Rogers and Telus filed Charter applications after police obtained orders requiring the telecom providers to disclose customer information related to 21 cell towers or sites.MARK BLINCH/Reuters
An Ontario court is set to issue what could be a landmark ruling on a Charter of Rights challenge filed by two of Canada's biggest wireless carriers over "tower dump" production orders that would have required the companies to turn over personal information of about 40,000 customers.
Police use such orders as a technique to get all call-detail records from specific cellphone towers, at a certain point in time, in the hopes of turning up information relevant to a criminal investigation.
The case in question began in 2014 after Peel Regional Police obtained production orders requiring Rogers Communications Inc. and Telus Corp. to provide communication records related to 21 cellular towers or sites. The companies said complying with the order would have resulted in the disclosure of customer name and address information for more than 9,000 Telus subscribers and more than 30,000 Rogers subscribers.
After the orders were issued, the police said they would be content to receive just the telephone numbers and not the associated customer name and address details. Several other telecom providers then complied with the orders but Telus and Rogers filed the Charter applications.
The orders were later revoked entirely, but Justice John Sproat of the Ontario Superior Court in Brampton nonetheless agreed in a July, 2014 decision to hear the companies' applications, noting that individual subscribers lack the means to raise such issues and writing that: "The privacy rights of the tens of thousands of cellphone users are of obvious importance."
"The Rogers-Telus applications directly concern 40-50,000 individuals, it is safe to infer that the number of individuals affected across Canada would be in the hundreds of thousands, if not millions, every year," he added.
Justice Sproat heard arguments on the matter in August, 2015 and is expected to release his decision on Thursday. Rogers and Telus have asked him to find that the orders amounted to unreasonable search and seizure under the Charter and also issue general guidance on how the courts should approach tower-dump production orders in the future.
Lawyers for the companies argue there is a reasonable expectation of privacy in the subscriber information at stake in this case – both for the subscribers themselves and for the companies as it relates to their business records – and further argue the orders were unreasonable, as they were "tantamount to fishing expeditions" and contained no post-seizure restrictions on what could be done with the information.
Lawyers for the Ontario Ministry of the Attorney General acknowledged in court filings that the orders issued in this case were "extraordinary in scope," falling "well outside the norm" of what is typically requested in tower-dump production orders, which are generally restricted to a handful of cell towers or cell sites. However, the Crown argued there was no Charter breach in the case – noting there was no search and seizure – and said the court should resist setting any "bright-line" rules for when tower-dump orders can be made.
The Supreme Court of Canada highlighted the issue of personal privacy in the online world in its June, 2014 Spencer decision, which held that police must obtain a search warrant before asking Internet providers for details that would identify their customers. Rogers and Telus, along with many other telecom providers, have since said they will not disclose name and address information without a court order.
"Technology is expanding so rapidly and we are recording more and more information about ourselves, whether intentionally or unintentionally. So that creates all sorts of challenges about how we regulate what the police are allowed to find out about us," Gerald Chan, a criminal and constitutional lawyer with Stockwoods LLP in Toronto, said in an interview.
He said tower-dump orders "represent a privacy invasion of a different order of magnitude" compared to a typical search warrant for an individual home or business. "Tower dumps allow the police to gather information about the movements or associations of thousands of innocent people in one fell swoop. There's far more collateral damage to individual privacy rights."
Although such orders do not seek the content of communications, they do turn up "metadata," which include information such as the time and length of a call, the addresses and numbers contacted and geolocation information. Those details, when correlated with name and address information, can reveal a great deal about individuals' movements and associations, Mr. Chan said. "I think more and more people are realizing that metadata alone, when aggregated and put together, paints a very detailed picture of our lives."
Mr. Chan said the criminal law bar would be following the ruling – which could be appealed to higher courts – and "law enforcement will no doubt be looking to this for guidance on when they can use this investigative power."
He added that a decision that includes "clear principles set out as to when the police can do this and how they should do it" will give telecom operators a baseline from which to assess orders they receive and decide whether to take legal steps to protect the privacy of their customers.
Representatives for Rogers and Telus both offered similar reasons for why the companies felt it necessary to mount a court challenge to the orders, arguing they were overly broad.
"We only provide confidential customer information to law-enforcement agencies in response to valid court orders or other applicable law. We will contest orders if we believe they overreach," said Telus spokeswoman Emily Hamer. "We think that this order was broader than the law allows, and so asked the court to set it aside"
"We want to ensure our customers' privacy rights are protected and there are clear ground rules for what law enforcement is able to request and access," said Aaron Lazarus of Rogers, adding the company's policy is only to share customer information when required by law or in emergency situations. "This case did not meet the test for us and we are hopeful the court agrees."
A spokesman for the Ontario Ministry of the Attorney General declined to comment on the case ahead of the ruling.