The Canadian Internet Policy and Public Interest Clinic recently announced that they are making a request to the privacy commissioner to investigate Canadian major Internet Service Provider Bell Canada. The complaint is directed at Deep Packet Inspection technology.Internet Service Providers (ISP) have a legal sore spot these days - that sore spot is internet intervention on the ISP level. In Canada, a form of that sore spot may be in the form of Deep Packet Intervention and its impact on privacy. Considering the kind of privacy laws Canada has, it may prove very interesting to see where this goes. A hint on the kind of privacy laws that are in place is the fact that Canada has commissioners dedicated to privacy which is often said is a rarity in the world today. The complaint (PDF) made by CIPPIC says, among other things: 1. This is a complaint under s.11 of Part I of the Personal Information Protection and Electronic Documents Act (PIPEDA), regarding the unnecessary and non-consensual collection and use of personal information by Bell Canada and Bell Sympatico (collectively, “Bell”) through the use of “Deep Packet Inspection” (“DPI”) technology. 2. In brief, we understand that Bell is engaging in internet “traffic management” practices that involve the inspection of internet traffic headers and content, both of which contain information that can be linked to internet subscribers, purportedly to classify traffic for purposes of network optimization. Such practices – i.e., those involving the collection and use of personal information - are not necessary to ensure network integrity and quality of service. Moreover, subscribers whose traffic is being inspected have not consented to the inspection and use of their data for this purpose. Finally, Bell does not make readily available to individuals specific information about these practices. 3. We submit that Bell is violating Principles 4.3, 4.4, and 4.8 of PIPEDA, Schedule 1 by failing to: Internet traffic shaping practices have typically focused on identifying and slowing down Peer-to-Peer (“P2P”) traffic during peak hours of usage, for the alleged purpose of ensuring adequate bandwidth availability for other users. In order to distinguish P2P traffic from other types of traffic, ISPs typically use Deep Packet Inspection technologies. DPI examines the contents (commonly called the “payload”) rather than just the header of the data packet. A press release (PDF) has the following: Large ISPs including Bell Canada and Rogers Communications Inc. may be monitoring internet subscribers’ online activities contrary to Canada’s privacy legislation, and the Canadian Internet Policy and Public Interest Clinic has asked Canada’s Privacy Commissioner to investigate. There is evidence that other large ISPs such as Rogers, Shaw, and Cogeco may be engaging in similar practices, said Lawson. “Our complaint focuses on Bell, but we are asking the Commissioner to investigate all ISPs who engage in traffic-shaping practices.” So, first of all, what are principles 4.3, 4.4, and 4.8 of PIPEDA? Here's what we find in these sections: 4.3 Principle 3 — Consent 4.4 Principle 4 — Limiting Collection 4.8 Principle 8 — Openness Considering Bell Canada was very secretive in their business with filtering technology, among other things, it definitely sounds like Bell Canada is about to get nailed for their use of Deep Packet Inspection. It also sounds like that '33% overloaded' complaint from Bell, as we reported last month, is going to be a part of the trouble Bell put themselves in to. Second of all, there was mention over the CAIP submission at the CRTC. Michael Geist posted about this, highlighting the privacy concerns Deep Packet Inspection, the technique used to filter P2P traffic: CAIP is also raising privacy concerns with the throttling, seeking an order that "Bell has acted unlawfully and contrary to the prohibition on carrier interference with the content of messages carried over its telecommunications network contrary to section 36 of the Act and contrary to the Canadian telecommunications policy objectives set out in paragraphs 7(a) and (i) which, inter alia, seek to protect the privacy of persons." The privacy argument is based on Bell's deep-packet inspection of Internet traffic. In particular: Michael Geist is noting this connection as well: With CAIP raising the privacy issue in its submission to the CRTC, it was only a matter of time before the Privacy Commissioner was asked to intervene. Finally, it seems that the complaint stems specifically from a few things, some of which include the fact that Bell did not obtain permission from its customers to use the technology, it didn't disclose it's practices in, not only a clear manner, but a timely manner, limit the amount of information they obtain, and the fact that filtering the internet is clearly not an essential practice on the network in the first place. The case has a number of similarities to the Phorm controversy in Britain where two analysis, one from Richard Clayton and the other from FIPR (which complimented Claytons analysis) Phorm, of course, has a few key differences in the fact that it's based on analysis of web surfing behavior while the DPI technology analyzes specific packets from a few protocols. At the same time, the similarities are very real in the fact that both deal with intervention from an Internet Service Provider and capturing and using private information indiscriminately. One thing to consider is the simple fact that the privacy laws in Britain are different from that of Canada. Either way, when an ISP starts collecting personal information in some form or another, there's bound to be high level controversy at some point. Whether or not the Privacy Commissioner of Canada will respond is, of course, another matter. There was a case in the past where CIPPIC filed a privacy complaint (namely against Abika.com) back in June of 2004 (second from bottom). The privacy commissioner initially refused to intervene due to a jurisdiction issue, but after going through court for a judicial review, the courts ruled in favor of CIPPIC and the case resumed in 2007. It'll be interesting to see what the Privacy Commissioner has to say about this case and if the commissioner will intervene. Looking through the laws CIPPIC sites, it seems reasonable to assume that there'll be fewer issues in this case. |
 
|
members that voted for this story
|
