Landmark pro-privacy ruling sets important precedent for cell phone privacy in Canada

Police request for “tower dump” of user data from Rogers and Telus ruled a violation of privacy rights

January 14, 2016– In a landmark decision, an Ontario Superior Court judge has ruled that police were in breach of the Charter of Rights and Freedoms when they asked Rogers and Telus to hand over the personal information—including deeply-revealing metadata—of over 40,000 customers in a “tower dump” of user data.

In today’s ruling, Justice John Sproat recognized the reasonable expectation of privacy in cell phone communications – a critical victory for Canadians’ privacy rights. This decision reinforces concerns of the rights violations contained within Bill C-51, which greatly expand the ability of authorities to access Canadians’ private information without a warrant, and raises questions about the constitutionality of StingRay surveillance technologies, which mimic cell towers to produce similar results as tower dumps.

“This is a critical ruling that will help safeguard the privacy rights of countless Canadians,” said Laura Tribe, OpenMedia’s Digital Rights Specialist. “These tower dumps reveal that authorities are really pushing the limits when it comes to warrantless access to our private information. Our cell phone data says a lot about us – and this is an important step to ensuring that authorities are forced to demonstrate just cause for these kinds of requests.”

In today’s ruling, Justice Sproat recognized the vulnerability of personal data and the perils of sharing information in large quantities without justification: “It is not tenable to reason that since only the police will be in possession of this information any sensitive information will never see the light of day. One needs only read a daily newspaper to be aware of the fact that governments and large corporations, presumably with state of the art computer systems, are frequently “hacked” resulting in confidential information being stolen and sometimes posted on-line.”

When deciding to hear the case, Justice Sproat warned that “hundreds of thousands, if not millions” of Canadians were likely to be affected by similar requests each year. The guidelines laid out today will ensure that police can only access basic information about specific targets, rather than bulk collecting the personal information of thousands of innocent Canadians.

Today’s ruling reinforces the historic June 2014 Supreme Court R. v. Spencer ruling that required police to obtain a search warrant before obtaining private customer data from telecom companies, further demonstrating the value of metadata and the importance of protecting individuals’ data privacy.