Study says Internet providers should be more transparent about data privacy

A new report by leading privacy experts has revealed that Canadian Internet providers need to be much more transparent about how they protect their customers' private information. The report found that while all providers had room for improvement, smaller independent providers tend to be more transparent overall than their larger counterparts. Smaller providers also got credit for being more transparent about their user privacy protection and for more visibly keeping domestic Canadian Internet traffic within Canada.

The report, entitled "Keeping Internet Users in the Know or in the Dark," is being released today by IXmaps.ca and New Transparency Projects. The report offers Canadians an in-depth look at the Data Privacy Transparency of Canadian Internet Service Providers (ISPs). The authors have also released an at-a-glance 'Star Table' rating ISPs according to 10 transparency criteria. Canadians can use this chart to see how their provider compares with others. The ISP 'star ratings can also be seen in relation to one's personal internet traffic using the Explore feature of the IXmaps.ca internet mapping tool.

The study found that there was plenty of room for improvement among the 20 ISPs covered by the report. However, smaller, independent Canadian carriers scored better overall than larger incumbents. Independent provider TekSavvy earned more stars across more categories than other ISPs. Canadian ISPs were overall more transparent than the foreign carriers that handle domestic Canadian internet traffic. They generally don't even acknowledge their compliance with Canadian privacy law, notably the Personal Information Protection and Electronic Documents Act (PIPEDA).

The project was spearheaded by Prof. Andrew Clement and Dr. Jonathan Obar at the Faculty of Information, University of Toronto. Professor Clement explains that: "We've just seen that in 99% of Canadian Border Services Agency's requests for subscriber information, telecom companies have turned this sensitive data over without a warrant. Internet providers must be accountable to the Canadian public for how they handle our personal information. ISPs that proactively demonstrate transparency can show leadership in the global battle for data privacy protection and bringing state surveillance under democratic governance."

OpenMedia.ca, a community-based organization leading a 34,000-strong nationwide pro-privacy campaign, says the report has revealed that Canadians need better accountability from their ISPs, especially from the telecom giants.

"Canadians deserve to know whether their telecom provider has their back when it comes to how they protect your privacy," says OpenMedia.ca Executive Director Steve Anderson. "Today's report will make it easier for Canadians to make informed choices about which Internet provider to trust with their personal information. It's clear from these detailed findings that smaller providers are more transparent about the measures they take to protect customer privacy – information customers need to assess which Internet provider is best for them."

Anderson continued: "Nevertheless, all Internet providers have plenty of room for improvement. With so much of our private information now online, every Internet provider has a duty to safeguard Canadians from mass government surveillance – foreign and Canadian. They also need to be much more transparent about the extent of their cooperation with warrantless government spying – Canadians deserve to know exactly how often the government tries to invade their privacy, and exactly what their ISP is doing to protect them."

The report makes a number of policy recommendations aimed at improving ISP transparency:

• ISPs should make public detailed information about their commitment to being transparent about when, why, and how they transfer private customer information to the state and other third parties.
• The federal Privacy Commissioner and CRTC should more closely oversee ISPs to ensure their data privacy transparency, and in particular that they only hand off Internet traffic to carriers with comparable privacy protections as those in Canadian privacy law.
• Legislators should reform privacy laws to include robust transparency norms.