Ontario Court of Appeal Recognizes Expectation of Privacy in Energy Consumption Data

On August 10, the Ontario Court of Appeal released its decision in R. v. Orlandis-Habsburgo (Orlandis).¹ This case builds on R. v. Spencer, a decision of the Supreme Court of Canada, which considered law enforcement requests for internet subscriber data.² In Orlandis, the Court held that a utility sharing residents' energy consumption data with police, which led to a search and criminal charges, violated their reasonable expectation of privacy.

Although it arose in a criminal context, the Court of Appeal's comments in Orlandis about the reasonable expectation of privacy in seemingly low sensitivity information such as electricity use will have consequences for private sector organizations. The decision will add to the body of jurisprudence that informs regulators' and courts' interpretations of companies' compliance with privacy law when voluntarily disclosing information about employees or customers to police.

What You Need to Know

• The decision in Orlandis has implications for private sector and public sector organizations that collect personal information that may be of interest to police. Orlandis also has implications for employers that monitor information stored or sent on employer-issued or personal devices used by employees to perform their job. In particular, the Ontario Court of Appeal has made it clear that privacy law exceptions that allow disclosure to police without consent of the data subject cannot be interpreted so broadly as to negate the purpose of protecting individuals' privacy.
• The Court recognized an organization may disclose information to police on its own initiative when it has reasonable grounds to believe the information relates to a crime. However, organizations should have clear and consistent policies for disclosing personal information that comply with the legislative disclosure exceptions and the reasonable expectation of privacy of customers, users or employees. An informal information-sharing arrangement with the police will not meet the requirements of statutory law enforcement exceptions.
• Organizations that wish to make voluntary disclosures of personal information to police should document the basis for the legislative exemption and keep thorough records of the facts and law supporting the belief the information relates to criminal activity. In most cases, this will require the organization to conduct a thorough internal investigation and engage legal counsel prior to disclosing any personal information to a government institution.

Reasonable Expectation of Privacy

In Orlandis, tenants of a home in Ontario operated a marijuana grow-op. Their energy provider, noting a pattern of electricity use consistent with the operation of a grow-op, forwarded information about the electricity consumption to police. Personnel of the utility had developed an informal arrangement whereby the energy provider would share energy consumption information with the police when it observed a suspicious pattern of energy consumption. Using the information provided by the utility, the police obtained a search warrant for the residence, found marijuana plants and charged the residents with various criminal offences.

On appeal, the accused argued the police violated their right under Section 8 of the Charter to be free from unreasonable search and seizure when they acquired energy consumption data from the energy provider without their consent or prior judicial authorization. The Court held that the examination and use of the data by the police was not authorized by law, but ultimately refused to exclude the evidence obtained in the search.

In deciding the Charter argument, the Court of Appeal held that there is a reasonable expectation of privacy in energy consumption data because it is information capable of supporting inferences that certain activities are occurring inside a home. Since the subject matter of the search included both the raw data and the inferences that can be drawn from that data, the accused had a reasonable expectation of privacy in the energy consumption information.

Scope of Law Enforcement Exemptions in Privacy Law

The Court went on to make comments that may restrict the scope of the disclosure provisions of the Municipal Freedom of Information Protection of Privacy Act³ (MFIPPA) and the federal Personal Information Protection and Electronic Documents Act⁴ (PIPEDA). Both acts prohibit disclosure of personal information without consent, but contain exceptions permitting disclosure of personal information to the police in prescribed circumstances.

First, the Court considered the exception in section 7(3)(c.1)(ii) of PIPEDA, which permits disclosure without consent to a government institution that discloses its lawful authority to obtain the information. Following the decision in Spencer that restricted the scope of lawful authority that will meet this requirement, the Court of Appeal held that the informal information-sharing arrangement between the energy provider and the police failed to conform with that requirement.

Second, the Court found the exception in section 7(3)(d)(i) of PIPEDA, which allows an organization on its own initiative to disclose personal information to a government institution on "reasonable grounds to believe that the information relates to a contravention of the laws of Canada," does not permit informal information sharing with police. The Court commented that an organization could develop a formal policy permitting disclosure—on its own initiative—of energy consumption data or other information in the circumstances prescribed by that Section, but did not weigh in on the elements of a such a policy or the level of certainty required to establish "reasonable grounds" for the belief.

Third, in assessing the law enforcement exception in MFIPPA, the Court noted the MFIPPA exception seems broader than the exception in PIPEDA in that it does not require the police identify a source of "lawful authority" to obtain the information. Rather, section 32(g) of MFIPPA permits disclosure by a public institution to police "to aid an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result." There is no statutory requirement that the organization has reasonable grounds to believe the information relates to a crime, or that the information has been formally demanded by police. However, the Court of Appeal narrowed the interpretation of MFIPPA to align with PIPEDA. The Court emphasized the purpose of MFIPPA, like PIPEDA, is to protect privacy, and that purpose would be negated by an overly broad reading of the exceptions to the requirement for consent to disclose personal information. Accordingly, the Court held that section 32(g) does not contemplate an ongoing arrangement for sharing of personal information with police, but rather calls for the public institution to make an independent and informed judgment in exercising its discretion to release the information in response to a specific request for the information in the context of a specific criminal investigation.

Summary

The comments on the scope of legislative provisions permitting disclosure to law enforcement without the consent of the data subject suggest organizations cannot simply pass on suspicious information or tips. The Court of Appeal's decision in Orlandis suggests there is a heavy burden on both private sector organizations and public institutions to make independent factual and legal decisions that personal information of any level of sensitivity is evidence of criminal activity before providing such data to police. Canadian organizations would be prudent to review and update internal procedures for investigating potential unlawful activity and sharing information about employees or customers with law enforcement.

_________________________

¹ 2017 ONCA 649.

² 2014 SCC 43.

³ R.S.O. 1990, c. M. 56.

⁴ S.C. 2000, c. 5.