R v Croft, 2013 ABQB 665

Court of Queen ’ s Bench of Alberta Citation: R v Croft, 2013 ABQB 665 Date : 20131113 Docket: 121085393Q1, 121085591Q1, 121086227Q1 Registry: Edmonton Between: Her Majesty the Queen - and - Docket 121085393Q1 Jason Clarke Croft Docket 121085591Q1 Jason Clarke Croft and Wassime Rahime Docket 121086227Q1 Jonathan Mark Rivera Aldaba, Jason Clarke Croft and Steven Daniel Whipple Accused _________________________________________________________ Reasons for Judgment of the Honourable Mr. Justice B.R.

Burrows Defence Application Regarding Subscriber Information and Challenge to PIPEDA, R.S.C. 2000, c. 5, s. 7 _______________________________________________________ [ 1 ] The four accused named in the three criminal proceedings referenced in the style of cause are charged, in various combinations, with a variety of mainly drug offences. I have been appointed pursuant to Criminal Code s. 551.1 as the case management

judge for these proceedings and pursuant to Criminal Code s. 551.7 to adjudicate pretrial motion issues arising in all three proceedings. [ 2 ] In this motion, the accused seek a declaration that individuals who subscribe for telephone service have a reasonable expectation of privacy in the “subscriber information” which the telephone service provider obtains from them at the commencement of their subscription. [ 3 ] In the course of the investigation which resulted in the charges before the Court, the police came into possession of many telephone numbers which they believed might have significance to their investigation.

The police determined which telephone service provider provided service via the telephone numbers in which they were interested, and then asked the relevant telephone service provider for the name and address of the person to whom telephone service was provided on a specific telephone number. The telephone service provider voluntarily gave the police the requested information.

Knowing the name and address of the person associated with the telephone number facilitated further investigation of the person so identified (though, as will appear, it has not been made clear in this application exactly how further investigation was facilitated). [ 4 ] The accused take the position that individuals have a reasonable expectation of privacy in the information the police obtain in this manner – that is the name and address of the subscriber for a specific telephone number – and that in obtaining that information the police engaged in a search, which, as there was no prior judicial authorization, was unreasonable.

They say that in obtaining the information from the telephone service provider, the police violated the constitutional protection against unreasonable search and seizure guaranteed by Charter s. 8. [ 5 ] In a companion application argued at the same time as the application just described, the accused challenge Personal Information Protection and Electronic Documents Act , S.C. 2000, c. 5, s. 7(3)(c.1)(ii). They submit that if the

section is read as a source of authority for the police to obtain the “subscriber information” without prior judicial authorization, it also violates Charter s. 8. [ 6 ] At the conclusion of the submissions made by counsel for the accused, I dismissed both applications without calling on the Crown. In my view it is clear that there is no reasonable expectation of privacy in the “subscriber information” in this context. There is no violation of Charter s. 8. I indicated that I would provide my reasons for that conclusion in due course. I now do so.

The Evidence [ 7 ] The evidence on this application consisted of an agreed statement of facts and the testimony of three witnesses called by the Crown, each an employee of a telephone service provider. [ 8 ] In

summary, these are the facts contained in the agreed statement of facts: - In the investigation leading to the charges before the Court (which the police named Project Khemistry), the police made requests to telephone service providers for customer names and addresses in respect of identified telephone numbers or device serial numbers. - Police would search a database maintained by Telus to determine which telephone service provider provided service on the telephone number for which the police wanted subscriber information.

Police would then make the request for subscriber information to the telephone service provider so identified. - In Khemistry, a total of 3662 requests for subscriber information were made – each in respect of a different telephone number. The police obtained subscriber information for 3324 individuals, businesses or organizations. In 399 instances the request either yielded no information or identified a pay phone. - The police requests for subscriber information were in four categories: 1. Requests made pursuant to a Production Order granted under s. 487.012 of the Criminal Code – (678 requests) 2.

Requests made pursuant to authorization contained in a “DNR” warrant [which I understand to be a warrant issued under s. 492.2 of the Criminal Code ] – (240 requests) 3. Requests made pursuant to a general warrant granted ancillary to a wiretap authorization pursuant to

Part VI of the Criminal Code – (194 requests) 4. Requests made with no prior judicial authorization – (2170 requests) This leaves 380 of the total of 3662 requests uncategorized.

The agreed statement of facts indicates that it is unknown which category these 380 are in. - Of the 2170 requests which were made without prior judicial authorization, 1910 were accompanied by a “ PIPEDA request form” [which I understand to be a form issued by police to the telephone service provider containing the information set out in PIPEDA s. 7(3) (c.1)]. - None of the requests for subscriber information in this case were made as a result of a service provider advising that it suspected criminal activity. - Telus maintains a database, LEADS, to which subscribing law enforcement agencies can direct requests for subscriber information.

It is described in the agreed statement of facts as follows: LEADS in an acronym for “Law Enforcement Agency Database Search”. It is an electronic database owned by Telus and is managed by a team in the Telus Corporate Security Department that is responsible for dealing with lawful access requests from law enforcement agencies (LEAs). The database contains customer name and address (CNA) information for Telus voice telephone customers. Its purpose is to allow an authorized user to retrieve the CNA associated with a telephone number. LEAs can subscribe for online access

subject to security safeguards. In the absence of a court order, access by LEAs is restricted to CNA that is either published or deemed to be non-confidential under applicable Telus Service Terms. Such information is available only to authorized LEA personnel. RCMP personnel are not permitted to access the database except in the context of an investigation of suspected criminal activity. [ 9 ] The Crown called three witnesses in this application. Each was an employee of one of three telephone service providers: Telus, Bell Canada and Rogers Communications.

Each testified to the terms and conditions which apply to customer subscriptions for telephone service, in particular cellular voice and data service. [ 10 ] In the case of Telus, the terms and conditions are contained in a document entitled “Telus standard mobility Service Terms”. The relevant portion of the document provides: Your Privacy How does TELUS protect my privacy? Your privacy is important to TELUS. We have a long-standing policy of protecting the privacy of our customers in all of our business operations.

The TELUS Privacy Policy sets out the principles that govern the collection, use and disclosure of our customers’ personal information and reflects our continuing commitment to protecting their privacy.

All information that TELUS keeps with respect to you and your service, other than your name and address , is confidential. . . . [Emphasis added] [ 11 ] The witness from Telus, Don Calpito, testified that because of this provision, and specifically because it states that a customer’s name and address are not confidential, Telus is prepared to disclose that information to the police if the police ask for it. [ 12 ] Mr. Calpito testified that when a customer signs up for cell phone service from Telus, they are given a copy of the terms and conditions. A copy is in the box for a new cell phone.

Also, in the activation process of a new or existing cell phone, the customer is advised of the terms and conditions and is required to accept them before the activation can be completed. If they do not agree, service will not be provided. [ 13 ] Mr. Calpito also testified that there is no “non-published” option for a cellular telephone number customer. If such a customer requests that their name and address be kept confidential, Telus will not accommodate that request. [ 14 ] The evidence of the witness from Bell Canada, Christian Huard, was in the same vein.

In the case of Bell Canada, the relevant terms of service are found in the “General Tariff” which is issued by the CRTC.

Article 11.1 provides: Unless a customer provides express consent or disclosure is pursuant to a legal power, all information kept by Bell Canada regarding the customer, other than the customer’s name, address and listed telephone number, are confidential . . . [Emphasis added] [ 15 ] Mr. Huard’s evidence as to how this provision is communicated to a customer was essentially the same as Mr. Calpito’s evidence on that point. If the customer subscribes for Bell Canada service at the point of sale of the cell phone, the terms and conditions will be provided in hard copy.

They are also communicated in the course of activation of the cell phone service and the subscriber is required to confirm that they accept the terms and conditions before service is commenced. Bell Canada also maintains a database by which law enforcement agencies who have subscribed to the service may search for the name and address that is associated to a Bell Canada cellular telephone number. [ 16 ] David Mak testified as to the terms and conditions which apply to cellular telephone service provided by Rogers Communications.

The relevant provision is almost exactly the same as that which applies in the case of Bell Canada: Unless you provide express consent, or disclosure is required pursuant to a legal power, all information regarding you kept by us, other than your name, address and listed telephone number, is confidential and may not be disclosed by us to anyone . . . [Emphasis added] [ 17 ] Mr. Mak testified that this condition is not contained in the Customer Service Agreement which a customer is required to sign when subscribing for cellular telephone service from Rogers Communications in person.

It is, however, referenced in the Customer Service Agreement document: This document must be read in conjunction with the Rogers Terms of Service and Acceptable Use Policy provided to you and posted on rogers.com . . . By signing below you: . . . o acknowledge having received a copy of, and having read, understood and agreed to the Rogers Terms of Use and Acceptable Use Policy forming part of and included with this/these service agreement(s). [ 18 ] Mr.

Mak also testified that if cell phone service is activated by a customer other than in a store, that is, for example, using a private computer, the program requires the customer to acknowledge having read and agreed to the terms of service before the activation can be completed. Right of the Accused to Seek a Remedy on the Basis of the Alleged Violation of the Charter Rights of Third Parties [ 19 ] This is one of several pretrial applications in these proceedings.

The list of pretrial applications to be addressed includes applications challenging judicial authorizations including general warrants, production orders, search warrants, and wiretap authorizations obtained by the police in the course of the investigation. The accused, in this particular application, seek only a

declaration that the acquisition by the police of the telephone service subscriber information was a violation of the protection afforded toeveryone by Charter s. 8. They submit that at this point it is not necessary that the inquiry be confined to the violation of the accused’sown Charter s. 8 rights.

They submit that, at this stage, the question of whether or not they would have standing to seek the exclusion ofevidence under Charter s. 24(2) need not be determined. [20] They observe that they do not, at this point, seek the exclusion of any specifically identified evidence from either the ITOs oraffidavits which will be reviewed when the challenges of the various judicial authorizations are dealt with, or from the three trialsthemselves.

They submit that it is appropriate for this determination to be made in advance of the applications for the review of thejudicial authorizations and of the trials. [21] In support of his submission that the Court should declare at this point in these proceedings that people who have subscribedfor telephone service have a reasonable expectation of privacy in the information that links their name and address to a particular phonenumber, and that the question of standing does not arise at this point, Mr. Renouf cited R v.

Thompson (SCC), [1990] 2S.C.R. 1111 and in particular the statement of Sopinka J. at page 1143 which was discussed by Cory J. in R v. Edwards (SCC), [1996] 1 S.C.R. 128 at paras. 33 to 38. [22] I note that as general authority for the proposition that an accused can seek a declaration that evidence was gatheredunlawfully because it was gathered in breach of a third party’s Charter rights, the passages cited appear wanting.

Sopinka J. and Cory J.were addressing the significance of the invasion of the privacy of third parties in determining the second of two issues they identified asarising in a Charter s. 8 challenge: whether the search was conducted in a reasonable manner. They did not say that the effects of policeactions on third parties was relevant to the first issue which arises in a Charter s. 8 challenge: whether the accused had a reasonableexpectation of privacy. (Edwards, paras. 33, 34 and 35.) It is that first issue which the accused seek to have determined in thisapplication.

They propose leaving the second issue, the issue to which Sopinka and Cory JJ. said the invasion of the privacy interests ofthird parties could be relevant, for future determination. [23] The Crown did not accept the position advanced by the accused. Mr. Hrabcak expressed concern that it was not clear whetherthe accused were seeking a remedy under Charter s. 24(1) or 24(2). The Notice of Motion, he observed, does not make that clear. Mr.Hrabcak submitted that the “standing” issue ought to be determined before the Court entertained submissions on the reasonableexpectation of privacy issue. [24] Mr.

Hrabcak confirmed, however, that the police did in fact obtain subscriber information without prior judicial authorizationfrom at least one and arguably two of the accused. He did not dispute that at least one and arguably two of the accused therefore hadstanding to challenge the police acquisition of that information as a violation of those accused’s own Charter s. 8 rights. [25] On that basis I decided to permit the accused to proceed with the application. I expect that if he had been called upon torespond to the application, Mr.

Hrabcak would have made further submissions as to the right of the accused to allege and rely upon theviolation of the Charter rights of third parties, and generally as to the propriety of separating the issues that arise in a Charter s. 8application.

However, as indicated, I found it unnecessary to call up the Crown at the conclusion of the accused’s submissions in supportof their applications. [26] In these circumstances, therefore, I should not be taken as having decided anything about the question of whether the accusedcan seek a remedy based on the alleged violation of the Charter rights of persons who are not accused. Further I should not be taken ashaving decided anything about the general acceptability of determining separately the issues which arise in a Charter challenge from oneanother.

Reasonable Expectation of Privacy [27] Charter s. 8 protects individuals against unreasonable search and seizure. The Courts have read s. 8, in particular the word“unreasonable”, as requiring that the individual’s claim to privacy be balanced against the state’s need to obtain information in order toeffectively enforce the law and maintain order.

The balance is achieved by requiring first that the individual claiming constitutionalprotection subjectively expect that the state will not (or perhaps should not) have access to the place or thing or information in questionand second that the individual’s subjective expectation be objectively reasonable. Where a reasonable expectation of privacy exists, onlyreasonable state intrusion will be constitutionally permissible. State intrusion will be reasonable when it has prior judicial authorization. [28] In R v.

Tessling 2004 SCC 67 , [2004] 3 S.C.R. 432, the question was whether the accused had a reasonableexpectation of privacy in information concerning thermal energy radiating from his house which the police obtained using an infraredcamera. The information so obtained, combined with other information, was used to obtain a search warrant for the accused’s house. The resulting search revealed a marihuana grow operation. [29] Binnie J., writing for the Court, considered whether the accused had a subjective expectation of privacy in the informationrevealed by the infrared camera. The accused did not testify.

However, Binnie J. held that when the information obtained by the policeis about something that happens inside an individual’s home, an expectation of privacy should be presumed unless the contrary is shown. [30] After so concluding, Binnie J. observed: (para. 42) I should add a caveat. The subjective expectation of privacy is important but its absence should not be used too quickly to undermine theprotection afforded by s. 8 to the values of a free and democratic society.

He observed that a person who fears state invasions of his privacy or who takes steps to prevent them should not be taken not to have anexpectation of privacy. He said: (para. 42) It is one thing to say that a person who puts out the garbage has no reasonable expectation of privacy in it. It is quite another to say thatsomeone who fears their telephone is bugged no longer has a subjective expectation of privacy and thereby forfeits the protection of s. 8. Expectation of privacy is a normative rather than a descriptive standard.

[31] In this observation Binnie J. was not addressing the determination of whether the subjectively held expectation wasreasonable. He was observing that the question as to a subjective expectation is more as to whether the individual believes the stateshould respect the privacy of the information than whether the individual believes the state actually does respect the privacy of theinformation. “Expectation” is to be understood in its normative connotation. [32] In many circumstances it is obvious that the accused would have a subjective expectation of privacy.

Where, as in Tessling,the information related to activity in his home or the contents of his suitcase, or the internet browsing history on his computer, theexistence of a subjective expectation of privacy is properly presumed. In some circumstances, a normative subjective expectation ofprivacy has been found even though the accused has acted in a manner inconsistent with its existence. For example, in R v.

Patrick 2009SCC 17 , [2009] 1 S.C.R. 579, Binnie J. writing for the majority of the court, held that the accused had a subjective expectationof privacy in the contents of the garbage he had left at the alley for collection. He said: At the subjective stage of the test, I do not think “reasonableness” is the issue. The question is whether the appellant had, or is presumedto have had, an expectation of privacy in the information content of the [garbage] bags. This is not a high hurdle.

As mentioned, in thecase of information about activities taking place in the home, such an expectation is to be presumed in the appellant’s favour. It ispossible that the appellant (who did not testify on this point) may never have ceased to have a subjective expectation, reasonable or not. [33] The lowness of the hurdle was perhaps demonstrated in R v. Gomboc 2010 SCC 55 , [2010] 3 S.C.R. 211.

Thepolice, who suspected the accused was growing marihuana in his residence, had requested that the electrical utility install a device at itsfacility which would reveal the pattern of electrical consumption in the accused’s home. The majority of the Supreme Court held thatthe accused had a subjective expectation of privacy in relation to information concerning the use of electricity in his home because theinformation concerned activity in the home and because the evidence made it clear that he: (para. 24) . . . exhibited a strong desire for privacy in his habits of electricity use.

The electricity meter on the property – the usual deviceemployed to measure the quantity of electricity being used in a home – had been deliberately bypassed to prevent it from performing thisfunction. The only reason can be a desire to shield his electricity use from detection. [34] None of the accused and none of the other 2168 persons whose privacy is alleged to have been intruded upon, testified in thisapplication. No one testified that they thought the fact that their name and address was linked to a particular telephone number wasprivate information, or should be respected as private information.

No one testified that they believed the police did not have access tothat information or that the police should not have access to the information. There was no evidence on the point – not even evidence ofthe nature relied upon in Gomboc – that an accused or anyone whose subscriber information was obtained, desired to shield thatinformation against being revealed. [35] Neither was there evidence that any of the individuals whose names and addresses were revealed to the police were not awarethat their telephone service provider did not consider that information confidential.

Indeed the evidence was to the contrary. It wasshown by the Crown that subscribers are informed at the time they subscribe for cellular telephone service that their name and addresswill not be held in confidence. In some of the authorities what the terms of service say about the confidentiality of subscriberinformation has informed the determination of whether a subjectively held expectation of privacy was objectively reasonable. In myview it also informs the determination of whether there was a subjectively held expectation of privacy.

The unanswered Crown evidencesupports the conclusion that cellular telephone service subscribers know, or, at worst, should know, that their service supplier does notconsider or treat their name and address as confidential. In the absence of any contrary evidence (as opposed to the contrary speculationwhich counsel did offer), it is reasonable to conclude that the cellular telephone customers to whom this application relates, knowing oftheir supplier’s position on the point, were content with that state of affairs.

That attitude is inconsistent with the existence of asubjective expectation of privacy. [36] Further, counsel for the accused did not identify, either in their written or oral submissions, a basis for presuming that asubjective expectation of privacy existed in this context.

There was no submission that the information obtained by police – that acertain name and address belonged to the person to whom a certain telephone number had been assigned – revealed anything which hasbeen recognized in the authorities as justifying a presumption of a subjective privacy expectation, such as activities in the home,information stored on a computer, core biographical particulars, intimate details of the life-style and personal choices of the individual,or anything affecting or relevant to the individual’s dignity, integrity or autonomy. [37] Unlike the several cases (R v.

Trapp, 2011 SKCA 143 , [2012] 4 W.W.R. 648; R v. Spencer, 2011 SKCA 144, [2012] 4 W.W.R. 425; R v. Ward, (2012) 2012 ONCA 660 , 97 C.R. (6th) 377) where internet service subscriberinformation was recognized as being, in effect, the key to the door protecting the privacy of the content of the individual’s computer,information properly presumed to be the subject of a subjective expectation of privacy, there was no evidence in this application that thetelephone service subscriber information was similarly the key to any private information.

It was not established or even suggested thatthe subscriber information obtained by police permitted the police to link, for example, text messages relating to drug trafficking to anyperson whose subscriber information was obtained without prior judicial authorization. If, though it was not established in theapplication, there was in fact such a link, it was not established or even suggested that it was the subscriber information obtained withoutprior judicial authorization, and not the subscriber information obtained under some form of warrant, which permitted the link to beestablished.

Counsel speculated that having obtained the name and address linked to a known telephone number could direct police to aresidence to be searched – but it was not shown that this actually happened in this case, much less that it happened as a result ofsubscriber information obtained without prior judicial authorization as opposed to subscriber information obtained pursuant to a warrant. Counsel was asked in argument what consequential information the police had learned as a result of obtaining the subscriberinformation.

No answer was given. [38] Counsel for the accused observed that, as noted above, the hurdle to be met with regard to a subjective expectation of privacyis low. Even so, counsel proposed no basis upon which to overcome even a low hurdle. In effect the submission was that this aspect ofthe analysis should be ignored, that the Court should simply move on to a determination of whether an expectation of privacy, if itexisted, would be objectively reasonable.

Upon determining that an entirely hypothetical expectation of privacy would be objectivelyreasonable, the Court should, in effect, assume that one must have existed.

[ 39 ] I cannot adopt that course. Even when cautioning against the quick determination of the question in Tessling , Binnie J. observed, “The subjective expectation of privacy is important.” The hurdle may indeed be very low, but there must be some basis for concluding that a subjective expectation of privacy was held by the individual who claims the protection of Charter s. 8, or on whose behalf it is claimed. As noted, the basis could be a presumption or an inference.

But no basis for reasoning that even such a low threshold has been met has been offered here. [ 40 ] I am not persuaded that a subjective expectation of privacy existed here. It is not therefore necessary to consider whether, if it did, it would have been reasonable.

I observe, however, that most of the elements of the reasoning which has led me to the conclusion that a subjective expectation of privacy did not exist would also have led to the conclusion that a subjective expectation of privacy, if it did exist, would not have been objectively reasonable. [ 41 ] I find that in obtaining the subscriber information in this case, the police did not intrude upon anyone’s reasonable expectation of privacy and therefore did not conduct a search or seizure within the meaning of Charter s. 8. Therefore the police did not violate Charter s. 8 rights.

As indicated at the conclusion of the submissions of counsel for the accused, the application for a declaration in that regard is dismissed.

Constitutional Challenge to PIPEDA s. 7(3)(c.1) [ 42 ] In some of the cases one of the factors considered in determining whether a subjectively held expectation of privacy was objectively reasonable was the existence of a statutory regime governing disclosure of the information in question. (See Gomboc , Trapp , Spencer , and Ward. ) [ 43 ] For example, in Ward , Doherty J.A. observed that the statutory authorization given in PIPEDA s. 7(3)(c.1) for a commercial entity otherwise required by PIPEDA to maintain the privacy of the personal information of its customers, to disclose that information to a law enforcement agency, was significant to the question of whether the accused’s expectation of privacy was reasonable.

Doherty J.A. said: (para. 104) . . . I look to legislation [ PIPEDA , s. 7(3)(c.1)] the constitutionality of which is not challenged, and which by its terms speaks to the circumstances in which the third party holder of the information may disclose that information to the police as informing the degree of privacy that persons ought reasonably to expect in our society. [ 44 ] The constitutional challenge to the same

section of PIPEDA here appears to have been made so that it could not be said, if the same point had been reached in the analysis, that the

section had not be constitutionally challenged. [ 45 ] The theory of the present constitutional challenge is that the impugned

section authorized an unreasonable seizure of private information. It appears clear, however, that s. 7(3) (c.1) is not a source of police authority to obtain information. Police authority to obtain the information must already exist before an organization possessing personal information may disclose it pursuant to the section. It is difficult to see, therefore, how a disclosure contemplated by the impugned

section could ever be considered a search or seizure. The entity authorized to do something by the

section already has the information. The entity obtaining it, the police, must have authority from a source external to the impugned

section before it can obtain it. [ 46 ] Further, since there was no reasonable expectation of privacy in the subscriber information in this case, even if the impugned provision somehow could be read as being a source of the police authority, no search or seizure within the meaning of Charter s. 8 occurred when police obtained the information. The conclusion that PIPEDA s. 7(3)(c.1) violates Charter s. 8 is therefore not possible. [ 47 ] Therefore, as indicated at the conclusion of submissions of counsel for the accused, the constitutional challenge to PIPEDA s. 7(3)(c.1) must be dismissed.

Heard on November 4, 5 and 6, 2013. Dated at the City of Edmonton, Alberta this 13 th day of November 2013. B.R. Burrows J.C.Q.B.A. Appearances:

Dennis Hrabcak for the Crown Simon Renouf, Q.C., Julia Renouf and Adam Badari for Steven Daniel Whipple Clayton Rice and Tara Hayes for Jonathan Mark Rivera Aldaba Gregory Lazin for Jason Clarke Croft Aleksandra Simić and Alexandra Seaman for Wassime Rahime