Skip to main content

Landmark Canadian Privacy Cases

Supreme Court of Canada decisions, appellate rulings, and Privacy Commissioner investigations that shape how privacy law is applied across the country.

Case summaries are for general information and are not legal advice. The full decision is the authority, and how a case applies to a particular situation is a question for a lawyer.

Supreme Court of Canada 1984 Charter section 8 and the reasonable expectation of privacy

Hunter v. Southam

Hunter v. Southam Inc., [1984] 2 SCR 145

Facts: Federal investigators entered newspaper offices under the Combines Investigation Act without prior judicial authorization. Southam challenged the search as unreasonable.
Holding: Section 8 of the Charter protects a reasonable expectation of privacy. A warrantless search is presumptively unreasonable. Prior authorization by a neutral arbiter, on reasonable and probable grounds, is the default constitutional standard for searches.
Why it matters: This is the foundational Charter privacy decision. Every subsequent Canadian search and seizure case traces back to the reasonable expectation of privacy framework established here.
Read the full decision
Supreme Court of Canada 2014 Anonymity and subscriber information from internet service providers

R v. Spencer

R v. Spencer, 2014 SCC 43

Facts: Police obtained Spencer's name and address from his ISP without a warrant by matching an IP address to his subscriber account. The question was whether Canadians have a reasonable expectation of privacy in subscriber information tied to online activity.
Holding: Yes. There is a reasonable expectation of privacy in the identity of an internet subscriber when it is linked to their anonymous online activity. Warrantless disclosure by the ISP to police was a search under section 8.
Why it matters: Spencer recognized anonymity as a privacy interest protected by the Charter and is the leading case on ISP subscriber disclosure and online privacy in Canada.
Read the full decision
Supreme Court of Canada 2017 Privacy in text messages after they are received

R v. Marakah

R v. Marakah, 2017 SCC 59

Facts: Police seized an accomplice's phone containing text messages Marakah had sent. The Crown argued he lost any privacy interest once the messages were delivered.
Holding: A sender can have a reasonable expectation of privacy in text messages even after they are received by the recipient. The totality of the circumstances test still governs and control of the device is only one factor.
Why it matters: Marakah is the leading case on privacy in digital communications and is cited in nearly every challenge to cell phone or messaging evidence.
Read the full decision
Supreme Court of Canada 2019 Reasonable expectation of privacy under the voyeurism offence

R v. Jarvis

R v. Jarvis, 2019 SCC 10

Facts: A high school teacher used a pen camera to record female students in hallways and classrooms. The defence argued students had no privacy expectation in semi-public school spaces.
Holding: The reasonable expectation of privacy for voyeurism is contextual. Students in a school setting retain a privacy interest in not being surreptitiously recorded for a sexual purpose, even in locations visible to others.
Why it matters: Jarvis established that privacy is not lost simply because a person is in public view. The decision now shapes analysis of surveillance in workplaces, schools, and public spaces.
Read the full decision
Supreme Court of Canada 2024 Reasonable expectation of privacy in IP addresses

R v. Bykovets

R v. Bykovets, 2024 SCC 6

Facts: Police asked a payment processor for the IP addresses associated with suspicious transactions, then used those IPs to request subscriber information. The question was whether police needed judicial authorization for the IPs themselves.
Holding: Yes. Canadians have a reasonable expectation of privacy in IP addresses. Obtaining an IP address from a third party without a warrant engages section 8 and is a search.
Why it matters: Bykovets extends Spencer from subscriber identity to the IP address itself and is changing law enforcement practice around requests to third parties.
Read the full decision
Ontario Court of Appeal 2012 Recognition of the tort of intrusion upon seclusion

Jones v. Tsige

Jones v. Tsige, 2012 ONCA 32

Facts: A bank employee accessed the banking records of her partner's ex-wife at least 174 times over four years. The plaintiff sued for breach of privacy.
Holding: Ontario recognized the common law tort of intrusion upon seclusion. Elements: intentional or reckless conduct, intrusion into private affairs, and a reasonable person would regard the intrusion as highly offensive. Damages are capped around CAD 20,000 where no pecuniary loss is shown.
Why it matters: Jones created a private law remedy for privacy breaches in Ontario and influenced tort recognition across several provinces. It is the foundation of most civil privacy claims in Canada.
Read the full decision
Ontario Superior Court of Justice 2016 Public disclosure of private facts and non-consensual intimate images

Jane Doe 464533 v. N.D.

Jane Doe 464533 v. N.D., 2016 ONSC 541

Facts: An ex-boyfriend posted an intimate video of the plaintiff online without her consent. She sued for privacy torts.
Holding: The court recognized a new tort of public disclosure of embarrassing private facts, grounded in the same policy as Jones v. Tsige, and awarded damages on a default judgment. That judgment was later set aside so the defendant could defend; the tort was then confirmed after a full trial in Jane Doe 72511 v. N.M., 2018 ONSC 6607.
Why it matters: This decision opened a civil avenue for victims of non-consensual intimate image distribution, complementing Criminal Code section 162.1 and provincial image-based abuse statutes.
Read the full decision
Office of the Privacy Commissioner of Canada 2021 Mass scraping of facial images to build a biometric database

Clearview AI Joint Investigation

PIPEDA Findings # 2021-001 (joint investigation with AB, BC, QC)

Facts: Clearview AI scraped over three billion images from the public internet, extracted biometric identifiers, and sold access to law enforcement. Four Canadian privacy regulators investigated jointly.
Holding: Clearview AI's practices were mass surveillance and clearly contrary to PIPEDA and provincial private-sector privacy laws. The federal Commissioner recommended that Clearview stop collecting images of people in Canada and delete those it held; the Alberta, BC and Quebec regulators, which have order powers, later issued binding orders to that effect.
Why it matters: This is the leading Canadian regulatory statement on facial recognition and shaped subsequent guidance on biometric processing, AI training data, and consent.
Read the full decision
Office of the Privacy Commissioner of Canada 2020 Covert facial recognition in shopping malls

Cadillac Fairview

PIPEDA Findings # 2020-004 (joint investigation with AB, BC)

Facts: Cadillac Fairview used cameras with facial analysis technology in wayfinding directories at Canadian malls, collecting biometric information from roughly five million shoppers without meaningful consent.
Holding: The collection was unlawful. Notice was inadequate and consent was not meaningful. Cadillac Fairview had already ended the pilot and deleted the biometric data by the time of the findings, and the regulators' remaining concern was its refusal to commit to express opt-in consent for any future use.
Why it matters: A high-profile reminder that brick-and-mortar businesses using video analytics must meet the same consent and transparency standards as online services.
Read the full decision
Information and Privacy Commissioner of Ontario and Office of the Information and Privacy Commissioner for BC 2020 Breach of sensitive health information of millions of Canadians

LifeLabs Data Breach

IPC Ontario and OIPC BC joint investigation report (June 25, 2020)

Facts: A 2019 cyberattack exposed personal and health information of approximately 8.6 million LifeLabs customers (LifeLabs' initial estimate was up to 15 million), including test results. The company made payments to the attackers but the data had already been taken.
Holding: LifeLabs failed to meet its duties under Ontario's PHIPA and BC's PIPA to safeguard personal information and to deploy adequate information technology security. The commissioners ordered remediation, improved controls, and reporting.
Why it matters: A benchmark Canadian health-sector breach case. The investigation shaped expectations on ransomware response, encryption, and vulnerability management for custodians of sensitive data.
Read the full decision
Office of the Privacy Commissioner of Canada 2020 Insider data theft affecting millions of members

Desjardins Breach

PIPEDA Findings # 2020-005 (joint with the Commission d'accès à l'information du Québec)

Facts: A Desjardins employee exfiltrated the personal information of about 9.7 million members and shared it outside the organization over several years before detection.
Holding: Desjardins did not have adequate safeguards against insider threats. Extensive remediation and long term monitoring commitments were required.
Why it matters: Treated as the modern Canadian baseline for insider threat controls, access governance, and breach notification expectations.
Read the full decision
Supreme Court of Canada 2017 Global de-indexing order against a non-party search engine

Google v. Equustek

Google Inc. v. Equustek Solutions Inc., 2017 SCC 34

Facts: A British Columbia court ordered Google to de-index a defendant's websites worldwide. Google argued a Canadian court could not impose global internet orders on a non-party.
Holding: The Supreme Court upheld the global injunction. Canadian courts can order a worldwide de-indexing remedy where it is the only effective way to prevent ongoing harm.
Why it matters: An important Canadian decision on jurisdiction over online intermediaries and a reference point in later debates about right to be forgotten and takedown orders.
Read the full decision
Supreme Court of Canada 2019 Privacy expectations in online conversations with a stranger police officer

R v. Mills

R v. Mills, 2019 SCC 22

Facts: Police posed as a 14 year old child online. Mills engaged in sexual conversations and was charged with child luring. He argued his communications were private.
Holding: There was no reasonable expectation of privacy in communications with a stranger who turned out to be an undercover officer, on the specific facts. The decision is narrow and does not displace Marakah.
Why it matters: Mills clarifies that Marakah is not absolute. Courts still apply the totality of the circumstances test and the identity of the recipient can matter.
Read the full decision
Supreme Court of Canada 2018 Third party consent to seize a shared home computer

R v. Reeves

R v. Reeves, 2018 SCC 56

Facts: Reeves's spouse consented to police seizing a shared home computer. Police later found child pornography. The question was whether the spouse could waive Reeves's privacy interest.
Holding: A co-user's consent cannot waive another co-user's reasonable expectation of privacy in a shared personal computer. Police needed prior judicial authorization.
Why it matters: Reeves is the leading case on shared device privacy and restricts when police can rely on third party consent for electronic devices in the home.
Read the full decision

How to read a Canadian privacy case

Canadian privacy law pulls from three streams: constitutional protection under Charter section 8, statutory protection under federal and provincial privacy acts, and common law torts like intrusion upon seclusion. When reviewing a decision, identify which stream is in play, the specific legal test applied, and the factual context. A holding in a criminal case may not carry over directly to a private-sector dispute.

Start with our Learn the law primers
Ask AI