Background Paper: Critical Privacy Issues
in Canadian Copyright Reform

May 17, 2006

IntellectualPrivacy.ca

---

Background Paper: Critical Privacy Issues
in Canadian Copyright Reform

May 17, 2006

1. Executive Summary
2. Copyright Should not be a License to Invade Privacy
3. Anti-Circumvention and DRM
4. Internet Service Provider Liability
5. Photographs and Consumers
6. Conclusion
7. Endnotes

---

Background Paper: Critical Privacy Issues
in Canadian Copyright Reform

May 17, 2006

IntellectualPrivacy.ca

1.  Executive Summary

Privacy is increasingly threatened by copyright holders' technological controls and by expanding copyright law. In our information society, some of the most fundamental questions about the appropriate limits of copyright holders' rights have come to be synonymous or interdependent with questions about the appropriate limits of personal privacy in connection with the enjoyment of copyright works. To date, the product of this conflict has unquestionably been a diminishment of privacy.

Although the conflict between privacy and copyright has received much critical attention, our former government appears to have ignored these criticisms in its proposals to reform copyright law in Canada. The government has never consulted specifically on the privacy implications of copyright reform. In November 2004, for example, the Privacy Commissioner of Canada expressed her concern about copyright reform and stated that her office had not been consulted by the ministries responsible. ⁱ

This short Background Paper explains why intellectual privacy — the ability to enjoy copyright works in private or anonymously — is so important, both in its own right and in terms of furthering the goals of copyright. This paper then briefly outlines three major privacy threats posed by copyright reform in Canada ⁱⁱ and explains why critical attention is needed in these areas. This paper also identifies and references proposals for resolving the identified problems.

Ultimately, this paper describes why it is critical that Canada ensure a privacy-preserved means of access to creative works. Protecting personal privacy in this context is essential for our intellectual freedom, freedom of expression, and innovation, all of which are independently important, in addition to complementing the goals of copyright policy.

2.  Copyright Should not be a License to Invade Privacy

Some 'copyright holders' ⁱⁱⁱ increasingly attempt to use copyright as a justification to invade Canadians' personal privacy. Privacy-invasive 'digital rights management' (DRM) technologies, described further below, are one example of this trend; as are the standard-form licenses that such technologies implement. Some copyright holders have also sought to compel Internet service providers (ISPs) to retain and disclose individuals' personal information in order to sue them for staggering statutory damages for music downloading. ^iv As of early 2006, approximately 16,000 individuals had been targeted with lawsuits in the United States and thousands more around the world. ^v

In addition to the need to protect privacy as a fundamental right in and of itself, it is important to note that copyright policy is furthered by protecting privacy. Individuals should be able to access and enjoy copyright works free from the prying eyes of copyright holders. The American Library Association explains why this kind of privacy is essential:

In all areas of librarianship, best practice leaves the user in control of as many choices as possible. These include decisions about the selection of, access to, and use of information. Lack of privacy and confidentiality has a chilling effect on users' choices. All users have a right to be free from any unreasonable intrusion into or surveillance of their lawful library use. ^vi

The same rationale applies to copyright policy generally. Access to and enjoyment of existing works is chilled when individuals are forced to do so under copyright holders' microscope: "Surveillance is inimical to creativity. We cannot expect people to 'stand on the shoulders of giants' to create in the full glare of spotlights." ^vii Privacy invasions not only chill and discourage public access to and enjoyment of existing works, but also over the longer term may lead to less creation of new works. New creativity is built on access to and enjoyment of existing creativity.

Not surprisingly in light of the importance of privacy for copyright policy, copyright law was never intended to be used against individuals in ways that affect our intellectual freedom to access and enjoy copyright works in private:

In sum, the invasion of the private sphere is at odds with the history of copyright… . There was an implicit recognition that copyright did not apply to end uses, even though formally users were making copies and, in rarer cases, performing or communicating works.

…

[On the Internet] copyright has tried to enter deep into the private sphere of end-users, thus breaking with two centuries of tradition and practice. ^viii

From our courts, Justice LeBel of the Supreme Court of Canada has sounded a warning about why we ought to tread carefully at the intersection of copyright and privacy:

[an individual's surfing and downloading activities] tend to reveal core biographical information about a person. Privacy interests of individuals will be directly implicated where owners of copyrighted works or their collective societies attempt to retrieve data from Internet Service Providers about an end user's downloading of copyrighted works. We should therefore be chary of adopting a test that may encourage such monitoring. ^ix

Despite such warnings, Canada is proposing to revise copyright law in ways that erode Canadians' personal privacy rights, with consequent erosion of education, intellectual freedom and freedom of expression. The three areas of proposed reform that currently pose the most threat are: (1) anti-circumvention and DRM, (2) ISP liability and (3) photography.

3. Anti-Circumvention and DRM

DRM technologies are designed to automatically manage rights in relation to information. This functionality can include preventing copyright works and other information from being accessed or copied without authorization and establishing and enforcing license terms with individuals.

DRM is used by some copyright holders ostensibly to control access to and use of copyright works. In fact, DRM technology can be used to override fundamental privacy protections. DRM typically uses surveillance to monitor and collect detailed information about people's access to and use of copyright works and other information.

In basic terms, DRM implicates privacy because its continuous surveillance function can provide copyright holders with highly detailed information about the reading, browsing, listening and viewing habits of individuals. Both the nature of this information and the level of its detail are unprecedented. This information about people's browsing, reading, listening and viewing habits is highly sensitive 'core biographical' information. ^x

One of the most insidious aspects of DRM's impact on privacy is the fact that DRM is collecting information while people are engaged in highly private activities in places where they would normally have no expectation that they are being watched. DRM collects information while users are reading, watching or listening to copyright works in the privacy of their homes or other private spaces. In this way, DRM interferes with Canadians' intellectual freedom to access, explore and use copyright works privately or anonymously. DRM leaves no room to enjoy copyright works in private, free from the prying eyes of copyright holders.

The Information and Privacy Commissioner of Ontario wrote about DRM's threats to privacy as early as 2002. ^xi Recognizing the potential privacy implications of DRM, in 2004 the Privacy Commissioner of Canada identified DRM as posing a threat to individuals similar to the threat posed by 'spyware'. ^xii

Our Federal Privacy Commissioner's concern came to fruition in 2005 when a major public outcry erupted over Sony BMG's use of 'rootkit' DRM on millions of music CDs. This single instance of DRM, characterized by experts as a form of 'spyware', created a fundamental privacy and security breach for hundreds of thousands of computer networks and for many more governments, businesses and individuals worldwide. ^xiii Among other consequences, the incident prompted a division of the U.S. Department of Homeland Security to issue a public statement recommending that individuals not install DRM used on music CDs. ^xiv The Sony BMG case is not an isolated incident of problems with DRM. ^xv Class action lawsuits have since been launched against Sony BMG in the United States and Canada. The Texas Attorney General has also commenced an action against Sony BMG, alleging inter alia that the DRM violated the state's spyware and deceptive trade practices laws. ^xvi

The privacy threats posed by the Sony BMG DRM were twofold: first, individuals' personal information was secretly transmitted from their computers to Sony BMG as part of the intended operation of the DRM; ^xvii second, the DRM (and DRM uninstallers) exposed individuals to privacy violations by making them vulnerable to computer viruses and worms. The Sony BMG controversy is representative of the kinds of problems that can arise with DRM. It is not an isolated incident — similar security and privacy problems have arisen in the use of DRM on DVDs. ^xviii

Rather than consulting on privacy and considering copyright reforms that would protect Canadians from the use of DRM (as an increasing number of commentators have suggested we should do), ^xix Canada's former government proposed copyright reforms in Bill C-60 that would provide protection for DRM. These are called 'anti-circumvention' provisions because they protect DRM by making it illegal for people to circumvent DRM. Anti-circumvention laws that protect DRM (as proposed in Bill C-60) have the effect of legitimizing and encouraging the use of these privacy-invasive technologies. Such legal provisions could cripple Canadians' ability to protect their privacy and to enjoy copyright works in private, free from copyright holders' DRM 'spyware'.

Though well-intentioned, data protection law is inadequate for addressing the privacy threats of DRM, principally because it permits the circumvention of privacy by 'agreement'. Non-negotiable standard-form terms of service implemented by DRM sometimes reference this surveillance, for example: "[i]f you are a registered user, you also acknowledge, understand and hereby agree that you are giving us your consent to track your activities…". ^xx However, not surprisingly, people are frequently unaware of this and unwittingly 'agree' to the surveillance.

Related to the threats to privacy, some commentators have pointed out that DRM and anti-circumvention restrictions compromise Canadians' constitutional right of freedom of expression. In response, they suggest that copyright must infringe on freedom of expression "only insofar as is necessary to serve the public interest in a robust marketplace of ideas." ^xxi Access to information, freedom of expression and the exchange of ideas are essential to the promotion of innovation, which is a core element of the purpose of copyright. These are compromised by DRM and anti-circumvention laws.

It is difficult to reconcile the use and legal protection of DRM with individuals' rights to personal privacy, intellectual freedoms and freedom of expression. One might ask whether DRM technologies ought to receive legal protection at all, and for more than just the privacy reasons raised here. ^xxii However, if DRM is to receive the protection of law at all, then individuals' privacy rights and the public interest in those rights must be accounted for and protected. Proposals for addressing these rights have already been made ^xxiii and could be adopted by the Canadian government, including, for example:

• Include an express provision prohibiting the circumvention of privacy by TPM/DRM, notwithstanding licence provisions to the contrary;
• Include an express provision stipulating that a DRM licence is voidable when it violates privacy law; and
• Include an express provision permitting the circumvention of TPM/DRM for personal information protection purposes. ^xxiv

In addition, it is important that Canada ensure a privacy-preserved means of access to creative works. For example, Canada might legally enshrine the rights of Canadians to access and enjoy copyright works in private by enacting a legal requirement for anonymous or pseudonymous access to and use of copyright works, just as we have in the real world when we visit libraries and engage in other activities. ^xxv Protecting personal privacy in this context is essential for intellectual freedom, freedom of expression, and innovation, all of which complement copyright policy goals.

4. Internet Service Provider Liability

Bill C-60 proposed a 'notice-and-notice' system to address ISP liability. Under this system, copyright holders could issue notices of alleged copyright infringement to ISPs. ISPs would be required to forward these notices to the relevant subscriber. They would also be required to retain identity data about their customers for six months. If the copyright holder commenced a lawsuit within that time, then the ISP would have to retain the identity data for a further year.

The ISP proposals in Bill C-60 raise a number of questions regarding privacy. For one, requiring ISPs to retain customer data for six months conflicts with the courts' view regarding the reliability of personal information held by ISPs. In BMG Canada v. John Doe, ^xxvi the court refused to order disclosure of identity information where there had been a delay of approximately six months between the copyright holders' investigation and the filing of the application in court. Based on the evidence of the ISPs, the court confirmed that the delay gave rise to a risk that the identity information would be inaccurate. Anxious to avoid violating the privacy of innocent people and exposing them to lawsuits, the court declared that "the greatest care should be taken to avoid delay between the investigation and the request for information." ^xxvii Use of unreliable information may lead to lawsuits improperly being filed against innocent people and is more likely to result in unjustified privacy violations. Bill C-60 is also silent about precisely what information ISPs must retain, leaving privacy protection in doubt.

In addition, Bill C-60's regime for ISP data retention in response to copyright infringement allegations is inconsistent with our understanding of Justice Canada's proposed regime for ISP data retention under judicial "Preservation Orders" for criminal law enforcement purposes. We understand that retention in such cases would be for 90 days. ^xxviii If 90 days is sufficient for criminal law enforcement purposes, why is a longer period required for civil actions under copyright law?

Bill C-60 could help address the privacy implications of ISP data retention by minimizing the time period for the retention of data and requiring ISPs to retain only the name and last known address of the subscriber. Further, to help ensure that privacy is consistently protected, Bill C-60 could specifically spell out a privacy-respecting test for courts to apply in determining whether to order ISPs to release subscribers' information in copyright disputes.

In the area of ISP liability, it is important to be aware that some copyright holders are expected to lobby for a 'notice-and-takedown' regime or even a 'notice-and-termination' regime. These regimes would require ISPs to take down individuals' content, block their communications or even terminate their Internet access when a copyright holder issued a mere allegation of infringement to an ISP. Such extra-judicial 'self-help' regimes have obvious negative implications for individuals' rights of privacy and freedom of expression. These proposals should be rejected as the government has done to date.

A court order should always be required before an ISP discloses the personal information of its customers or takes any other action ^xxix on the basis of a mere allegation from a copyright holder. As one Ontario court has pointed out, there are good public policy reasons for protecting the privacy of individuals' online activities:

In keeping with the protocol or etiquette developed in the usage of the internet, some degree of privacy or confidentiality with respect to the identity of the Internet protocol address of the originator of a message has significant safety value and is in keeping with what should be perceived as being good public policy. ^xxx

5. Photographs and Consumers

Bill C-60 proposed changes to copyright in two key areas of photography that would take away consumer rights in their photographs and negatively impact their privacy interests.

First, the bill would have repealed section 10 of the Copyright Act. This change would mean that (1) photographers would always be the first author and owner of copyright in photographs (unless they took the photos in the course of their employment) and (2) that the term of copyright protection would run for their life plus 50 years. This proposed amendment does not account for the fact that individuals often hand their camera to strangers and ask them to take a picture of, for example, the person and their spouse or family at Niagara Falls. The repeal of section 10 would mean that the stranger, not the consumer, would own copyright in the resulting photographs in such circumstances for their life plus 50 years. They could also sell copyright in the photographs. The current version of section 10 does not give rise to these copyright and privacy problems.

Second, today consumers own copyright in personal photographs that they hire and pay a photographer to take, including but not limited to their wedding photos, babies' first photographs, portraits, and pet portraits. Bill C-60 would have changed this. Under the bill, photographers would automatically own copyright in consumers' personal photographs, including the right to sell copyright. Consumers who commission photographs would have to bargain for copyright in their own photographs and could be at the mercy of the photographer (or whomever the photographer sold copyright to) for decades.

There is no justification for altering the Copyright Act in the area of consumer-commissioned photographs — there is no problem in need of addressing in this area. The Chair of the Senate Committee that studied the issue arrived at a similar conclusion when it looked at a virtually identical reform proposal in the area of photographs: "… [in repealing section 10 and subsection 13 (2) of the Copyright Act, Bill S-9] has been written so broadly that it sweeps in consumers which — trust me — it was not intended to do, but nevertheless does." ^xxxi

Bill C-60 did not provide consumers with sufficient control over personal photographs that they commission and pay for. Although privacy law would provide consumers with some limited rights of restraint where personal information is at issue, default copyright ownership under the current Copyright Act provides consumers with protections in critical areas where privacy laws do not (e.g. non-commercial or artistic uses of consumer-commissioned photographs by a photographer). It is also important to note that the definition of "personal information" found in Canada's privacy laws would leave consumers with no rights in cases where their photographs are private but do not fit the legal definition of "personal information".

Proposals for addressing privacy issues in the area of photography have already been made and could be adopted by the government. ^xxxii For example, Canada might adopt a model for commissioned works currently use in Australia. This common sense model vests copyright in all photographs commissioned for private or domestic purposes with the commissioner (e.g. the consumer) but allows the photographer to restrain uses (e.g. commercial uses) not contemplated at the time of commissioning. ^xxxiii

6. Conclusion

This short paper has outlined several of the ways that Canada's proposed copyright reform threatens individuals' rights of privacy, intellectual freedom, and freedom of expression. It is not only critical that these threats be addressed in the current reform proposals, but also that Canada resist the pressure that some copyright holders are expected to apply in pursuit of laws that would be even more damaging.

Endnotes

ⁱ Privacy Commissioner of Canada, Letter to CIPPIC, (24 November 2004), online: CIPPIC <http://www.cippic.ca/en/news/article.html?69> ["Privacy Letter"]. (Return to Text)

ⁱⁱ In 2005, Canada's former government tabled Bill C-60 — An Act to Amend the Copyright Act. This proposed legislation represents the most recent expression of possible copyright reform in Canada. This paper uses some of the provisions of Bill C-60 as a reference for discussion. (Return to Text)

ⁱⁱⁱ The term 'copyright holder' in this letter refers primarily to the 'major' music labels and others. Other Canadian labels and artists have openly opposed the tactics of the majors in a number of the areas discussed in this letter. See e.g.
Canadian Music Creators Coalition http://www.musiccreators.ca/, Rock band shows fans how to crack DRM, My Morning Jacket Tackle Copy-Protection Software Problems — By Burning CDs For Fans and <http://www.thestar.com/NASApp/cs/ContentServer?pagename=thestar/Layout/Article_Type1&c=Article&cid=1138661412175&call_pageid=970599119419>.

The question of which groups are driving copyright's conflict with privacy, along with the question of what interests those groups represent, should be scrutinized by government. For example, it certainly seems significant for Canadian copyright policy that nearly 90 percent of Canadian new music is created by the smaller, independent music labels in Canada, not the majors represented by CRIA. See the Daily — 2003 Sound recording. (Return to Text)

^iv In Canada, see BMG Canada Inc. v. John Doe, 2005 FCA 193, 2004 FC 488, online: CanLII http://www.canlii.org/ca/cas/fca/2005/2005fca193.html. (Return to Text)

^v See e.g. Wired: How Can I Swap Safely? (Return to Text)

^vi American Library Association, "An Interpretation of the Library Bill of Rights", online: ALA Interpretations of the Library Bill of Rights (Return to Text)

^vii Graham Greenleaf, "IP, Phone Home: Privacy as Part of Copyright's Digital Commons in Hong Kong and Australian Law" in Lawrence Lessig, ed., Hochelaga Lectures 2002: The Innovation Commons (Kong: Sweet & Maxwell Asia, 2003). (Return to Text)

^viii Daniel Gervais, "Use of Copyright Content on the Internet: Considerations for Excludability and Collective Licensing" in Geist, In the Public Interest, supra note ii at 531, 548. (Return to Text)

^ix Society of Composers, Authors and Music Publishers of Canada v. Canadian Association of Internet Providers, 2004 SCC 45, at para. 155. (Return to Text)

^x This was confirmed by Justice LeBel in Society of Composers, Authors and Music Publishers of Canada v. Canadian Association of Internet Providers, 2004 SCC 45, at paras. 153–55. See also, Article 29 Data Protection Working Party, "Working document on data protection issues related to intellectual property rights" (18 January 2005), online: Working document on data protection issues related to intellectual property rights (PDF 44 KB, 8 pages) (Return to Text)

^xi Information and Privacy Commissioner/Ontario, "Privacy and Digital Rights Management (DRM): An Oxymoron?" (October 2002), <http://www.ipc.on.ca/docs/drm.pdf>. (Return to Text)

^xii "Privacy Letter", supra note i. (Return to Text)

^xiii See e.g. BBC News, "Microsoft to remove Sony CD code" (14 November 2005) online: http://news.bbc.co.uk/1/hi/technology/4434852.stm;
Hiawatha Bray, "Security firm: Sony CDs secretly install spyware" The Boston Globe (8 November 2005), online: http://www.boston.com/business/technology/articles/2005/11/08/security_firm_sony_cds_secretly_install_spyware/. (Return to Text)

^xiv U.S. Computer Emergency Readiness Team, "First 4 Internet XCP (Sony DRM) Vulnerabilities" (15 November  2005), online: http://www.us-cert.gov/current/archive/2005/12/13/archive.html#xcpdrm. ["Do not install software from sources that you do not expect to contain software, such as an audio CD."]. (Return to Text)

^xv Similar problems have arisen with the use of DRM on DVDs. See e.g. Heise Online, "DVD Copy Protection Creates Security Risk" (14 February 2006), online: <http://www.heise.de/english/newsticker/news/69608>. (Return to Text)

^xvi See e.g. <http://www.eweek.com/article2/0,1895,1891501,00.asp>. (Return to Text)

^xvii See http://www.boston.com/business/technology/articles/2005/11/08/security_firm_sony_cds_secretly_install_spyware/. (Return to Text)

^xviii See <http://www.heise.de/english/newsticker/news/69608>. (Return to Text)

^xix See e.g. Ian Kerr, "If Left to Their Own Devices…: How DRM and Anti-Circumvention Laws Can Be Used to Hack Privacy" in Geist, In the Public Interest, supra note ii; http://michaelgeist.ca/index.php?option=com_content&task=view&id=1052&Itemid=85. (Return to Text)

^xx See e.g. MTV, "Privacy Statement" <http://www.mtv.com/overdrive/> [emphasis added]. (Return to Text)

^xxi Provisions in Bill C-60 that restrict the activities of schools and libraries arguably similarly implicate freedom of expression. (Return to Text)

^xxii For example, DRM is widely criticized for more directly undermining the balance in copyright by locking out access and fair dealing with works. (Return to Text)

^xxiii See e.g. Kerr, "If left to Their Own Devices", supra note xiv,
Alex Cameron, "Infusing Privacy Norms in DRM: Incentives and perspectives from law", in Yves Deswarte, et al. (Eds.), Information Security Management, Education and Privacy, IFIP 18th World Computer Congress, TC11 19th International Information Security Workshops, 22–27 August 2004, Toulouse, France (Kluwer 2004). (Return to Text)

^xxiv Kerr, "If left to Their Own Devices", supra note xiv. (Return to Text)

^xxv The importance of this principle is recognized by, among others, the Article 28 Data Protection Working Party, supra note ii at 5 and in a similar vein has been characterized as good public policy in Canada: see e.g. Irwin Toy Ltd. v. Doe [2000] O.J. No.3318 (S.C.J.). (Return to Text)

^xxvi BMG v. Doe, supra note v at para. 43. (Return to Text)

^xxvii Ibid. (Return to Text)

^xxviii As of March 13, 2006, this proposal had not been introduced in Parliament, but we understand that it will form part of a broader "Lawful Access" package to be introduced this year. (Return to Text)

^xxix That is, any action beyond forwarding a notice and, if available, retaining minimal identity information. (Return to Text)

^xxx Wilkins J., in Irwin Toy Ltd. v. Doe [2000] O.J. No.3318, S.C.J. (Return to Text)

^xxxi Canada, Standing Senate Committee on Social Affairs, Science, and Technology, Minutes of Proceedings (3 November 2004). (Return to Text)

^xxxii Alex Cameron, "Lights, Camera,… Harmonize: Photography Issues in Copyright Reform" in Geist, In the Public Interest, supra note ii. (Return to Text)

^xxxiii Ibid.. With respect to the section 10 issue, Cameron suggests that the individual who owns the negatives or the photographs in such circumstances could be deemed to be the author of the photograph. This would essentially involve retaining subsection 10(2), but only for "personal" situations and only where the person who owns the negatives is a natural person. (Return to Text)