The decision has significant implications for Canadian businesses that collect and store user data, meaning just about all of them. And for Canadians online, meaning just about all of us.

The Supreme Court of Canada has ruled that a person’s IP address is privacy-protected, and that law enforcement agencies must have a warrant or court order to get a hold of that seemingly random string of numbers.

That string, the Court feels, is directly connected to our deepest selves, to our ‘biographical core’ – an interesting legal, if not psycho-social concept.

In its decision, the Court’s majority wrote that a look at our activities on the Internet can reveal more intimate details about our lives than a physical search, and so privacy rules must extend into the digital domain and protect us against unreasonable search or seizure, physical or digital.

An IP (Internet protocol) address is a required set of unique identifying numbers assigned to every connected device. That includes your phone, laptop, desktop computer, game console and more, whether the connected device is Mac, Windows, Android or iOS.

Internet Service Providers (ISPs), which make use of IP addresses to get us and all our devices online, are certainly affected by the ruling, but so too, any entity that collects, tracks or uses IP addresses to follow us online: advertising and marketing companies; online retailers, product and service providers; and an ever-expanding alphabet soup of acronyms active in our digital age and interested in our IP addresses, not just ISPs, but SEOs (search engine operators), VPNs (virtual private networks), and more.

The Court referred to an IP address as “the first digital breadcrumb” that can lead to the trail of our Internet activity. The IP address may not reveal precise personally identifying information by itself, but the Court determined it is a key to opening up details about a particular Internet user, including their online activity and their identity.

In its narrow five-four decision, the Court ruled that a “reasonable expectation of privacy” is attached to the numbers making up a person’s IP address, and just getting those numbers constitutes a search with parameters guided by law. So Canadian ISPs cannot provide basic subscriber information to police without a court order or a warrant seeking the IP address of a computer belonging to an individual or organization.

While seemingly anonymous, IP addresses can act like a personal identifier when connected to an account, subscription service or third-party company, like a or financial service provider or data aggregator; the power and ubiquity of third-party companies in the digital domain drew attention and comment from the Court.

Writing for the majority in the decision, Justice Andromache Karakatsanis explained that any meaningful protection for the online privacy of Canadians in today’s overwhelmingly digital world must include their IP addresses. “It is the key to unlocking a user’s Internet activity,” she wrote, “and, ultimately, their identity.”

That brings a reasonable expectation of privacy, she explained, based on Section 8 of the Canadian Charter of Rights and Freedoms.

Section 8 is seen as a protection for the biographical core of personal information that people should want to protect and control.

The biographical core is not limited to literal identity, lawyers have argued: it includes details of the many lifestyle choices of an individual that can be very personally revealing, and, crucially, any information which tends to reveal such details.

Those digital data breadcrumbs we sprinkle around, often without realizing it, are not the kind of generic information one used to find in the white pages of the phone directory: they are more like the desires, doubts, and intimate details we used put in our personal diary.

Now they’re in our online browsing history, our caller ID logs, our smartwatches. Our IP addresses. To paraphrase digital marketing consultant Patrick Gant (from his online post titled You are what you post), ‘online is now the outcome of all things.’

The Supreme Court of Canada’s decision, as powerful and impactful as it is, should not have come as a surprise.

More than ten years ago, Canada’s Privacy Commissioner reported that an individuals’ computer usage, particularly when linked to the Internet, made up “core biographical data” to which a reasonable expectation of privacy protection should be attached.

A May 2013 paper from the Commissioner’s Technology Analysis Branch showed that information or knowledge about a person’s online activity (such as IP addresses, but also browser history, cache files, and metadata) can be the starting point to compile a picture of an individual’s online activities and used to uncover further information about that individual.

# # #

-30-