Internet service providers should do a better job of telling subscribers to its Internet services that some personally identifying information is collected when traffic is managed as part of regular activities, Canada’s Privacy Commissioner says.
The Canadian Privacy Commissioner, Jennifer Stoddart, had stated last April that Bell’s public explanations of its use of deep packet inspection technology (DPI) to slow traffic of some Internet subscribers doesn’t comply with its obligations under the federal privacy law, PIPEDA.
Now, the Office of the Privacy Commissioner (OPC) has issued a summarizing report on the topic.
It notes that the initial investigation stemmed from a complaint that Bell uses DPI to collect personal information from its Internet customers without consent, and that it does not suitably notify its customers.
The complaint was not well-founded, the Commissioner said, with regard to matters of consent and limiting collection, but it was well-founded with regard to the matter of openness.
As such, the OPC says it will check with Bell within 30 days to follow-up on the nature of its published statements and documentation about Internet services and data collection.
A requested comment or response from Bell on this topic had not been received by post time.
The Commissioner’s report also states, in part:
“We have found that consent and notification are commonly overlooked when new technologies are brought on line. Like many technologies, each implementation of DPI technology must be considered as an individual case and examined to ensure the appropriate protection and treatment of personal information is in place.”
The Privacy Commission has ruled before that an IP address, which can be collected during DPI related activities, is personal information.
As a result, the Commissioner says Bell can identify user addresses of not only its subscribers, but also of non-subscribers who use Bell's network.
The report includes findings of its investigation into the matter, and it states “we have determined personal information is affected by how Bell Canada links DPI, dynamic IP addresses and the identification numbers belonging to subscribers of Bell’s own Sympatico internet service.
“The investigation identified particular concerns about how users are notified about new technology, and how their consent is secured.”
The subject of Deep Packet Inspection and related issues of so-called “Internet throttling” were reviewed and discussed during comprehensive public hearings, held this past summer by the Canadian Radio-television and Telecommunications Commission. The hearings are expected to resume in the fall.
For more on the Privacy Commission report, see
http://www.priv.gc.ca/cf-dc/2009/2009_010_rep_0813_e.cfm#findings
For more Mediacaster Magazine coverage of DPI related issues and the recent CRTC hearings, please see:
Web Portal Gathers Deep Packet Inspection Information
http://www.mediacastermagazine.com/issues/ISarticle.asp?aid=1000326507&PC=
BC Company Dives Into Deep Packet Inspection Market
http://www.mediacastermagazine.com/issues/ISarticle.asp?aid=1000081091&PC=
CRTC Internet Hearings Adjourn – For Now
http://www.mediacastermagazine.com/issues/ISarticle.asp?aid=1000334646&PC=