Rogers surprised many yesterday by becoming the first major Canadian telecom provider to release a transparency report (TekSavvy, a leading independent ISP beat them by a few hours in issuing a very detailed report on its policies and activities). The company was rightly lauded for releasing the report, which seems likely to end the silence among all Canadian telecom companies. Telus now says it is working on a transparency report for release this summer and it is reasonable to guess that others will follow.
Much of the focus on the report came from its big number: nearly 175,000 requests for subscriber information last year. Yet requests for information is only part of the story. The report only contained data on requests for information with no numbers on how many times the company disclosed the information to the authorities upon request. The reason for the omission is shocking admission: Rogers says it has not tracked when it discloses subscriber information in response to these requests. When asked how often authorities’ requests were granted, the company stated:
â€œWe don’t keep track of it. Our tracking to date has really been for internal management purposes, not for creating a transparency report. So that’s something we’re going to look to expand in the future and hopefully provide more information in the future.“
The claim that Rogers only tracks in-bound requests and not out-bound data is hard to believe. The reason may be financial – the “internal management purpose” may be to charge a fee to law enforcement for the process. Further, the company says that if it considers an order too overbroad, it will “push back and, if necessary, go to court to oppose the request.” Is it really possible that the company has no records of when it has gone to court to oppose a request?
[Update 7/6/14: Rogers has provided a private response in which it indicates that it does have records of individual responses to requests for subscriber information, but that it does not track aggregate numbers. Further, it does know the number of times it went to court, but did not include that information in the transparency report.]
Tracking disclosures of subscriber information should not be viewed as optional. Privacy law gives individuals a right of access to their information:
Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information.
The statute continues at 4.9.3:
In providing an account of third parties to which it has disclosed personal information about an individual, an organization should attempt to be as specific as possible. When it is not possible to provide a list of the organizations to which it has actually disclosed information about an individual, the organization shall provide a list of organizations to which it may have disclosed information about the individual.
If Rogers is not tracking disclosures, the approach raises privacy compliance concerns. Moreover, this helps explain why it does not notify customers that their information has been disclosed since it does not seem to track the information itself. title