Canadian Internet Policy and Public Interest Clinic (CIPPIC)

On Friday, February 19, 2010, CIPPIC provided Facebook and the Privacy Commissioner a statement highlighting its concerns with respect to recent changes on Facebook.com.  The statement is intended as a follow up to CIPPIC's initial privacy complaint against Facebook and the Commissioner's resulting Report of Findings and follow up letter of resolution.  It concludes that Facebook has failed in a number of ways to live up to standards set out in that Report of Findings, and asks for remedial measures and a response within 30 days.  In particular, it alleges that Facebook did not have the informed, meaningful consent of its users for new defualt privacy settings it has imposed on them and asks that Facebook commit to undoing these changes. It also asks that Facebook ceases its current practice of forcing users to share information categories it deems 'publicly available'.  The deadline for compliance is March 22, 2010.

CIPPIC has added its name to the growing list of experts and civil society groups signing the Madrid Privacy Declaration, reaffirming a global commitment to privacy, both as a value and a human right.

• Madrid Privacy Declaration
• International Conference of Data Protection and Privacy

The CRTC has turned down CAIP's application to vary the CRTC's decision in CAIP v. Bell, finding no substantial doubt about (1) the correctness of its determinations that Bell's throttling of wholesale customer traffic does not control the content or influence the meaning or purpose of telecommunications it carries, (2) the completeness of the record used to make that decision, or (3) whether or not Commission fettered its discretion.  The Commission declined to review other elements of the application to review and vary on the grounds that Bell's traffic management practices would now be subject to the new analytic framework and tariff requirements set out in Telecom Regulatory Policy 2009-657.

• Telecom Decision CRTC 2009-677
• Telecom Regulatory Policy CRTC 2009-657

The CRTC released its decision in the Internet Traffic Management proceeding today.  CIPPIC, who represented the Campaign for Democratic Media in the hearings leading up to this decision, called on the CRTC to put in place a framework that will ensure Canadians an open and netural Internet.  The decision (TRP CRTC 2009-657) is a step in that, but does not go as far as the FCC went a year ago, let alone as far as it is about to go tomorrow.

CIPPIC joined other privacy advocates across Canada in a joint submission promoting respect for privacy interests that will be affected by proposed changes to copyright law.

• Submission of Canada's Privacy Community
• Attachment:  Privacy and Copyright Backgrounder

CIPPIC has submitted a letter to the copyright consultations.  CIPPIC's submission cautions policy makers to avoid undermining copyright's policy objectives in revising the law, and warns of the dangers of excessive control over copyrights. 

• CIPPIC Copyright Consultation Submission
• Consumer Coalition White Paper (français)
  

The OPC has released a letter to CIPPIC outlining its final resolution with social networking site Facebook with respect to the privacy concerns CIPPIC raised in its PIPEDA complaint a year ago.  The letter supplements the original finding and lays out a process for moving forward.  The OPC has said it will continue to work with Facebook over the coming year to ensure that Facebook implements its obligations in a manner that meets the requirements of the Act.  CIPPIC has some outstanding concerns, and will continue to engage both the OPC and Facebook to ensure these are met.

CIPPIC has launched DigitalAgenda.ca, a new website promoting grassroots advocacy on digital issues.  DA's initial focus is on the ongoing copyright consultations.  As part of this, DA has set up an Ideatorrent - an open source tool that allows Canadians to suggest, discuss, and vote on solutions to copyright problems with the ultimate goal of providing a grassroots submission to the copyright consultations.

Other issues highlighted on DA include Canada's Safe Internet Act (the Electronic Consumer Protection Act), recent lawful access legislation (Bills C-46 and C-47, and Net Neutrality. More issues and content will be added as legislative priorities shift.

• CIPPIC's Media Release

Today, the Privacy Commissioner issued its response to CIPPIC’s privacy complaint against Bell’s use of deep packet inspection equipment for the purpose of traffic management.  The Commissioner held that Bell must amend its privacy policy in order to clarify precisely what uses it is making of personal information collected through its DPI with particular attention to whether it is sharing that information with affiliates, agents and suppliers.  More importantly, the Commissioner found that, before using its DPI for behavioural targeting advertising purposes, Bell must add explicit notice that it intends to do so.

•    CIPPIC’s Initial Complaint
     o    Supplement 1
     o    Supplement 2
•    OPC’s Report of Findings

Today, the Privacy Commissioner of Canada released its finding on CIPPIC’s privacy complaint against Abika.com, a US databroker.  The Privacy Commissioner found that the complaint was well-founded, and called on Abika to stop collecting personal information of Canadians without their informed consent.  The is significant in that it involved an appeal by CIPPIC to the Federal Court to establish that the Privacy Commissioner had jurisdiction to investigate complaints relating to transborder flows of personal information.  Additionally, it led to a cooperative investigation between the Privacy Commissioner and the US Federal Trade Commission into the practices of Abika.

• Report of the Privacy Commissioner of Canada’s Findings against Abika

On July 29, 2009, CIPPIC filed the Campaign for Democratic Media’s final reply submissions in the CRTC’s traffic management proceedings.  CIPPIC called for rules ensuring an open and neutral Internet, and for a finding that current ISP application-specific throttling practices violate the Telecommunications Act.

•    CIPPIC/CDM’s Final Reply Submission

The Office of the Privacy Commissioner announced yesterday that it would release its finding on CIPPIC's PIPEDA complaint against Facebook today.  The finding will be released today at 9 am, and will be followed by an OPC press conference at 11 am.

• OPC Finding: CIPPIC v. Facebook
• Original CIPPIC Complaint

Today, CIPPIC submitted a letter to the Financial Services Commission of Ontario highlighting the case for expanding the Ontario Consumer Protection Act so that it will better protect consumers from informational and other deficiencies in interactions with financial institutions.  Many such financial institutions are currently excluded from the CPA, yet consumers require CPA safeguards just as much during financial transactions as elsewhere, if not more.  The letter calls for a more detailed investigation of the issue.

On April 30, 2009 CIPPIC filed, on behalf of its client, CDM, reply comments in the CRTC proceeding on network neutrality and traffic management.  CIPPIC/CDM argued that an ISP who wishes to apply traffic management techniques to different types of applications must justify such discrimination.  It further argued that slowing down against P2P file-sharing applications is unjustified, as it is discriminates against content developers that depend on such applications, against customers that use them, and against the developers of the applications themselves.

•    CIPPIC/CDM’s Reply Submission

Over the past few years, CIPPIC actively participated in the "On the Identity Trail" project, a multidisciplinary research project funded by the Social Sciences and Humanities Research Council (SSHRC) Initiatives on the New Economy (INE) Program and led by my colleague Ian Kerr that focused on issues of anonymity and privacy in an networked society. The fruits of that project have now been pulled together into a book, Lessons from The Identity Trail: Anonymity, Privacy and Identity in a Networked Society, which is available to purchase online from Oxford University Press or to download, free of charge, under a Creative Commons license.

CIPPIC has filed a Comment on behalf of its client, Campaign for Democratic Media, in the CRTC proceeding on ISP traffic management.  CIPPIC was supported in its submissions by the testimony of noted Internet experts Dr. David Reed of MIT, Dr. Andrew Odlyzko of the Minnesota Internet Traffic Studies (MINTS) project, and Bill St. Arnaud Chief Research Officer for CANARIE Inc.

• CIPPIC's CDM Comment
• Testimony of Dr. Andrew Odlyzko
• Testimony of Dr. David Reed
• Testimony of Bill St. Arnaud
• Media Release

The Office of the Privacy Commissioner of Canada (OPC) has found that CIPPIC's allegations regarding violation of the Privacy Act by the Pension Appeals Board (PAB) were well-founded, and that the PAB continues to violate the Act by using actual rather than randomly-assigned initials in place of individual names in the decisions it posts online.
more

In comments filed today with the Privacy Commissioner of Canada, CIPPIC argues that infoCANADA, a company that matches geo-demographic data with White Pages listings to create and sell consumer lists, is required by law to obtain consent from the consumers on its lists.
Case summary and documents

A nation-wide coalition of consumer and public interest groups including CIPPIC today asked each of the five major parties to take a stand on consumer protection in Canada's telecommunications sector.
News Release
Questionnaire to Parties
Responses

CIPPIC has received a large donation from UCal Berkeley Professor Pamela Samuelson and technology innovator, entrepreneur and professor Dr. Robert Glushko, allowing the clinic to continue its student-centered public interest advocacy work on law and policy issues arising from the use of new technologies. With this generous donation, CIPPIC joins the growing network of Samuelson-Glushko cyberlaw clinics in universities across North America.
Samuelson Law, Technology and Public Policy Clinic, University of California, Berkeley
Glushko-Samuelson Intellectual Property Law Clinic, Washington College of Law
University of Colorado Technology and Policy Clinic
Fordham Law School Intellectual Property and Information Law Clinic

By way of a formal complaint filed August 1, 2008, CIPPIC is challenging the legality of bank policies that require clients to allow the bank to use their personal information for such purposes as "to determine your eligibility for products and services we offer".  CIPPIC also argues that banks must obtain the express consent of clients to any such secondary uses of personal financial information; opt-out consent is not sufficient.

In a letter sent July 25th, CIPPIC asked the federal Office of the Privacy Commissioner to begin an investigation into the internet service provider (ISP) industry's controversial new practice of profiling users online to target them with advertising. CIPPIC also filed privacy complaints against Rogers, Shaw, and Eastlink for their use of Deep Packet Inspection technology to shape network traffic. This follows a similar complaint against Bell earlier this summer.
CIPPIC Media Release
Request for investigation into ISP use of DPI for behavioural targeting
Complaint against Rogers re: use of DPI for traffic-shaping
Complaint against Shaw re: use of DPI for traffic-shaping
Complaint against Eastlink re: use of DPI for traffic-shaping

In response to the CRTC's call for comments on issues that should be examined in the context of a proceeding on broadcasting policy and new media, CIPPIC filed a submission urging the CRTC to examine ways in which proposals for protecting Canadian content could actually undermine important policy objectives of the Broadcasting Act as well as the Telecommunications Act.

In response to a formal complaint filed by CIPPIC last summer about the unnecessary inclusion of personal details in employment insurance appeal decisions posted online, Service Canada (the federal government department responsible) has finally agreed to change its policy.  The Privacy Commissioner of Canada found CIPPIC's complaint to be well-founded, and made a number of specific recommendations which Service Canada has now agreed to implement.
OPCC letter of finding
CIPPIC complaint

CIPPIC filed comments today with the CRTC on behalf of the Campaign for Democratic Media ("CDM"), objecting to Bell Canada's throttling of P2P traffic, and calling for a public proceeding to examine the legality of ISP traffic-shaping practices generally. The current proceeding was brought by the Canadian Association of Internet Providers and focuses on the legality of Bell's throttling of P2P traffic carried by ISPs that lease Bell facilities.
CDM News Release
CDM Comments
Appendix 1 to CDM Comments (Emerging P2P Applications)
Appendix 2 to CDM Comments (CIPPIC PIPEDA Complaint re: DPI)

Civil society groups participating in the OECD Ministerial on the Future of the Internet Economy in Seoul, Korea this week tabled "The Seoul Declaration", calling on OECD countries to adopt policies designed to ensure the inclusiveness, fairness and effectiveness of the internet for all citizens.  CIPPIC was actively involved in this initiative along with other members of "The Public Voice" coalition.

Industry Minister Jim Prentice today introduced into the House of Commons an Act to Amend the Copyright Act that imported the worst aspects of the American DMCA while leaving consumers digitally locked on the outside looking in.  Highlights:  good ISP liability regime, long overdue time and format-shifting exceptions.  Lowlights:  those consumer exceptions - indeed, almost all user rights under copyright law, including fair dealing - are trumped by digital locks.  We now know the Conservative vision of copyright, and it's bleak:  digital distributors are king, and Canadian consumers come last. 
CIPPIC Media Release (version française incluse)

A massive coalition of Canada's leading consumer advocates have today released an open letter calling on the Canadian government to embrace copyright policies that put Canada's interests first.  Consumer advocates from across the country - including two of Quebec's leading consumer rights organizations - have demanded a principled approach to copyright policy from Canada's government that rejects any law modeled on the American Digital Millennium Copyright Act.  Signatories include Union des consommateurs, Option consommateurs, the Public Interest Advocacy Centre (PIAC), the Consumers Council of Canada, CIPPIC and the grassroots digital advocacy group, Online Rights Canada.
- Open Letter to Ministers
- Media Release
Simultaneously, some members of this coalition have released a White Paper on Consumer Copyright.  The White Paper lays out a standard against which the coming copyright legislation may be measured.  White Paper signatories include Option consommateurs, CIPPIC, PIAC, and Online Rights Canada.
- Consumer Coalition White Paper (français)
- Media Release

CIPPIC today filed a 35-page complaint under the Personal Information Protection and Electronic Documents Act against Facebook, alleging 22 separate violations of the Act.
CIPPIC News Release
Appendix 1 - Facebook Privacy Policy
Appendix 2 - Facebook Terms of Use
Appendix 3 - Facebook Privacy Settings

CIPPIC has asked the Privacy Commissioner of Canada to investigate the use by Bell Canada and other large Canadian ISPs of "Deep Packet Inspection", a technology that permits ISPs to look at content of internet traffic as it flows through the network.  Bell has admitted to using the technology in order to manage traffic on its network. 
CIPPIC News Release

CIPPIC testified before a Parliamentary Committee today, calling for a number of changes to the federal Privacy Act in order to better protect Canadians against state incursions on their privacy.

CIPPIC today offered comments to the Department of Foreign Affairs and International Trade on ACTA, the proposed Anti-Counterfeiting Trade Agreement.  CIPPIC's comments focus on the unusual venue of discussions (which provides no room for participation by developing nations or civil society groups), the vague process (which is unusually opaque, even for trade discussions) and the danger posed by the potential substantive content of the treaty itself.

Further to stakeholder consultations by Industry Canada regarding the specifics of a new legislated data breach notification requirement, CIPPIC filed comments today.  These comments are further to CIPPIC's January 15th submission to Industry Canada on the PIPEDA Review, which submission called for a public registry of data breaches.

CIPPIC has provided the House of Commons Standing Committee on Industry, Science and Technology with a submission with respect to its study into Canadian science and technology.  CIPPIC's submission focuses on open access to scientific data, Crown copyright, and the challenges DRM and anti-circumvention laws pose for security researchers.

CIPPIC has provided the FTC with comments on the FTC's proposed online behavioural advertising Principles.  The FTC proposes that the Principles guide the development of industry self-regulation of the practice of tracking consumers’ activities online to target advertising.

CIPPIC has been awarded a Public Interest Articling Fellowship from the Law Foundation of Ontario, for 2009-2010. The award covers the salary, benefits, Bar Admission course fees, and overhead costs for the articling student. This is the fourth year in a row that CIPPIC has received funding for an articling student from the LFO.

CIPPIC yesterday filed a brief with the House of Commons Standing Committee on Justice and Human Rights, on the matter of Bill C-27: An Act to amend the Criminal Code (identity theft and related misconduct). CIPPIC supports the Bill, but emphasizes that it is just one small piece of a much bigger law reform agenda needed to effectively address the identity theft problem.

CIPPIC Brief

In a submission made to the CRTC today, CIPPIC responds to Applications by Bell Canada et al, Bragg Communications et al, and SaskTel to review and vary Telecom Decision CRTC 2007-130.  The telecom service providers ("TSPs") challenge, among other things, the CRTC's decisions to require their participation in a new consumer complaints agency, and to allow the new agency to disregard the liability limitation clauses included in TSP terms of service.

The Office of the Privacy Commissioner of Canada (OPCC) today issued its findings on CIPPIC's November 2005 complaint against Ticketmaster.  The OPCC found that CIPPIC's allegations regarding lack of openness and consent were well-founded, and that as a result, Ticketmaster had changed its policies and practices so as to comply with the law and respect customer privacy.

Canada's Privacy Community has released an open letter calling on Canada's minister responsible for Canadian copyright policy to consult widely with privacy experts prior to introducing copyright legislation.  The letter follows correspondence from the Privacy Commissioner of Canada last week identifying some of the privacy interests implicated by proposed digital copyright laws.