The Supreme Court of Canada has ruled that the country's Internet service providers can't give out customer names and addresses to police unless they are handed a search warrant. Here's a look at what this case means.

What changes with this decision?

For several years now, if police wanted to know who was behind an IP address (Internet Protocol) engaged in suspicious activity, they went to the Internet service providers behind the address. Police would make a written request and then it was up to the ISPs to grant or deny the request.  To actually search a suspect's computer, police still needed a search warrant.

Friday's ruling means police will now also need a search warrant to get subscriber information from Internet service providers. The court decided that customers have a reasonable expectation of privacy that their information will be kept private and that in cases where police believe the public's interest supersedes that privacy right, they will need a warrant.

How often do police ask Internet service providers for info on their customers?

According to information that University of Ottawa law professor Michael Geist has gathered, police made close to 1.2 million requests for customer name and address information in 2011, most without a court order.

Many of the requests were simply to confirm a customer's name and address, not to obtain them. But the reasons behind the requests are not clear, nor is it clear how many subscriber info requests are granted and why. As civil libertarians point out, there is no compulsion for companies and police to disclose how customer data is shared.

Is today's decision a win for Internet criminals?

No, says Halifax-based Internet privacy lawyer David Fraser.

Fraser says the case before the court involved a person police believed was trading child pornography. Police would have had more than enough information to go to a judge and get a production order and get the man's subscriber information.

One's right to privacy or anonymity is not absolute, Fraser notes and if a judge or justice of the peace recognizes that the public interest in investigating serious crimes outweighs privacy interests, an order to reveal IP information can be granted lawfully.

What other implications will this ruling have?

The decision could affect two federal government bills before the House of Commons:

  • Bill C-13, which is intended to crack down on cyberbullying, but includes provisions that give police easier access to the metadata that ISPs keep on email sent by their customers. Geist has said the bill would alsoinclude an immunity provision for companies that store personal information or that disclose it without a warrant. Ontario's Information and Privacy Commissioner Ann Cavoukian said ideally the bill would be split to deal with cyberbullying and access to information laws separately.
  • Bill S-4, the digital privacy act, which would reform PIPEDA, the Personal Information Protection and Electronic Documents Act, which governs how the private sector handles private information. Geist and others worry the bill would expand police ability to obtain subscriber information without a warrant. 

Cavoukian said the Supreme Court decision also sets the stage for a larger debate around public safety and online privacy and how to best have both interests represented.