R. v. Bykovets, 2024 SCC 6 – Summary of Case

On March 1, 2024, the Supreme Court of Canada rendered its decision in R v. Bykovets, 2024 SCC 6. 

A narrow majority consisting of five judges (Karakatsanis, Martin, Kasirer, Jamal, and Moreau JJ.) found that internet protocol (“IP”) addresses attract a reasonable expectation of privacy. A strong dissent consisting of four judges (Wagner C.J. and Côté, Rowe, and O’Bonsawin JJ.) would have held IP addresses do not attract a reasonable expectation of privacy. 

As a direct consequence of the majority’s holding, Charter s. 8 constitutional protections against unreasonable search and seizure are applicable to police requests to third party private corporations for IP addresses. 

The appellant Andrei Bykovets was convicted for fraudulent transactions involving the use of unauthorized credit card data. During police investigations, requests were made to Moneris to provide IP addresses used for certain transactions. Moneris is a third-party payment processing company. Police then obtained an order compelling the internet service provider (the “ISP”) to disclose the name and address of the customer associated with the IP address provided. 

The trial judge found the subject matter of the police’s request to Moneris was IP addresses to further investigations. The trial court’s understanding was that IP addresses consist of a collection of numbers. This by itself does not disclose personal details. Given this chain of reasoning, the police request does not fall under “search” as used in s. 8 of the Charter. The trial judge held Mr. Bykovets could not have a reasonable expectation of privacy in a collection of numbers.

The trial decision was upheld on appeal. However, Veldhuis J.A. wrote a strong dissent against the majority’s holding. Her opinion was that the majority’s characterization of the subject matter of the search was too narrow. She reasoned the true subject matter of the search was the identity of the internet user which corresponds to a particular IP address. She noted that IP addresses are linked to monitored internet activity that could disclose core biographical information of the user. Veldhuis J.A. would have overturned the trial judge’s decision, opining that an individual would have a reasonable expectation of privacy given the subject matter of the search involves identity.  

In the decision of the Supreme Court of Canada, the narrow majority largely followed the reasons offered by Veldhuis J.A. in her dissent. The majority agreed that characterizing the subject matter of the search as a collection of numbers is artificially narrow. The analysis should come from a broad and functional approach to the subject matter of the search. The function of obtaining the IP addresses is for police to obtain information about a particular internet user. Therefore, privacy interests are engaged. 

After determining privacy interests are engaged, the majority then moved on to determine whether a subjective expectation of privacy would be reasonable in this instance. Factors for determining whether an expectation of privacy would be reasonable include the degree of control over the subject matter, the place of search, and the private nature of the subject matter. The court noted the first two factors are largely non-determinative. Internet users do not have meaningful choice in the informational privacy context – provision of user information is the pre-requisite to participating in online activity. Furthermore, they found the lack of a physical place of search does not assist in the analysis. 

In examining the private nature of the subject matter, the majority noted a normative approach to the analysis is demanded by s. 8 of the Charter. This requires the court to enquire into what information the subject matter of the search will reveal. In its enquiry, the majority held that the information provided by IP addresses will reveal biographical data. The majority also voiced concerns that a request of this nature by law enforcement to third parties circumvents the protections of the Charter s. 8. This is because private third-party corporations are not subject to the Charter. The decision is intended to remove the choice of disclosure from private corporations to the state back to the purview of the court and within constitutional protections. 

The minority would have held the claimant did not have a reasonable expectation of privacy in his IP address. Using the same functional approach the minority found the subject matter to be the IP address and the ISP revealed by them. 

The minority also noted that IP addresses are not private and do not by themselves reveal private information. The correct characterization of place of search is the database of Moneris where the IP address was stored, where no reasonable expectation of privacy attached. Furthermore, the minority took issue with the majority’s holding, stating the majority’s analysis means any step taken in a state investigation engages a reasonable expectation of privacy. The concern was that this holding will hinder law enforcement’s ability to conduct investigations.