Sproat J. of the Superior Court of Justice has issued a very important decision for organizations that find themselves subject to a search warrant or production order seeking personal information in their records about third parties.
Overview
On January 14th, 2016, in R. v. Rogers Communications, Sproat J. of the Superior Court of Justice issued a very important decision for organizations that find themselves subject to a search warrant or production order seeking personal information in their records about third parties. The Court found that an organization in this situation has standing — and potentially a duty — to challenge the order if it constitutes an undue interference with the privacy interests of the third parties. The decision underscores the importance of obtaining legal advice before responding to such a request, to assist in determining whether the order should be challenged. The decision is particularly important for financial institutions, health care institutions and telecommunications companies who are routinely subject to orders compelling production of personal information regarding customers, patients and subscribers, respectively.
Case Summary
Rogers and Telus were subject to a "tower dump" production order. Mobile phones access cellular networks via antennas mounted on towers, typically by accessing the closest tower. Each tower serves a geographical area ranging from a 10-25 km radius around the tower in rural areas to 2 km around the tower in urban areas. A record is created whenever a telephone attempts or completes a phone call, text message or email, which among other information, identifies the particular tower through which the phone connected to the network.
In the context of an investigation into jewelry store robberies, the Peel Regional Police served Rogers and Telus with production orders requiring cell phone records for all phones activated, transmitting or receiving data through certain specified towers (presumably over a defined period of time). The orders required the name and address of every subscriber making or attempting a communication through a specified tower, as well as billing information, which may include bank or credit card information. Telus estimated that it would be required to disclose the personal information of 9,000 subscribers. Rogers estimated that it would be required to conduct 378 different searches and retrieve approximately 200,000 records relating to 34,000 subscribers. The orders did not specify any means by which the Police would safeguard the information, nor did they restrict the purposes for which the Police could use the information.
Rogers and Telus challenged the production orders as overbroad, and thus a breach of their subscribers' reasonable expectation of privacy, guaranteed under section 8 of the Charter of Rights and Freedoms. Specifically, section 8 requires that the state's law enforcement activities be minimally intrusive upon the privacy interests of individual citizens, and Rogers and Telus argued that the disclosure of personal information that the production orders required went well beyond what was reasonably necessary to investigate the crimes that had been committed.
Significantly, Sproat J. found that Rogers and Telus have standing to assert the privacy interests of their subscribers. Furthermore, he found that they had a contractual obligation to do so, in view of their promise to keep subscribers' personal information confidential in their subscriber agreements. Also, as a practical matter, Sproat J. found that individual subscribers would be unlikely to bring such claims forward. Having found that Rogers and Telus had standing, Sproat J. went on to find that the production orders were overbroad in violation of section 8. In addition, the Court issued a series of guidelines for police seeking "tower dump" production orders in the future, and for issuing justices reviewing these applications.
