Customers’ explicit approval needed for use of information, court tells TELUS

TELUS Communications Inc. must make more of an effort to get customers’ explicit approval to use the information it collects for a range of uses, and to inform them that they can opt to pay to have it excluded from directories, the Federal Court of Appeal has ruled. On November 17, a unanimous panel of judges sided with Mathew Englander in his three-year battle to have TELUS found in violation of Canada’s privacy laws. The ruling sets aside a lower court decision to the contrary issued in June 2003. TELUS has been using customers’ personal information in printed phone directories, on the 411 directory assistance system, and also on its Internet directory assistance service. It has also sold the listed information to independent directory publishers as well as others, and copy-protected CD-ROM directories. Subscribers have the option to opt out of having their information used in these services for a fee. The court found, however, that "…proper consent was not, and could not have been given, by TELUS first-time customers with respect to the use by TELUS of the personal information in its Internet directory assistance service, in its Directory File Service and Basic Listing Interchange File Service and its CD-ROM service. These services were not identified at the time of enrolment and there is no evidence that they were so connected with the primary purposes of telephone directories that a new customer would reasonably consider them as appropriate. There is no evidence that TELUS made any ‘effort,’ let alone a ‘reasonable’ one…to ensure that its first-time customers are advised of the secondary purposes at the time of collection." In its defence, TELUS had argued that, when subscribing, customers were asked how they would like their information to appear in the phone book, which was a form of implicit consent to use their information. Customers who inquired about leaving their name out of the phone book would be told about the option to opt out for $2 per month. With respect to the alleged implicit consent, the court writes: "The (lower court) judge’s conclusion…that first-time customers can be considered to have consented to the primary uses if they do not, on their own initiative, request an unlisted number, are not compatible, in my respectful view, with the very exercise of seeking informed consent before or at the time of enrolment…A consent is not informed if the person allegedly giving it is not aware at the time of giving it that he or she had the possibility to opt out. First-time customers have the right to know before their personal information becomes ‘publicly available’…with all the consequences that might flow from such publicity, that they can exercise their right to privacy and choose not to be listed. This, it seems to me, is a fair compromise between one’s right to privacy and the industry’s needs." While finding that TELUS was not making enough of an effort to get permission from new subscribers to use the information, the court did rule that the fee charged by TELUS does not infringe on the Personal Information Protection and Electronic Documents Act (PIPEDA). It found that the fee actually facilitated the process of making numbers unlisted, and that there was no evidence that the rate was onerous. Arguments were made during the case that the federal court has no jurisdiction over unlisted number rates, since they are in the purview of the CRTC, which regulates them. The court didn’t rule on the matter, though it noted the possibility that a future case will deal with whether CRTC privacy rules can trump or differ from PIPEDA laws. Michael Geist, a professor of Internet law at the University of Ottawa, says the case is precedent-setting, and will likely be felt across a variety of economic activities. "Obviously, it’s the highest court in Canada to address PIPEDA, so that alone makes it significant. It’s the first time we’ve had a senior appellate court address PIPEDA issues, and this court takes a detailed look at the purpose behind the law and issues around consent and the role of the courts. On that count, I think it certainly stands as one of the most important private sector privacy rulings we’ve had in Canada," Geist says. "What I take from this decision is that the court is really looking for a very serious and informed consent – perhaps more so than some people might have anticipated – so that they were not willing to infer consent merely because of some general knowledge around the fact that the information might be used, and, certainly there will be applicability of that kind of standard, I think, in multiple cases." The court would not order a monetary remedy in the case, but has ordered TELUS to submit written representations about how it will comply with the order, with Englander having two weeks to reply to those. A final ruling by the court would be issued some time after that. The court has also ordered TELUS to reimburse Englander for costs in both the Federal Court of Canada and in the appeals court, as well as reimburse him for $11,906.41 he was forced to pay as a result of the lower court ruling. Drew McArthur, VP of corporate affairs for TELUS, tells Network Letter that the company is still reviewing the decision to determine whether there might be grounds for an appeal to the Supreme Court of Canada, but is also working to determine how to come into compliance with the court’s order. "We’re putting together our proposal in terms of how we live up to the court’s ruling in informing customers about the uses we make of the information. In the world of business, things have changed since the original complaint. The court said ‘you need to inform customers about the consequences of having their information listed in the directory,’ which, in one way would require TELUS to kind of tell a person everything that any independent third-party who gets access to publicly available information might do with it. That’s almost impossible. So, what we have to do is at least provide the court with some idea of how we would propose to inform new customers about the availability of non-published number service, and what maybe the consequences are of having their name published in a directory, like it would be available online." He adds: "The problem is that we can’t inform every one of the possible permutations of whatever online directories that are out there once it’s made publicly available. But, we can say once your information is published in a directory, it does become publicly available and would be available in online directories. So, we have to determine what an appropriate – I guess, to put it as briefly as possible – we have to anticipate what the court might be expecting in terms of informing customers of the consequences of having their telephone number in a directory listing, and the availability of non-published number service."

Customers’ explicit approval needed for use of information, court tells TELUS

News | 11/25/2004 5:00 am EST

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us