A woman walks past a Rogers sign on the day of the Rogers Communications Inc. annual general meeting for shareholders in Toronto, April 21, 2015.MARK BLINCH/Reuters
An Ontario judge has ruled there was a breach of the Canadian Charter of Rights and Freedoms in "tower dump" production orders that required Rogers Communications Inc. and Telus Corp. to hand over the personal information of about 40,000 cellphone users to police.
Justice John Sproat of the Ontario Superior Court of Justice in Brampton issued a decision Thursday that found the orders had authorized unreasonable searches in contravention of Section 8 of the Charter, breaching the rights of Telus and Rogers subscribers.
The orders were made in 2014 but later revoked by the police after Rogers and Telus challenged them and the judge found the disclosure of personal information required went "far beyond what was reasonably necessary to gather evidence concerning the commission of the crimes under investigation."
Justice Sproat wrote that "common sense" dictates Canadians have a reasonable expectation of privacy in the records of their cellphone activity and while this type of information is often innocuous, "it remains that in a number of cases it will be quite sensitive."
He also set out guidelines in his ruling for how police and courts should handle requests for such orders to minimize the intrusion on personal privacy.
Police use tower dump orders to get all call-detail records from specific cellphone towers, at a certain point in time, in the hopes of turning up information relevant to a criminal investigation. In the case at hand, Peel Regional Police sought details of subscribers whose mobile devices had pinged cellphone towers in the range of a string of jewellery robberies.
"Every year such orders require cellular providers to produce the names and addresses of hundreds of thousands, if not millions, of subscribers; who they called; who called them; their location at the time; and the duration of the call. These orders may also require that credit card information be provided," Justice Sproat wrote.
Rogers and Telus challenged the orders in question for being overly broad, saying complying with them would have resulted in the disclosure of the personal information of more than 9,000 Telus subscribers and more than 30,000 Rogers subscribers.
Justice Sproat noted in his ruling that the orders also required production of bank and credit card information, which, "if it had any relevance at all in locating an individual, could have been sought in a follow-up application for a small number of actual suspects, i.e. a person whose cellphone was proximate to multiple crime locations."
The judge provided seven guidelines for police and courts to follow. Taken as a whole, his recommendations urge police to carefully outline the specific information they are seeking and why it is relevant and to consider requesting information in increments through carefully tailored requests.
David Fraser, a Halifax-based privacy lawyer, said the decision reflected the "principles of minimal intrusiveness that are required by the Charter, but still ensured that the police have the ability to use production orders as a tool in appropriate circumstances."
He said while police have often dismissed concerns about telecom companies handing over customer name and address details – characterizing them as nothing more than "phone book information" – Canadian courts have increasingly recognized that such information "can go to people's biographical core."
Mr. Fraser said he was hopeful the guidelines Justice Sproat provided would be followed by police forces and courts across Canada, not just in Ontario.
Both Telus and Rogers said they take customer privacy seriously and welcomed the decision Thursday.
"Today's decision was really helpful in protecting privacy and providing guidelines to the police and courts and guidelines we can observe as well," Rogers' chief privacy officer Dave Watt said in an interview. "I think it was a big step forward."
"We think the Court has struck an appropriate balance between the need to protect individuals' privacy and the need for police to obtain information that will assist in their investigation of criminal activity," Telus chief data and trust officer Pam Snively said in a statement.
Brendan Crawley, a spokesman for the Ministry of the Attorney General of Ontario, said the ministry is reviewing the decision, adding "as the matter is currently within the appeal period, we have no further comment."