Henry Waldock
Last updated: 2015.01.03
"The right to be let alone is indeed the beginning of all
freedom."
-- Justice William O. Douglas
"People have really gotten comfortable not only sharing more
information and different kinds, but more openly and with more
people." "That social norm is just something that has evolved
over time."
-- Mark Zuckerberg, C.E.O. of Facebook
Today, when we witness an act of violence or larceny, we may, if we feel so inclined, dial 911 and summon peace officers to assist us.
It was not always so in the common law.
In 1285, England had a crime problem. Highwaymen operated with impugnity, and, it appears, stole from strangers with the blessing or tolerance of the locals. There were no police officers. King Edward I improved the law enforcement problem by conscripting the public. In the Statute of Winchester, Edward ordered all citizens to chase and capture any known felon. If they failed to capture a robber in their neighborhood, the citizens of the community would be required pay the victim back for the victim's losses.
That public duty to uphold and enforce the law remained in the common law for centuries. Canada inherited this view of the law, and indeed, in Canadian law, the power of police to arrest arises from the citizen's power to arrest, and not the other way around. R. v. Asante-Mensah, 2003 SCC 38
In 1829, England established its first police force. Sir Robert Peel identified 9 principles of policing:
One may observe in principle 7 that even five and a half centuries later, the English common law still viewed enforcement of the law as a duty of every citizen.
Did enforcement of the law include a duty to assist police officers? In 1966, in England, that duty faded from the law. In Rice v. Connolly, [1966] 2 All ER 649 (Q.B.), the English courts decided that although every citizen had a moral duty to assist police, they had no legal duty. Canadian courts agreed, in cases which discussed this question in the context of the right to silence: whether a person that the police suspected of misconduct had to answer police questions. R. v. Guthrie, 1982 ABCA 201, Moore v. The Queen, [1979] 1 SCR 195.
What of the innocent bystander? Does a Canadian law or our heritage from the common law still impose any moral duty on the bystander to assist in bringing a felon to justice?
The Canadian Charter of Rights and Freedoms protects the rights of the citizen as against the state. In so doing, it drives a philosophical wedge between the public and the police. Increasingly, at law, police are not part of the community, but something outside it, and from which the community requires protection.
Spencer, 2014 SCC 43 surprised me.
The Supreme Court of Canada rejected the idea that police officers could simply ask Internet Providers for the subscription information for internet addresses that the officers were investigating for criminal activity. The court found that such a request requires judicial pre-approval because Canadians enjoy a reasonable expectation of privacy over their identities when they go online.
An officer found a computer at a Canadian IP address sharing child pornography over LimeWire. The officer sent a written PIPEDA request to the IP provider (Shaw Communications) to give the name and address of the customer. Shaw provided the name and address of Mr Spencer's sister. That information led investigators to discover that he lived with her. He was responsible for running LimeWire on her IP address. At trial, he complained that the police request was an unconstitutional search. The trial judge convicted him of some offences. The Supreme Court found that the police request violated s.8 of the Charter.
To reach this conclusion, the court observed that s.7(3)(c.1)(ii) - which permits private organizations to disclose customers' personal information to police - requires police to have "lawful authority". The judges interpreted that term narrowly, so that police must have things like warrants, production orders or exigent circumstances. This interpretation took me by surprise because it differs markedly from their interpretation of the same phrase in another context. Merk v. I.A.B.S.O.I. 2005 SCC 70. Furthermore, PIPEDA already covers court orders in s.7(3)(c), and exigent circumstances in s.7(3)(e). One would expect s.7(3)(c.1)(ii) to mean something different.
Effectively, in their enthusiasm to protect Canadians' anonymity online, the court apparently interpreted s.7(3)(c.1)(ii) out of existence.
That result seems wrong. Police officers commonly need less-sensitive information, and should be able to request it from corporations without first seeking judicial authority. Suppose, for example that in the course of paying their internet bill in person at a Shaw office, a couple gets into an argument, perhaps over his exorbitant pornography bill. The man assaults the woman. Fearing further punishment, the woman refuses to cooperate with the police. The teller who served them might be permitted to give police a statement, but s.7(3) prevents Shaw Communications from providing a copy of any video the security camera recorded until the police obtain a production order. On a strict reading of PIPEDA as the court interpreted it, Shaw employees can not even tell the police whether the security system captured any of the assault. This could bring the investigation to a premature standstill: a justice can only issue a production order if the police can establish that the security system probably contains evidence. Therefore, in this example, the police might not get a video-recording which they plainly ought to obtain.
I do not think that the judges intended this result.
None of the other privacy statutes in Canada use the cumbersome language of PIPEDA. None require that police officers have the "lawful authority" required by PIPEDA.
How the courts will interpret police FOI requests under those statutes remains an open question. The language of those statutes plainly authorize corporations and government agencies to release information to police engaged in criminal investigations. I expect
In my view, police officers should continue making FOI requests of corporations, especially where the information sought is not particularly private or sensitive. But beware of requesting highly sensitive or private information. Like linking subscriber information to IP addresses.
Does Spencer turn good corporations bad?
Rice v. Connelly (1966), 2 All E.R. 649, in which Lord Parker
held that it "seems to me quite clear that though every citizen
has a moral duty, or, if you like, a social duty to assist the
police, there is no legal duty to that effect and indeed the
whole basis of the common law is that right of the individual to
refuse to answer questions put to him by persons in authority,
and a refusal to accompany those in authority to any particular
place short, of course, of arrest".
Subsequent judges addressed this question in a simpler way: the fact that legislation permits a government agency to share private information with police does not create an exception to the expectation of privacy that the person enjoys in the record. Therefore, by requesting it and reading it, the police violate the person's privacy. R. v Flintroy, 2018 BCSC 1777
But not always. The expectation of privacy in records depends
upon the relationship between the record-holder and the person.
In R.
v. El-Azrak, 2023 ONCA 440, the Ontario College of
Pharmacists gave police information about a pharmacist and the
prescriptions he filled. This disclosure did not violate the
pharmacist's expectation of privacy because:
Public and private agencies must now protect the private information they collect on their employees and customers. For this reason, investigators found it harder to get answers from corporations and government agencies.
Each Act contained a provision which permitted (but did not require) organizations to share information with police officers investigating offences.
Until the Supreme Court of Canada's decision in Spencer, 2014 SCC 43, I thought that provision allowed all organizations to share information with police who were actively investigating an offence. This led me to believe that there would be no harm in asking organizations to share personal information in their possession. Some courts judges. The Supreme Court didn't. As a result, police can rely on PIPEDA to request information from government and private sector organizations only when police have "lawful authority". Status as a police officer, engaged in the investigation of crime apparently doesn't suffice. Exigent circumstances do.
Therefore, don't use PIPEDA to request private information, unless you need information in order to save lives or prevent destruction of evidence.
On the other hand, other privacy legislation does not include this "lawful authority" language. Lower court decisions have interpreted some to permit disclosure of personal information to law enforcement agencies.
Quoting the correct exception in your request for information may persuade them to release the information you seek.
Different legislation applies to different organizations. There are four general Acts, and many specific ones. To figure out which legislation to refer to, ask:
is the organization public or private?
does Federal or Provincial legislation apply to it?
Answering these questions is not easy. When in doubt:
ask someone in the organization whether the organization is governed by federal or provincial legislation, or incorporated federally or provincially;
read the first few sections of the legislation to see what it applies to, and look to the appropriate privacy legislation;
in your letter, refer to all the acts or corporate privacy policy you think might apply.
Private corporations are required to publish their privacy policies. You can usually find them on the Web.
Get a copy.
If you read the privacy policy of the corporation from which you want information, you may discover that they have already decided whether they will release the information you seek.
Some customers of corporations, such as telecommunications and internet companies must enter into contracts with the corporations which limit their use of the technology.
Get a copy.
A written request for specific information will often render compliance lawful. The letter must:
Identify yourself as a police
officer, including the police force you work for, and the
section. For certainty, you might refer to the
legislation which establishes your agency.
Identify the specific information you require.
Explain that releasing it would assist in the investigation of a criminal offence, which, if successful, would likely result in charges.
Explain the nature of the offence (if disclosing it will not compromise the investigation).
Quote the file number of the police investigation.
Refer to the Act and the section which authorizes the organization to release the information you seek.
If it's a private organization, quote the language from their privacy policy which permits the disclosure you want.
If you expect resistance from the organization, you may want to add:
The nature of any ongoing risks to the public
risks of harm to people
risks of harm relevant to the agency
urgency of putting a stop to them
How disclosure of the information would be in the person's best interests (eg disclosure of identification tending to identify an unknown victim)
Why seeking consent from the person involved would affect the investigation. If revealing the request would compromise your investigation, then say so in clear terms. If you don't trust the organization to keep your request confidential, you could include a reference to s.129 - obstructing a peace officer.
If you're seeking information from a Federally governed private corporation, then you should address it to an "investigative body" within the organization. PIPEDA s.7(3)(h.2).
If someone questions your lawful authority to ask for the information, you can refer them to s.487.014 of the Criminal Code.
Government organizations always have purposes. For example, the Ministry for Children and Families exists for "the safety and well-being of children". (s.2 Child, Family and Community Service Act) If your request assists their purpose, then you should remind them how it helps. Therefore, if, in the investigation of a rapist, you think that this ministry's records may assist, your request could mention the harm to children caused by the threat he poses to their mothers. Quote the section which sets the purpose of the organization.
Businesses don't want to be sued for revealing private information. Therefore, they should know that the law permits them to reveal the information you seek. Be aware that the Act does not compel them to produce what you want. It merely permits them.
You may have to appeal to their corporate interest in being a good citizen, or explain to them what civil liability (if any) might flow from failing to disclose.
This table covers only the general legislation. Be aware that there may be specific exceptions. The organization to which you write may say that the act you quoted doesn't apply to them. If they do, find out which act does apply, or quote several.
Perhaps all you want is reports or statistics, or other non-private records from the federal government. Consider making a request under the Access to Information Act (federal).
People locked in civil litigation often have bad things to say
about each other. Some of what they say is true.
Sometimes one of them committed crimes. Sometimes, the
other one wants to tell.
The one that wants to talk - or their lawyer - can be a fertile
source of information. There are some limits.
The rules of civil litigation require plaintiffs and defendants
to disclose relevant documents to each other. They
can compel parties to attend "Examination for Discovery" in
which they must answer questions under oath.
Ordinarily, all the information so gathered must be kept
confidential until it is revealed in a trial. What if one
party discovers that another party committed a criminal offence?
In
Juman v. Doucette, 2008 SCC 8,
the court found that this information may not be disclosed to
police without a court order, except to prevent serious and
immediate danger. In a court application for release of
such information, all the parties should have notice.
Similarly, in Nedelcu,
2011 ONCA 143, the court found that Crown could not use a
transcript from an examination for discovery to prove that the
accused's new version of the event at trial was a lie.
I'm not yet sure what use you or the prosecutor can make of
information of this kind. Such information was compelled
from the suspect, and would tend to incriminate him.
I therefore doubt that transcripts of examinations for discovery
will be admissible in a subsequent criminal trial. (Charter
- s.13).
I can see arguments for and against including such information
in an ITO or affidavit. On the one hand, you lawfully came
into possession of the information. On the other, it came
from an invasion by the state of the suspect's privacy, which
engages s.7 and possibly s.8 of the Charter.
A cautious officer would investigate information received from a
civil litigant as if it were a tip from a source of unknown
reliability. Confirm as much as you can before exercising
any powers of arrest or search.
Section s. 7(3)(c.1)(ii)
of PIPEDA, authorizes private
organizations to disclose personal information to government
institutions for the purposes of investigating matters of
national security, law enforcement or intelligence
gathering. That section requires police to have "lawful
authority" to receive information, and to identify that lawful
authority in their request.
In Spencer, 2014 SCC 43, police sought subscriber information from an internet provider in order to identify the users of an IP address which shared child pornography on the internet. The court found that merely investigating a crime does not confer the "lawful authority" necessary to trigger this exception, but exigent circumstances to protect imminent bodily harm would. (Para 74)
Section 8 of the Federal Privacy Act authorizes federal public institutions to share private information with police officers investigating a crime. In Finnegan, 2014 ONSC 2032, the court found that this legislation overrode a prisoner's slight privacy expectation over his effects, which a prison stored while he served his time. That section does not require the police officers to have "lawful authority" to obtain the information.
Similarly s. 29(2)(g) of Saskatchewan's Freedom of Information and Protection of Privacy Act, S.S. 1990-91, c. F-22.01 permits disclosure of government information to prescribed police agencies for investigation. It does not require the officers to have "lawful authority" either. In Trapp, 2011 SKCA 143, like the Spencer case, the police sought subscriber information from a telephone company for a specific IP address. Unlike the Spencer case, the provincial legislation applied. That court found the provincial privacy legislation specifically authorized the request.
In Quesnelle, 2014 SCC 46, at paras 38-40, the court approved of police forces sharing information between themselves for purposes consistent with the purposes for which information was originally gathered.
When police investigated Mr Stucky, 2006 CanLII 588 (ON S.C.), they asked Canada Post to tell them who owned a particular post office box. Police applied pursuant to the Privacy Act, and explained what they intended to do with the information. Canada Post answered their question. Defence argued that police required a warrant but the court disagreed. It was a bona fide investigation. The Privacy Act does not create greater rights of privacy than the legislation itself describes. (On appeal, Stucky won a new trial, on other grounds. The appeal to Supreme Court of Canada was abandoned.)
When a police officer found that a computer on SaskTel's
internet service published child pornography on a peer-to-peer
network, she sent a request to SaskTel for "any" information
SaskTel had on the subscriber. SaskTel responded with Mr Trapp's,
2011 SKCA 143 name, address, phone number, email address, cell
phone number, and a list of the television channels to which he
subscribed. Two of three judges found that he enjoyed a
reasonable expectation of privacy over this information, but
because his contract allowed SaskTel to disclose personal
information to police, and because FIPPA's authorized SaskTel to
do it, the "search" was "prescribed by law", and therefore did
not violate s.8. The last judge agreed that the "search"
did not violate s.8, but followed a different route: the
contract and the legislation extinguished Mr Trapp's expectation
of privacy.
Several practice points emerge from this decision:
When making a freedom of information request, you should identify the applicable legislation in your request. (This officer didn't.)
The request should identify what information you want. (This officer asked for "any information". She got more than she needed. That irked the judges a bit.)
When assessing s.8 claims, judges do consider the subscriber's contract. You may want to get a copy before making the request, to see what it says about confidentiality.
Drug cops working in an airport in Nova Scotia routinely asked Westjet to let them see the passenger list to see if there was anyone suspicious on it. Westjet permitted them to see enough information that they had cause to suspect Mr Chehil, 2009 NSCA 111 (aff'd on other grounds 2013 SCC 49) might be carrying drugs. The officers brought a drug sniffing dog to sniff his luggage. Soon enough, the officers found 3.5 kg of cocaine in his luggage. The trial judge found that the officers violated Chehil's rights under s.8 of the Charter, because PIPEDA created an expectation of privacy. The Court of Appeal disagreed. "Mr. Chehil cannot rely upon the limitations in s. 5(1) of the PIPEDA yet ignore the disclosure permitted by s. 7(3)(c.1)(ii)..."
As I read this decision, it's only a breach of s.8 if you ask a person or corporation to reveal information that you know the person or corporation should not reveal. For example, doctors owe their patients a duty of confidentiality. Therefore, you shouldn't make a PIPEDA request to a doctor's office for medical records of a suspect (unless it's one of the emergencies set out in the Act).
In my view, this decision resolves the confusion arising from Ontario's various conflicting decisions around PIPEDA. It breathes life back into PIPEDA requests.
In the case of Gomboc 2010 SCC 55, the court split several ways in the interpretation of an obscure power company regulation which similarly permitted disclosure of information to police. Without specifically saying so, it appears that 7 of 9 judges agreed with the logic of Chehil.
Lower courts disagreed whether PIPEDA created such expectations
of privacy that PIPEDA requests for private information breached
s.8.
When police investigated Mr Ward, 2012 ONCA 660 for possession of child pornography, they needed his internet subscription information from Bell Canada. Bell Canada had a clear privacy policy of disclosing such information to law enforcement. Police wrote a request explaining their investigation, and specifically limiting their request to the kind of information that they needed. The information led to the evidence they were looking for. The trial judge convicted Mr Ward of accessing and possessing child pornography. Mr Ward complained that the police violated his expectations of privacy by making this request. The court disagreed. It looks like PIPEDA requests for subscriber information from Internet Providers for the purposes of investigating sexual offences against children will generally fly in Canada. But that doesn't mean all PIPEDA requests will survive s.8 of the Charter.
This decision suggests that courts may find s.8 breaches arising from PIPEDA requests where:
Without referring to Chehil, courts in B.C. reject Cuttell. The existence of a privacy policy does not matter to the disclosure to police of subscriber information relating to an IP address. A corporation "may" disclose information to police pursuant to PIPEDA. McNeice, 2010 BCSC 1544. Caza 2012 BCSC 525.
In Ballendine, 2011 BCCA 221, without specifically adopting it, the court seems to approve of Chehil too.
Ms Finley, 2013 SKCA 47 objected to completing the intrusive "Long Form" population census (before the Conservatives killed it). She complained that it violated her s.8 rights. The judges disagreed. Although it did require her to provide personal information, it was in the context of a regulatory regime, which thoroughly protected her privacy. Although the Act compelled her to provide "core biographical" information, it protected it so that s.8 was not breached.
What legislation in B.C. permits police to access private information?
Unfortunately, at this time, this list is not yet complete. It's extraordinarily time-consuming to research. If you think there might be BC legislation which governs a particular target, you can find the act by looking here. For Federal legislation, look here.
Ministry of Children and Families - Child, Family and Community Service Act s. 73-s.79
Colleges and Institutes are treated as public sector (therefore FOIPPA applies) College and Institute Act
Community Charter - Municipalities must make their public records public, otherwise FOIPPA applies.
Despite FOIPPA, the Coroner may refuse to disclose information.
The Correction Act permits prison authorities in BC to review correspondence of prisoners, and to monitor telephone calls.
Creditor Assistance Act requires a sheriff to maintain a book open to the public of all the seizures made against debtors; and creditors may file with the district registrar documentation of claims.
The court files in Court Registries are generally open to the public, except for family litigation. They can be an abundant source of information.
Family Registry – need consent of a party or a court order
Adoption – need court order or consent of an applicant
Small Claims, Supreme Court Civil, Probate – all open to public
Procedure: public access terminals allow you to search on names (JUSTIN may also permit you to search civil records). Pay $8.00 to see the files themselves.
Municipalities - In order to determine who is entitled to reduced taxes, the Homeowner Grant Act requires homeowners to sign a certificate for their primary residence. Under FOIPPA s.25, the municipality may determine that it is in the public interest to release to police those certificates if the police are concerned about possible grow ops.
Under the Health Act, s.11, where the medical officer has reasonable grounds to believe that someone has a communicable disease, he may order tests to confirm it, and order the person to abide by conditions to prevent its spread. However, that does not necessarily mean the medical officer will share this information with you.
The Hospital Act s. 18 requires each hospital to maintain a register of patients. It does not provide for disclosure of information in that register.
Hotels – an officer of the Provincial police may examine the hotel register without warrant. S. 6 of the Hotel Guest Registration Act.
The Human Rights Commission hears discrimination complaints. Although the Code is silent about what it must disclosed, its decisions are available online at the site.
Builder's Lien Act s. 41 The victim of a crooked contractor (can you say "leaky condos"?) can demand contractual information.
Business Corporation Act Division 5 Every corporation maintains a records office to which people associated with the company may apply for records. Businesses must register with the Registrar of Companies, a source of public information
Companies Act must maintain a registered records office, and notify the Registrar of Companies. Any person can get records from the registered records office. Many useful documents must be filed with the Registrar, which any person can see, using BCOnline.
The Cooperative Associations Act contains similar requirements for Co-ops.
The Health Professions Act s.22 allows any person to examine the register of the college to determine who is a member of that profession. Those colleges perform internal discipline hearings on their members; records of those proceedings may be relevant to your investigation. The list of health professions includes: Nurses, Doctors, Dentists, Optometrists, Dental Hygenists, Physiotherapists, Chiropracters, Pharmacists, Podiatrists, Hearing Aid Vendors, Massage Therapists, Dieticians, Midwives, Naturopaths, Psychologists, Accupuncturists
Hotel Guest Registration Act Hoteliers must provide guest registration to police.
Builders of residential homes must get licences from the Registrar of Residential Builders. This register is open to the public. Homeowner Protection Act s.17.
A reader sent me this link, which might get you started in the USA. There may be other ways through law enforcement agencies.
Canada (Information Commissioner) v. Canada (Commissioner of the Royal Canadian Mounted Police), 2003 SCC 8 (CanLII), [2003] 1 S.C.R. 66
A former inmate of an Ontario remand centre
applied for disclosure of the records which the jail kept on
him. The correctional authorities resisted disclosure of
police records they obtained, and other documents which "may"
contain information given in confidence. The Ontario
Court of Appeal interpreted the various exceptions to the
general freedom of information sections so as to protect
information which the correctional authorities received "in
confidence". Ontario
(Community Safety and Correctional Services) v. Ontario
(Information and Privacy Commissioner), 2011 ONCA 32
Someone wanted a breakdown of sex offenders
populations in areas of the province of Ontario, by the first
three digits of their postal codes. The sex offender
registration process collected this information, but
guaranteed anonymity to the sex offenders. Because this
statistical information did not identify any person nor pose
any real risk of harm to them, the government had to divulge
the information. Ontario
(Community Safety and Correctional Services) v. Ontario
(Information and Privacy Commissioner), 2014 SCC 31
Gomboc,
2010 SCC 55 at paragraph 42, the court pointed out that police
can lawfully ask corporations to disclose information.
Boushehri,
2021 ONSC 8396 - a person who calls a cab does not normally
enjoy an expectation of privacy from police inquiries about who
called for the cab, and where it went.
Chaudhry, 2021 ONSC 394 - a person who collects social services
payments does not enjoy an expectation of privacy over the dates
that they were paid, and the mode of payment (cheque, direct
deposit etc).
Police received allegations that Mr Tadros
2009 ONCA 442 (Ont. C.A.) sexually abused children. 8
charges were laid, but it must have been a weak case.
When Mr Tadros agreed to enter into a peace bond, the
prosecutor withdrew the charges. After the peace bond
expired, Mr Tadros applied for various jobs for which a
criminal record check would be required. All the
employers turned him down. He figured that the police
must have disclosed information about the 8 charges, and asked
the court to order the police to destroy all records in their
possession about the 8 complaints, so that future employers
would never find out about them. The trial judge
declined to make a destruction order, but did order the police
never to disclose it to prospective employers. The
appeal court found that the retention and disclosure of the
information was lawful within the terms of the privacy
legislation. It set aside the non-disclosure order.
Privacy Acts differ across the country. Do these acts
balance privacy rights and safety correctly? Most
agencies already have Freedom of Information officers.
This decision shows that they need to know what they're doing
and why.