Questions and answers to frequently asked questions
- What is anonymity?
- Why is online anonymity important?
- Are you anonymous on the Internet?
- Is anonymous speech or action a right in Canada?
- Can you sue someone without knowing their name in Canada?
- What are the typical claims behind a request for subscriber information?
- What is the process by which someone can get subscriber information from an ISP?
- What is the test for a court order requiring disclosure of subscriber ID?
- Does an ISP have the right to disclose the identity of a subscriber without a court order?
- What right of action does an Internet subscriber have if their personal information is released without a court order?
- I signed a confidentiality/privacy agreement with my ISP that provides that they will not release my information. Doesn't that protect me?
- What should I do if I receive notice that my ISP has received a motion for a court order to disclose my personal information? What are my rights of action?
- How much time would I have to try to fight a motion for a court order?
- What should I do if I find out that my ISP has received an order to disclose my personal information?
- Can someone ask for my identity even if I am not the Defendant in the case?
- I don't know whether my ISP keeps track of web sites I've visited or other personal online activity. Could a court order require disclosure of information like that?
Most broadly, anonymity is a state in which we can disengage our activity from our identities. Dictionaries generally define it as a state of being unknown through lack of identification, personality or individuality. This definition is based on anonymity's origins as a protection for authors and their writings.
Anonymity on the Internet allows people to engage in legitimate and often socially beneficial activities that they wouldn't otherwise engage in for fear of embarrassment, social ostracism, retribution or persecution. For example, communicating under a pseudonym allows individuals to explore their creative side, human rights workers to communicate with each other, employees to "blow the whistle" on harmful corporate practices, members of persecuted minorities (such as gays) to share experiences, and consumers to search for information on sensitive topics such as sexually transmitted diseases, hair loss, or incest without concern about disclosing their identity to others. The ability to browse the Internet anonymously also keeps personal data about what we do out of the hands of intrusive marketers and governments. As a judge in Ontario noted:
"In keeping with the protocol or etiquette developed in the usage of the internet, some degree of privacy or confidentiality with respect to the identity of the Internet protocol address of the originator of a message has significant safety value and is in keeping with what should be perceived as being good public policy." (Wilkins J., in Irwin Toy Ltd. V. Doe  O.J. No.3318, S.C.J.)
Unless you take specific measures to protect your anonymity, you are not anonymous on the internet. This is for two reasons: First, your ISP may keep logs of what sites your Internet Protocol (IP) address visited on the Internet. Your IP address is the identification given to your machine each time you log onto the Internet. This means that your actions on the Internet are not invisible to your ISP. Secondly, the websites you visit may be tracking the IP addresses of their visitors. Although a website owner will not know your particular name through your IP address, it is not very difficult for him to match your IP address to the ISP you are subscribed to.
The only way to be anonymous on the Internet is to use technology such as anonymous web browsing, which allows users to surf the Internet with their IP address hidden. See the links section for examples of anonymous browsing technology.
There is no general right to anonymity in Canada. However, the Supreme Court of Canada has found that individuals have a right to a reasonable expectation of privacy in certain contexts, including the publication of photographs taken of individuals in public (Aubry v. Editions Vice-Versa  1 S.C.R. 591), and warrantless searches by police (R v. Plant  3 S.C.R. 281). Courts may also grant a party in a court case the right to remain anonymous if there is a compelling reason such as a threat to one's life or safety (e.g., John Doe v. Roe,  A.J. No. 411).
It should also be noted that s.14.1 of Canada's Copyright Act gives authors the right to remain anonymous in connection with the publication of their works.
There is little reported caselaw in Canada on the issue of online anonymity. In the Ontario case referred to above, the court ordered an ISP to disclose the identity of a subscriber accused of defamation, noting however that there are important safety and public policy reasons for respecting online anonymity, and that disclosure of subscriber identities
"should [therefore] not be automatic upon the issuance of a Statement of Claim": Irwin Toy  O.J. No. 3318 (S.C.J),.
On the other hand, in a 1997 administrative ruling, Elections Canada ordered the take-down of a political website because it violated the Canada Elections Act by not disclosing the person responsible for the website.
Yes. Such suits are referred to as "John Doe" lawsuits because they substitute the name "John Doe" or "Jane Doe" for the actual defendant's name. In Internet or email situations, a lawsuit can be launched against an unnamed defendant, leaving identification for a later stage of the proceeding. The identity of a defendant can be discovered if any of the following information is known:
- IP address
- email provider
- ISP provider
- web site host provider
- anonymous remailer provider
The Rules of Procedure of each court set out a process and test for obtaining subscriber information from third parties such as an ISP or website hosts.
Typical claims underlying John Doe lawsuits are defamation or infringement of intellectual property rights such as trademark or copyright.
A complainant may first attempt to get the subscriber information by simply asking the ISP for it. However, most ISPs will be reluctant to give out this information without a court order. The complainant will then have to issue a claim against "John Doe" (at which point they become a "plaintiff"), and will then have to ask the court for an order requiring the ISP to disclose the identity of "John Doe".
The complainant will typically not sue the ISP. Instead, they will attempt to get subscriber information from the ISP as a third party. Each court has its own rules for requesting and obtaining such orders against third parties. (Note that in Canada, these orders are not called "subpoenas" as they are in the United States.) The request will be made via a "motion" (an application to the Court either in person or in writing). Ordinarily, such motions must be served on opposing parties. Again, different rules apply in different courts, but motions must typically be served on those who will be affected by the order - in this case, the ISP and the subscriber. Those who are served must be given an opportunity to be heard before an order is issued. However, because the defendant's identity is unknown, he or she cannot be served. Therefore, in this situation, the ISP will normally be served since the motion is for an order requiring the ISP to disclose the information, and it will be up to the ISP to inform their subscriber of the request.
In some cases, the plaintiff may try to obtain an order for disclosure of subscriber ID without giving the ISP an opportunity to respond. The plaintiff will have to convince the court that the order should be given without informing the ISP in advance.
In either case, the subscriber may not be aware of the process until the order is made. ISPs are required to comply with court orders for disclosure of subscriber ID.
In Ontario, courts may order ISPs to disclose subscriber information where it would be unfair to require the plaintiff to proceed to trial without the subscriber's identity. (Rule 30.10). Courts may also allow a plaintiff to cross-examine an ISP in order to get information about its subscriber, as long as the plaintiff can't get that information from another source, it would be unfair to require the plaintiff to proceed to trial without the subscriber's identity, and the examination will not cause undue delay, entail unreasonable expenses for other parties, or result in unfairness to the ISP. (Rule 31.10) In one of the few reported cases on point, an Ontario judge also required that the plaintiff make out a prima facie case against the defendant - i.e., whether the allegations appear, upon an initial review of the facts and law, to have merit - before ordering the ISP to disclose the name of a subscriber. (Irwin Toy v. Doe  O.J. No. 3318 (S.C.J)).
Under the Personal Information Protection and Electronic Documents Act (PIPEDA), an ISP is not permitted to disclose a subscriber's personal information without the subscriber's knowledge and consent, except in certain specified circumstances, including: " where required by court order; " where required by law " to certain named "investigative bodies" where the information relates to a suspected breach of law or contract, or " to government organizations who request the information for such purposes as law enforcement, national security, or the administration of law.
However, an ISP may have obtained subscriber consent to such disclosure through its terms of service or contract with the subscriber. Whether or not such consent is meaningful and therefore valid in law will depend on how clear and obvious it is to subscribers.
What right of action does an Internet subscriber have if their personal information is released without a court order?
A subscriber whose identity was disclosed by an ISP without a court order could argue:
- Breach of contract if the ISP promised in its term of service or otherwise represented that they would not disclose a subscriber's identity, or
- Breach of the Personal Information Protection and Electronic Documents Act , if the subscriber did not consent to such disclosure.
In the former case, the action would be launched in provincial court. In the latter case, the subscriber could complain to the federal Privacy Commissioner under the PIPEDA.
I signed a confidentiality/privacy agreement with my ISP that provides that they will not release my information. Doesn't that protect me?
Not entirely. Such agreements protect you from voluntary disclosures by your ISP, but not from court orders. If an ISP is served with a court order, they are required by law to disclose your personal information in accordance with the order.
What should I do if I receive notice that my ISP has received a motion for a court order to disclose my personal information? What are my rights of action?
First you should decide whether you wish to fight to protect your identity, Internet usage records, or whatever else is being sought. You should ask your ISP for a copy of the motion if they haven't already provided one. If you decide to fight it, you should inform the ISP immediately and, if necessary, request that it ask the court to delay arguments on the motion in order to give you time to find a lawyer.
Not very long. Generally, the time lines for responding to a motion for a court order are very short (less than a week). This means that you should contact a lawyer right away if you want to challenge the motion for disclosure of your identity.
What should I do if I find out that my ISP has received an order to disclose my personal information?
The ISP may be unlikely to fight the court order themselves. If you decide to challenge the court order, you should inform the ISP immediately and request that it delay compliance until you find a lawyer and bring your challenge to the court. In the best of circumstances, however, you will not have more than a few days to bring your challenge.
Possibly. Under the Ontario Rules of Civil Procedure (rule 30.10), a plaintiff seeking such disclosure would have to prove that revealing your identity is relevant to their case and that it would be unfair to require them to go to trial without knowing your identity.
I don't know whether my ISP keeps track of web sites I've visited or other personal online activity. Could a court order require disclosure of information like that?
Yes. Your ISP may keep logs which show the internet usage activity of subscribers by IP address. Unless you use an ISP which destroys its internet usage records (and most ISPs keep them for legal and security purposes), your ISP will have a log of your activities. Therefore a court order could ask for information about what websites you visited.
In order to preserve your privacy and to prevent your ISP from knowing what websites you visited, you can use an anonymous browsing service such as Anonymizer.com (see links below). These clients work by routing your internet requests through their own servers, so in effect you have a middle man between you and the website you visit. Most anonymous services delete their internet usage logs daily, so that they cannot be asked to produce them for any court procedures.
FAQ researched and compiled by Milana Homsi and Andy Kaplan-Myrth (original document).
This FAQ is licensed under a Creative Commons License.