Privacy, the Charter and judicial authorizations for data

On the evening of March 19, while Pike's phones sat sealed in the exhibit locker, Detective Park sat at her desk writing. By the next morning she had drafted an information to obtain a warrant to search both phones, three preservation demands to companies and two applications for production orders. She tells the class that people imagine cybercrime investigation as typing at a keyboard, but most of the work she did in the first week was legal writing. Every important piece of digital evidence in the case was obtained with a court's authorization or under a legal demand, and every one of them would later be scrutinized by the defence.

This lesson covers the law that governs police access to digital data: when people have a reasonable expectation of privacy in it, what authorizations police need, and what happens when they get it wrong. It is a field where the Supreme Court of Canada has decided several major cases in the last fifteen years, and where Parliament is considering new legislation.

Section 8 and reasonable expectations of privacy

Section 8 of the Charter guarantees everyone the right to be secure against unreasonable search or seizure. Since Hunter v. Southam (1984), the default rule has been that a search requires prior authorization by an impartial judicial officer, on reasonable and probable grounds, established on oath, to believe that an offence has been committed and that evidence will be found. Section 8 protects a reasonable expectation of privacy, which courts assess by looking at the subject matter of the search, whether the person had a direct interest in it, whether they had a subjective expectation of privacy, and whether that expectation was objectively reasonable in all the circumstances. Courts have held repeatedly that information revealing intimate details of a person's lifestyle and personal choices, the 'biographical core', deserves strong protection, and that digital devices and data often reveal exactly that.

Searching devices

In R. v. Vu (2013), the Supreme Court held that computers, including phones, are different from other places and receptacles because of the volume and sensitivity of the information they hold, so a warrant to search a home does not automatically authorize searching computers found there. The warrant must specifically authorize the search of computers. In R. v. Fearon (2014), the Court allowed a limited search of a cellphone incident to arrest, but only where the arrest is lawful, the search is truly incidental to it and done for a valid purpose such as officer safety, protecting evidence or finding evidence promptly where the investigation would be stymied without it, the search is tailored to that purpose, usually limited to recently sent or drafted messages, photos and the call log, and the police take detailed notes of what they examined and how. A full search of a phone needs a warrant.

Park chose not to search Pike's phone on the step, although the conversation with 'Mav' was open and he was presumably about to arrive. Rourke recorded only what was already on the screen. A tailored Fearon search for the messages about the planned pickup might have been justified if there had been reason to think other couriers were about to collect from other victims that afternoon, but there was no such information, and Park preferred a warrant that would stand up. The warrant, issued the next day, authorized the search for specified categories of data relating to the frauds between January 1 and March 19, which is why Lam wrote the scope at the top of her notes.

Data held by companies

In R. v. Spencer (2014), police asked an internet service provider, without a warrant, for the name and address of the customer using an internet protocol address that had been sharing child sexual abuse material. The Supreme Court held that the request was a search, because subscriber information linked to internet activity can reveal intimate details of a person's online life and their anonymity deserves protection. Police need lawful authority, usually a production order, to obtain such information, absent exigent circumstances or a law that clearly authorizes it. In R. v. Marakah (2017), the Court held that a person can have a reasonable expectation of privacy in text messages they sent, even when police find them on the recipient's phone. In R. v. Bykovets (2024), the Court held that an IP address itself attracts a reasonable expectation of privacy, so police needed judicial authorization to obtain the IP addresses a third-party payment company had collected from customers who used stolen card data. The Court reasoned that an IP address is the key that can unlock a person's online activity.

The Criminal Code provides a set of production orders, created in 2015. A general production order under section 487.014 requires a person to produce documents or data on reasonable grounds to believe an offence has been committed and that the material will afford evidence. Specific orders cover data that is considered less intrusive, on the lower standard of reasonable grounds to suspect: tracing a communication's path under section 487.015, transmission data such as the time, duration and numbers of calls under section 487.016, tracking data under section 487.017, and basic financial account data under section 487.018. The contents of communications and other sensitive data require the general order or a warrant, and the interception of private communications as they happen requires a much more demanding authorization under Part VI of the Code. Bill C-22, the Lawful Access Act, 2026, which passed the House of Commons in June 2026 and was before a Senate committee in November 2026, would create a new order for subscriber information on the suspicion standard; officers should check its status.

# Matching each request in the case to the authority it needs
requests = [
    ("search both seized phones", "warrant"),
    ("times and routes of incoming calls to the two victims' lines", "transmission data"),
    ("account details and IP logs of the calling service's account", "subscriber and IP"),
    ("messages stored in 'Mav' account", "content"),
]
authority = {
    "warrant": "search warrant specifically authorizing a computer search (Vu)",
    "transmission data": "transmission data order, s. 487.016, reasonable grounds to suspect",
    "subscriber and IP": "production order (Spencer, Bykovets)",
    "content": "general production order or warrant, or a foreign request",
}
for what, kind in requests:
    print(f"{what}\n   -> {authority[kind]}")

search both seized phones
   -> search warrant specifically authorizing a computer search (Vu)
times and routes of incoming calls to the two victims' lines
   -> transmission data order, s. 487.016, reasonable grounds to suspect
account details and IP logs of the calling service's account
   -> production order (Spencer, Bykovets)
messages stored in 'Mav' account
   -> general production order or warrant, or a foreign request

Each request in the case needed a different authority, with a different standard of proof, issued by a judicial officer who had to be satisfied by Park's sworn evidence. The incoming call records for Grace's and Mercer's lines showed that the calls had not come from the local numbers displayed on their phones. They had entered the phone network through a voice over internet protocol provider, and both sets of calls had come through the same customer account at that provider. That was the first evidence linking Grace's case to the network Pike worked for.

Writing the application

An application for a warrant or order must be full, fair and frank. It must set out the facts that establish the required grounds, identify the sources of information and their reliability, and disclose facts that might cut against the application, such as information that another person might be responsible. It must describe precisely what is to be searched or produced and for what time period, so that the authorization is no broader than the grounds justify. For devices, it should explain what kinds of data are sought and why, and may propose a search protocol. Boilerplate paragraphs copied from other applications, assertions not tied to the facts of the case, and failures to disclose unhelpful facts are the most common reasons digital warrants are later found defective.

Desjardins reminds the class of the consequences. Evidence obtained in breach of section 8 may be excluded under section 24(2) if its admission would bring the administration of justice into disrepute, applying the Grant analysis described in the evidence course. Digital privacy breaches are often treated as serious because of the sensitivity of the information, but good faith reliance on a warrant that turns out to be defective, or on settled law that later changes, weighs in favour of admission.

Consent and exigent circumstances

Police can sometimes obtain data without a warrant through valid consent or in an emergency. Consent must be voluntary and informed, given by a person with authority over the data, and can be limited or withdrawn. A victim like Owen can consent to an examination of their own phone, limited to the relevant conversation. A roommate generally cannot consent to a search of another person's phone. Providers may disclose data voluntarily in emergencies involving a risk of death or serious injury, and the Criminal Code and federal privacy law allow it. Exigent circumstances allow police to act without a warrant only where there is an urgent need, such as an imminent threat to someone's safety or the imminent destruction of evidence, and only as far as the urgency requires.

Real-time access and tracking

Real-time access to communications and locations is more intrusive than access to stored records, and the law treats it accordingly. Intercepting private communications as they happen requires an authorization under Part VI of the Criminal Code, available only for listed offences and only where other investigative methods have been tried and failed or are unlikely to succeed. In R. v. TELUS Communications (2013), the Supreme Court held that police could not use a general warrant to obtain text messages from a provider prospectively, as they were sent, because that was in substance an interception requiring a Part VI authorization. Tracking a person's phone or vehicle in real time requires a tracking warrant under section 492.1, and recording the numbers dialed and received as calls happen requires a transmission data recorder warrant under section 492.2. Each has its own standard and time limit. None of these powers was needed in the Pike investigation, because the evidence was in stored records, but Desjardins says officers should know where the lines are so they do not cross them by accident, for example by asking a provider to send new messages as they arrive.

Notes, returns and disclosure

Every authorization creates paperwork that the defence will see. Officers must keep notes of when and how each warrant or order was executed, what was obtained, and any problems. Many warrants and orders require a report to a justice after execution, and the information to obtain and the results must be disclosed to the defence, subject to editing to protect informants or ongoing investigations. Park keeps a single table for each file listing every request to a company, the authority used, the date sent, the date records were received, their hash values and where they are stored. She says that table has answered more defence questions than any other document she has written.

Desjardins adds that the scope of an authorization should be read narrowly in practice. If an examiner searching a phone under a fraud warrant comes across evidence of a different offence, the safe course is to stop and obtain a further warrant, rather than keep looking under the original one.