Police & Customer Data

In the digital age, where all of our online interactions are mediated by a range of private entities, companies hold troves of personal data about our most intimate interactions.

Yet, under the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal privacy legislation, private companies are permitted to disclose personal information to government agencies without meaningful safeguards.

While our Charter places limits on when government agencies are allowed to request personal information from companies, sensitive information is often obtained without a court order or any obligation to notify customers that their personal data has been disclosed.

Under certain circumstances, PIPEDA even prohibits companies from informing individuals that their data has been requested.

With so much sensitive data in the hands of private companies, we need rigorous accountability measures in place to ensure government requests are complying with the law.

The framework created by PIPEDA allows companies to share sensitive information with police in the absence of meaningful safeguards, raising serious privacy concerns.

In practice, there are few accountability measures to ensure these disclosures are lawful. Most individuals are never aware that their personal information has been shared, and won’t be unless they proactively ask their service provider, and even then the government can block the request.

Under this framework, phone and Internet companies (Telecommunications Service Providers or TSPs) shared large volumes of basic subscriber information with government agencies for years.

Basic subscriber information is information that helps identify anonymous Internet or phone users. For years, law enforcement agencies and TSPs had decided that this type of customer identifying information was not private, laying the groundwork for a large-scale information-sharing program.

The full scope of the historical program is not known, but in one instance, TSPs reported that on average they were receiving over 1 million requests for basic subscriber information every year. Only a fraction of these requests were ever scrutinized in court.

Then, in 2015, the Supreme Court of Canada ruled in R v Spencer that basic subscriber information is highly sensitive because it reveals otherwise anonymous online activity. Anonymity is integral to maintaining any semblance of privacy in the digital age.

The Spencer decision prevented some government requests for basic subscriber data. But it did not fix the underlying framework that had allowed so much sensitive data to be shared with the government—a framework where private companies and the government effectively decide what is and is not allowed in the majority of instances.

Today, government agencies continue to request information on tens of thousands of TSP customers every year, while a growing list of other companies are also subject to this regime, including payment processors, social media platforms and email providers. Newly introduced legislation (Bill C-2, the Strong Borders Act, introduced June 2025) could further expand police requests for information under this regime, making the need for an appropriate framework all the more urgent.