (1967), at p. 7, as “the claim of individuals, groups or institutions to determine for themselves when, how, and to what extent information about them is communicated to others.” Personal information such as documents and photographs fall within “the biographical core of personal information” about a person that is, in a fundamental way, for the individual to retain or communicate as he or she sees fit. (See: R. v. Plant, [1993] 3 S.C.R. 28)

3. Reasonable Expectation of Privacy

The seizure of personal information by law enforcement often requires a more nuanced analysis than the physical search of an apartment, an office or the trunk of a car. The seizure of digital information siloed in a government data bank raises issues affecting the right of the individual to determine to whom, and for what purpose, their personal information is communicated to others. In R. v. Spencer, [2014] 2 S.C.R. 212 Justice Thomas Cromwell emphasized, at para. 31, that the subject matter of a search must not be defined “narrowly in terms of the physical acts involved or the physical space invaded, but rather by reference to the nature of the privacy interests potentially compromised by the state action.”

However, before Spencer, the Tessling court had recognized, at para. 23, that privacy includes a “wider notion of control over, access to and use of  information” that is the claim of individuals “to determine for themselves when, how and to what extent information about them is communicated to others.” In Spencer, the Supreme Court of Canada unanimously affirmed the point made in R. v. Dyment, [1988] 2 S.C.R. 417 at pp. 429-30 that, although information may be communicated and cannot be characterized as secret or confidential, “situations abound where the reasonable expectations of the individual that the information shall remain confidential to the persons to whom, and restricted to the purposes for which it is divulged, must be protected.” This “wider notion of control” may be described as the restricted purpose doctrine that I discussed in previous posts to On The Wire. (here and here) Thus, in R. v. Marakah, a four-member majority of the Supreme Court of Canada held, at para. 15, that “[t]he subject matter of a search must be defined functionally, not in terms of physical acts, physical space, or modalities of transmission.”

Control, or lack of control, is not determinative of a reasonable expectation of privacy. As stated by Chief Justice Beverley McLachlin in Marakah, at para. 44, control “is not dispositive, but only one factor to be considered in the totality of circumstances.” Control over a physical object or place is not the only “indicator of effective control” and “control may arise from the choice of medium and the designated recipient.” Control does not, therefore, mean exclusive control. On numerous occasions the Supreme Court of Canada has recognized a reasonable expectation of privacy in places and things that were not exclusively under the claimant’s control.

In R. v. Buhay, [2003] 1 S.C.R. 631 a reasonable expectation of privacy was retained in a bus depot locker although the company owned the lockers and could access them at any time. In R. v. Cole, [2012] 3 S.C.R. 34 an employee retained a reasonable expectation of privacy in data he stored on a work computer although policy and technological reality deprived him of exclusive control. And, in R. v. Reeves, [2018] 3 S.C.R. 531 the consent of a spouse to the seizure of a shared computer from the family home by the police did not nullify the defendant’s reasonable expectation of privacy. As stated by Justice Andromache Karakatsanis in Reeves, at para. 41, “[t]he question is not which risks the claimant has taken, but which risks should be imposed on him in a free and democratic society.”

The Marakah court also reiterated the well-established test for s. 8 protection that was reaffirmed by a three-member majority in R. v. Mills, at para. 12. A claimant must show “a reasonable expectation of privacy in the subject matter of the search […] and that this expectation was objectively reasonable.” Objective reasonableness is assessed on the basis of the “totality of the circumstances” that requires “an evaluation of all aspects of privacy” guided by four lines of inquiry: (1) an examination of the subject matter of the search; (2) a determination as to whether the claimant had a direct interest in the subject matter; (3) an inquiry into whether the claimant had a subjective expectation of privacy in the subject matter; and, (4) an assessment as to whether the subjective expectation of privacy was objectively reasonable, having regard to the totality of the circumstances.

Most Canadians assert a subjective expectation of privacy in personal information such as electronic documents, emails, text messages and photographic images regardless of whether they maintain exclusive control over their digital data. This direct interest flows from the characterization of personal digital data as core biographical information that is the right of the individual to communicate or retain as he or she determines. But life in the twenty-first century often compels the citizen to relinquish personal information in order to access government services or gain admission to premises owned or regulated by government. The litigation, then, frequently turns on whether the subjective expectation of privacy is objectively reasonable.

4. Recent Developments

The courts of British Columbia have been at the forefront of recent developments in the application of the restricted purpose doctrine and the applicability of provincial privacy legislation. In R. v. Roudiani and R. v. Flintroy two different judges of the British Columbia Supreme Court concluded that the communication of personally identifying information for the purpose of gaining entrance to a bar or night club, and for the purpose of obtaining a passport, were not determinative of claims to constitutional protection. The communication of the information for those restricted purposes did not constitute a waiver of privacy interests for all purposes, including purposes associated with law enforcement.

In Roudiani, Justice Nathan Smith considered the provisions of the British Columbia Personal Information Protection Act, SBC 2003, c. 63, s. 6 (PIPA) that prohibit the disclosure of personal information by an organization without the consent of the individual. The statutory exemptions include “the disclosure to […] a law enforcement agency […] to assist in an investigation”. It was held that the statutory exemption was not dispositive of s. 8 privacy interests where Justice Smith stated, at para. 44, that legislation authorizing the holder of information to release it to the police “is not directly relevant to the question of whether the police, in obtaining that information, have conducted a search within the meaning of s. 8 of the Charter.” The statutory exemption, “is simply one consideration in determining whether there was a reasonable expectation of privacy.”

The rule in Roudiani may be put this way. The permissive provisions of PIPA do not neutralize a reasonable expectation of privacy in personal information provided to the police by a third party record holder. The same rule ought to be applied in construing similar provisions in the Alberta Personal Information Protection Act, SA 2003, c. P-6.5, ss. 1(1) and 20(f). (here) Although disclosure by a recipient of personal information to “a law enforcement agency in Canada to assist in an investigation” is protected under s. 20(f) of the Alberta statute, it is nonetheless reasonable for the individual to expect that his or her data will be retained for the restricted purpose for which it was communicated and thus siloed in the applicable government data base. The distinction is between disclosure of personal information by a third party record holder and the warrantless seizure of that information by the police. The individual’s subjective expectation of privacy is therefore objectively reasonable.

5. Conclusion

The means by which law enforcement obtains information about drivers’ licences is straight forward. An investigator just asks for it. As I mentioned, the information is retained in the Motor Vehicle System data base administered by the Government of Alberta. The acronym is MOVES. A police officer will submit a request by email to the Real Time Operation Centre and will usually receive a reply the same day. The request may include a cryptic comment, for example, that the information is required “in relation to a drug investigation”. A generic response will contain the photographic image of the licence holder and other data such as the motor vehicle identification number, the MOVES date of issue and the date of image capture. The information may then be used for investigative purposes by including the image in a target book for dissemination to street surveillance teams. This kind of warrantless seizure of personally identifying information is past its best-before date – as well as seizures from Alberta’s Bar Watch data base that is accessible with similar ease. Constitutional challenges are overdue.