On January 14, 2016, a judge of the Ontario Superior Court of Justice issued a series of guidelines for future production orders directed to telecommunications companies for cell tower data. Although the guidelines focus specifically on the test for a production order of cell tower data under the Criminal Code (Canada) and only apply in Ontario, Justice Sproat’s reasoning may influence how courts approach production orders for other types of data if the decision is not appealed and the guidelines are accepted by other courts.
An Easy Case?
The guidelines issued by Justice Sproat in R. v. Rogers Communications Inc., 2016 ONSC 70 arose out of a case in which the police clearly sought overbroad and onerous production orders. The respondent telecommunications companies, who would have had to produce the data, applied to set the production orders aside. Although the police attempted to withdraw the order, the court allowed the respondent telecommunications companies to continue with their application. Moreover, the court found that the telecommunications companies had standing to defend the privacy interests of their customers. It is disappointing that the government lawyers would have attempted to argue otherwise.
The production orders that were at issue were obtained under what was then s. 487.012(1) of the Criminal Code (this provision was replaced with a new suite of production order provisions as a result of amendments in 2014). This provision allowed a court to issue an order requiring a person to produce documents or data or to prepare and produce a document based on data that is already in existence. In order to obtain a production order, s. 487.012(3) required the applicant police to demonstrate that the there are reasonable grounds to believe that:
- a criminal offence has been or is suspected to have been committed;
- the documents or data sought will afford evidence respecting the commission of the offence; and
- the person who is subject to the order has possession or control of the documents or data.
Although s. 487.012 has been replaced, these elements still are part of the test under the new production order provisions.
The production orders obtained by Peel Region Police (which covers an area west of Toronto) were sweeping and would have, if fulfilled, resulted in personal information of more than 41,000 mobile subscribers being disclosed to the police. Why did the police want all of this information? The police were investigating a series of robberies. They wanted information about subscribers who were within the vicinity of the robberies during the period of time in which the robberies occurred. Because mobile phones are constantly checking in with cell phone towers and because a record is created of every call or text, the police sought the data from these cell phone towers. This data could be used to find individuals who appeared to be near the robbery locations. However, mobile phones do not necessarily connect with the closest tower if there are obstructions or the load on that tower is high. Therefore, multiple towers might need to be checked for any single location.
In this case, the police wanted data from more than 37 cell towers. The telecommunications companies estimated that the records of more than 41,000 subscribers would be involved. The police wanted the name, address, and billing information (which could include bank and credit card information) from all of these subscribers. Of course, the vast majority of these individuals would be completely innocent. The production order was indiscriminate and did not limit the use that the police could make of this information to the specific case they were investigating.
The Guidelines
Ultimately, the court concluded that subscribers have a reasonable expectation of privacy in their records. The production orders that were sought were so overbroad that they were not constitutional. It was not even clear how all of the data (e.g. the billing data) was relevant to the investigation.
What is most interesting about the case, however, is that the parties asked the court to issue guidelines for these types of production orders. After hearing submissions on appropriate guidelines, the court issued the following guidelines to police seeking future production orders of cell tower data:
- Adherence to Constitutional Safeguards. The police officer seeking the production order must state that he or she is aware of the privacy protective principles of seeking a minimally intrusive data set to support the particular stage of the investigation and that the police can seek incrementally broader orders if justified. The police officer must also state that he or she has tailored the requested production order with those principles in mind.
- Rational Connection between the Scope of the Order and the Investigation. The police officer must explain why the temporal and geographic parameters are relevant to the investigation, as is required under what is now s. 487.014(2)(b) of the Criminal Code. In other words, the police officer must justify the number of cell tower locations and the period of time over which they seek data.
- Rational Connection between the Content of the Data and the Investigation. The police officer must explain why the types of records being sought are relevant to the investigation, as is required under s. 487.014(2)(b) of the Criminal Code.
- Parameters that May Allow for a Narrower Search. The police officer should provide any details that may assist in the telecommunications company refining and narrowing the search. For example, if the police have information on the length of a call, this could assist in narrowing the data produced.
- Reports Rather than Raw Data should be the Default. A production order to produce a report from data in the possession of a telecommunications service provider is preferable to the production of raw data because it may minimize the amount of data relating to innocent individuals that is produced to the police.
- Raw Data Requests must be Justified. If raw data is requested, the police officer must explain why a report from the telecommunications service provider is not sufficient and the raw data is required.
- Manageable Data Set. The police officer must confirm that the data requested can be meaningfully reviewed. This is to avoid the impulse to ‘just get everything’ and then decide what can be done with it.
The idea that a report, rather than raw data, should be the norm may not be popular with all recipients of production orders. This could be potentially onerous in itself and, in some cases, may place recipients of these production orders in the position of performing investigative work on behalf of the police.
Implications
Justice Sproat’s guidelines apply specifically to cell tower data. Therefore, telecommunications service providers receiving production orders should consider reviewing those orders against the guidelines to avoid compromising the privacy of their subscribers’ data by responding to unconstitutional production orders.
However, other organizations may also wish to take note. The guidelines may have broader application. The amended production order provisions that were enacted in 2014 in ss. 487.014 to 487.0192 of the Criminal Code apply to other information than just to cell tower data. For example, s. 487.016 governs the production of transmission data, which includes information regarding the routing and addressing of emails over the Internet. The same concerns about overbreadth could apply in other contexts. The guidelines are sufficiently flexible to apply to production orders in this context as well.
Time will tell.
…