Wiertz Sebastien - Privacy by Sebastien Wiertz (CC BY 2.0) https://flic.kr/p/ahk6nh

Wiertz Sebastien - Privacy by Sebastien Wiertz (CC BY 2.0) https://flic.kr/p/ahk6nh

Privacy

Why Have Canada’s Telcos Failed to Notify Subscribers About Disclosing Their Information?

While much of the attention this week on the massive number of requests for subscriber information has rightly focused on the government and a legal framework that provides insufficient oversight (and is about to expand warrantless disclosure under Bills C-13 and S-4), the telecom and Internet companies also deserve greater scrutiny. One of the key questions in the document on telecom and Internet provider disclosure practices asked simply:

Do you notify your customers, when the law allows, that their information has been requested, thus giving them an opportunity to contest the request in court?

The answer from every provider: No.

Read more ›

May 2, 2014 14 comments News

Is a Canadian Telco Allowing the Government To Mirror Its Subscriber Communications?

The recent revelations regarding massive telecom and Internet provider disclosures of subscriber information has generated a political firestorm with pointed questions yesterday to Prime Minister Stephen Harper in the House of Commons. While Harper tried to provide reassurances that warrants were obtained where necessary, the reality is that the law […]

Read more ›

May 1, 2014 8 comments News

Canadian Telcos Asked to Disclose Subscriber Data Every 27 Seconds

Every 27 seconds. Minute after minute, hour after hour, day after day, week after week, month after month. Canadian telecommunications providers, who collect massive amounts of data about their subscribers, are asked to disclose basic subscriber information to Canadian law enforcement agencies every 27 seconds. In 2011, that added up to 1,193,630 requests. Given the volume, most likely do not involve a warrant or court oversight (2010 RCMP data showed 94% of requests involving customer name and address information was provided voluntarily without a warrant).

In most warrantless cases, the telecommunications companies were entitled to say no. The law says that telecom companies and Internet providers may disclose personal information without a warrant as part of a lawful investigation or they can withhold the information until law enforcement has obtained a warrant. According to newly released information, three telecom providers alone disclosed information from 785,000 customer accounts in 2011, suggesting that the actual totals were much higher. Moreover, virtually all providers sought compensation for complying with the requests.

These stunning disclosures, which were released by the Office of the Privacy Commissioner of Canada, comes directly from the telecom industry after years of keeping their disclosure practices shielded from public view. In fact, the industry was reluctant to provide the information to even the Privacy Commissioner.

According to correspondence I obtained under the Access to Information Act, after the Commissioner sent letters to the 12 biggest telecom and Internet providers seeking information on their disclosure practices, Rogers, Bell and RIM proposed aggregating the information to keep the data from individual companies secret. The response dragged on for months, with Bell admitting at one point that only four providers had provided data and expressing concern about whether it could submit even the aggregated response since it would be unable to maintain anonymity [I’ve released the full ATIP I received here].

Read more ›

April 30, 2014 29 comments News

Why the Government’s New Digital Privacy Act Puts Your Privacy at Risk

Appeared in the Toronto Star on April 12, 2014 as Why the Government’s New Digital Privacy Act Puts Your Privacy at Risk After years of false starts, Industry Minister James Moore last week unveiled the Digital Privacy Act, the long-awaited reform package of Canada’s private sector privacy law. While the […]

Read more ›

April 23, 2014 Comments are Disabled Columns Archive

The Expansion of Warrantless Disclosure Under S-4: Government’s Response Fails to Reassure

My post and column on the expansion of warrantless disclosure under Bill S-4, the misleadingly named Digital Privacy Act, has attracted some attention and a response from Industry Canada.  The department told iPolitics:

“Companies who share personal information are required to comply with the rules to ensure that information is only disclosed for the purpose of conducting an investigation into a contravention of a law or breach of an agreement. For example, self-regulating professional associations, such as a provincial law society, may wish to investigate allegations of malpractice made by a client. When organizations are sharing private information, the Privacy Commissioner can investigate violations and may take legal action against companies who do not follow the rules. This is consistent with privacy laws in British Columbia and Alberta and was recommended by the Standing Committee Access to Information, Privacy and Ethics.”

The response may sound reassuring, but it shouldn’t be.

Read more ›

April 14, 2014 6 comments News