Telus, OPL respond to CIPPIC DRM study

Representatives from Telus Corp. and the Ottawa Public Library (OPL) have responded to the Canadian Internet Policy and Public Interest Clinic (CIPPIC) report alleging both organizations offered digital rights management (DRM)-enabled services that violated privacy laws. While both parties seem sincere in their desires to protect customer privacy, opinions appear to differ about what is considered personal property. During the course of its study CIPPIC found that Telus "likely collects" the IP addresses of customers who use its Spark mobile content service. However, Telus' VP of corporate affairs Drew McArthur says that in order for a customer to initiate a download, Telus establishes the dynamic IP address for that customer, but does not keep the address after the download has been completed. CIPPIC also noted that by disclosing some of its technical data practices in an FAQ rather than its privacy commitment or privacy code, Telus wasn't as forthcoming with some of its privacy practices as it could have been. Again, McArthur explains: "We don't put every detail of every service into our privacy policy...We offer hundreds and even thousands of products and services. So our privacy policy is applied across all of our product and service suites, and we ensure through internal processes that as products and services are being developed they do adhere to our privacy policy."McArthur adds that Telus is recognized as an industry leader for its privacy policy. It's a fact that Canadian New Media had already been made aware of by CIPPIC's staff counsel David Fewer. In fact, Fewer points to Telus as an example of how even the most transparent companies could still be more upfront with their customers than they currently are. But sometimes the organization may be just as unaware of some practices initiated by a third-party DRM service as their customers are.For instance, Joan Haire, a planning consultant with OPL, says "our vendor, OverDrive Inc., states categorically that they don't have a relationship with DoubleClick." The library was understandably surprised then when CIPPIC reported that "the Ottawa Public Library's use of the OverDrive media console for implementation of digital audio book loans results in the disclosure of information to DoubleClick."As a result, Haire says OPL will be contacting both OverDrive for an explanation of CIPPIC's findings. OPL also plans to contact Fewer for more information on staying up to date with privacy law. "We take personal privacy very, very seriously in the library world," she says. "So if we were divulging something that was personally identifiable and potentially damaging we wouldn't want to be doing that."Telus, on the other hand, feels it's already in compliance with privacy laws, and McArthur adds that it reviews how its Web properties are managing information on a regular basis. It's a matter of customer care, and it seems likely that consumer privacy could be an issue that would influence purchasing decisions. "I think customers feel better knowing an organization's practices and that they are working to ensure the privacy and security of their information as a matter of trust, trust in the brand," McArthur says. "To suggest that they might buy one service over another service knowing that, I don't have any data to support it, but we certainly want to engender the trust of our customers." However, in spite of Telus' reputation for, and OPL's desire to achieve, stellar privacy practices, both organizations contradict CIPPIC's claim that IP addresses are considered "personal information." Haire and McArthur both say dynamic IP addresses are not personal information because they change frequently. "The determination of whether an IP address is personal information is probably yet to be determined and it's debatable under circumstances," McArthur adds.Indeed, it's been debated before. Internet consultant Russell McOrmond and CIPPIC both note that the Federal Court of Appeal ruled in the case of BMG v. Doe that IP addresses, including dynamic IP addresses, are personally identifying information. CIPPIC further notes that the Office of the Privacy Commissioner of Canada has held that an IP address can constitute personal information for the purposes of Personal Information Protection and Electronic Documents Act on several occasions.

Telus, OPL respond to CIPPIC DRM study

News | 09/27/2007 7:02 pm EDT

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us