DRM-enabled products and servivces are watching you: CIPPIC

Digital Rights Management and Consumer Privacy, a report that was released Wednesday by the Canadian Internet Policy and Public Interest Clinic (CIPPIC), returned some startling conclusions, including that "a number of organizations used DRM to collect, use and disclose personal information for inappropriate purposes." But perhaps more troubling are the implications one can draw from the covert way many companies divulge their privacy practices."One of the most startling aspects of the privacy-analysis side of the report was how many organizations put privacy disclosures in funny places, or spread them across different documents," David Fewer, CIPPIC staff counsel, tells Canadian NEW MEDIA. "A key privacy disclosure we found from one organization was in a supplementary software licensing agreement. That's where they put the kind of golden key saying they can do whatever they want with your personal information. And to say that's binding or that meets the requirements of our privacy laws, well, let's just say I doubt it's sufficient." When it comes to consumer privacy, much of the behaviour of the companies investigated by CIPPIC could be labelled insufficient. The report studied 16 products or services in Canada that use DRM technologies in some way to control access and use of creative works in the digital environment. The products ranged from the more obvious - Apple Inc.'s iTunes music and video stores, Telus Mobility's Spark service, and Napster - to the seemingly more harmless - the Pirates of the Caribbean DVD and the Ottawa Public Library (OPL)'s OverDrive digital audio book copy of Swiss Family Robinson. And as every application's compliance with the Personal Information Protection and Electronic Documents Act was assessed, the results ranged from moderately surprising - Telus likely collects Spark users' IP addresses - to downright frightening - Intuit Canada reserves the right to send the tax information of users of its QuickTax software and online filing service to their facilities in the United States, exposing such data to American laws (Telus and Intuit were unable to comment by press time). CIPPIC also found that organizations engaged in such DRM-enabled privacy-invasive behaviours generally don't allow consumers to opt-out of having their personal information collected and used for unnecessary purposes. Raising suspicions further, the majority of organizations were about as forthcoming in responding to CIPPIC's requests about the type of information being collected as they were with their privacy disclosures. "We were expecting pretty fulsome cooperation from these organizations," says Fewer. "We didn't get it. When presented with proof of the communications and getting a request saying ‘what's going on with these?'...only two came back to us and gave us an account of what they were." One of the obliging organizations was OPL (the other was Microsoft), which knew the use of its digital audio book download service prompted communications with online marketing company DoubleClick. Fewer calls the OPL scenario a textbook example of how DRM can cause well-meaning organizations to run afoul of privacy laws; OPL knows very little about DRM, the technology is provided by a third-party supplier, and that third-party supplier is an American company that may not think hard about complying with Canadian privacy laws. The study was funded through the Office of the Privacy Commissioner of Canada's contribution program, but was as much intended to shed light on the situation for the general public. Canadian's might find the results a little scary. If organizations with intentions as admirable as the public library are infringing on Canadians' privacy rights, who isn't? A report such as this certainly drums up visions of living in an Orwellian state. "Hopefully won't be so much paranoia as a little bit of shock and self awareness, both on the part of people who are using DRM products and on the part of people who are distributing these products," says Fewer. "Hopefully distributors like Telus and the Ottawa Public Library will be saying ‘we've got a due diligence process to do on the supply side now that perhaps we weren't paying enough attention to before.'" In the interim, Fewer says consumers can best protect themselves with their wallets, which is the most effective way to bring change. "How do you get people to actually either hold these guys to account, or how do you stop people from giving them the information in the first place?" asks John Lawford, counsel for the Public Interest Advocacy Centre. "The difficulty faced under the existing privacy legislation is it's complaints driven. So when you get a situation like this...it's up to individuals to take it forward." Lawford adds that legislation requiring companies to make it clear on their packaging that a product contains DRM, as well as which personal information it communicates and to whom, would at least give consumers the requisite knowledge at purchase time. "I don't know if it would actually scare people off or not," he says. "You can put up a sign and people still dive in head first."But at least all consumers would know, upfront, what was happening with their personal information; the lack of proper disclosure is biggest problem. "It isn't that DRM is a threat to privacy, that's not the case here," says Fewer. "How it's being deployed is inconsistent with obligations under privacy laws. So we're seeing the technologies not meeting consumers' expectations and certainly not meeting Parliament's expectations. You shouldn't have to go to a bunch of different documents to figure out what the global privacy policy is. It should be generally in one place...that was a problem we found with lots of organizations."

DRM-enabled products and servivces are watching you: CIPPIC

News | 09/21/2007 12:12 pm EDT

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us