CONTENTS PAGE Introduction .............................. 1 What is Privacy?........................... 2 Public Concerns with Privacy .............. 3 Privacy Concerns in Telecommunications ..... 3 The Context of Privacy in Canada ........... 5 Telecommunications Privacy Protection in Federal Jurisdiction ......... 6 The Need for Telecommunications Privacy Principles ......................... 7 Conclusion ................................. 8 APPENDIX Telecommunications Privacy Principles INTRODUCTION The development of computer-based telecommunications technologies and services raises the need to consider privacy issues in telecommunications. There is now a great deal of personal information that can be collected, transmitted, stored, manipulated and re-transmitted. As well there is a need for information about users and their activities which can be exchanged and shared between the carriers and the service providers involved in providing end-to-end telecommunications services. The Minister of Communications has the unique responsibility of ensuring that Canadians have access to efficient and affordable telecommunications services, while at the same ensuring a balance between technological, economic and social priorities. In this context, the Department of Communications has a leadership role to play in balancing privacy interests of individuals and the economic and social benefits of advanced telecommunications services and products. This paper is concerned with the privacy implications of telecommunications services made possible by new technology and market changes. Its particular focus is that privacy issues in this area should be dealt with as a telecommunications specific matter, taking into account the need to balance the cost against the benefits of telecommunications service innovations. The paper proposes that privacy principles (see Appendix), developed through a public consultation process for implementation by the telecommunications carriers and service providers are the most effective way of responding to privacy issues in telecommunications today. 2. WHAT IS PRIVACY? One definition which has gained considerable acceptance describes privacy as a universal human value which has several dimensions: - solitude: the right not to be disturbed - anonymity: the right not to be known - intimacy: the right not to be monitored - reserve: the right to control one's personal information - 2 - In the narrower context of telecommunications, privacy can be seen to have two distinct, but related, aspects: - protection against unwanted intrusion, i.e., the right to be left alone and not to be monitored; - the ability to control information about oneself and one's activities, i.e., the right to reserve and anonymity. Advances in unications, coupled with computer software, have revolutionized communications. These same developments now appear to present both threats and opportunities with regard to basic privacy tenets. There are two key factors associated with this development. First, more and more personal and business transactions are conducted electronically over telecommunications networks. Second, computer-based telecommunications and information services are making it easier and cheaper to collect, store, access, match and redistribute information about transactions and individuals. There are other developments which add to potential concerns about privacy, such as the proliferation of data banks and the growth in the international exchange of personal data. These, however, fall outside the scope of this paper. PUBLIC CONCERNS WITH PRIVACY Concern about privacy and information technologies has been rising in the past decade. Public surveys conducted on this subject in Canada and in the US point to a growing sense of unease, as consumers discover the amount of information about them being collected, stored and processed via electronic means and that these activities could present a potential threat to their privacy. PRIVACY CONCERNS IN TELECOMMUNICATIONS Telecommunications privacy is not a new issue. Many can remember the inconveniences of shared party-lines or of telephone operators on manual exchanges or PBX's. Private lines and direct long distance calling have gone a long way in making telephone communications more private and thereby raising the expectations of privacy for subscribers. However, there is evidence that the public perceives the telephone as an important source of privacy invasion. - 3 - A 1988 U.S. survey found, for example, that nearly three out of ten respondents identify their telephone service as the most important source of privacy invasion. The most frequent response was telephone tapping (14%) followed by telemarketing (12%). Another survey conducted in 1990 by Louis Harris and Associates found that respondents considered "keeping computerized records of telephone calls" more dangerous than maintaining records of political affiliations, or the results of psychological or intelligence tests. Dr. James E. Katz, an expert on telecommunications privacy from Bellcore, observed that while privacy experts focus on the privacy implications of telecommunications and computer technology, by contrast the public's concerns with privacy seem to focus mainly on the concrete and visible manifestations of privacy invasion and these appear to be associated with (1) the telephone and (2) access to and distribution of personal information over telephone lines. This observation suggests that public concern with privacy in telecommunications could increase sharpely in the near future. This would be the case particularly if the potential for privacy erosion becomes more visible to the public as new telecommunications services, such as automatic number identification and telemarketing, are introduced on a large scale. Furthermore, the rapid pace of change in telecommunications technology and services will almost certainly add to the public disquiet about privacy invasion, especially if people think that they are not in control or feel vulnerable to the technology. Privacy threats presented by some of the current telecommunications services are as follows: Cellular Telephones. Conversations which take place over cellular telephones can be easily monitored, and therefore afford less privacy to the user than conventional telephones. While the - 4 - introduction of digital cellular telephones will provide some measure of privacy through encryption, the expected growth of wireless communications (for example cordless phones, wireless local area networks, etc.) could raise privacy concerns. Automatic Calling Equipment. This equipment has led to a proliferation of unsolicited and intrusive computer generated telemarketing calls. These calls have prompted hundreds of complaints to the Department of Communications and the Canadian Radio-television and Telecommunications Commission (CRTC). Most of these complaints involve being called several times a day, telephone lines being tied up for several minutes and the inability to reach the source of the calls. Customer Proprietary Network Information. Data on customers calling behaviour, such as location, frequency and duration of calls, collected by telephone companies for billing and other operational purposes can be used to establish customer profiles and sold to marketing companies; this could create new privacy invasion. Advanced Facsimile Machines. The huge increase in the use of fax machines at work and home has resulted in a significant increase in "junk" faxes and higher long distance telephone bills. Caller Identification. This telephone feature known as the Call Management Service shifts the balance of privacy by giving the called party access to the caller's telephone number. This feature, also available to users of the "800 Plus" service, creates a certain conflict between the two dimensions of privacy mentioned previously: solitude or the right to be left alone and reserve or the right to control one's personal information. Many believe that the called party has a right to know who is calling, using the analogy that one does not open one's door without seeing who is knocking. Caller ID has help reduce crank calls, especially those that are obscene or harassing. As a new service, it has sold very well where it has been offered. On the other hand, the CRTC has received some 1,300 complaints in connection with the caller ID service. In response, the CRTC recently decided to require telephone companies offering the Call Management Service to provide call display blocking free of charge to subscribers who request it. These examples also point to another important aspect of privacy in telecommunications: that individual subscribers can choose among a variety of communications services and devices with differing degrees of privacy protection. The Call Management Service, for example, offers optional call identification and call trace features which provide subcribers - 5 - with additional privacy protection. On the other hand, cellular phones and facsimile machines have become popular despite their vulnerability to intrusion. The point is that today's marketplace offers customers a range of communication options to chose from, each with its advantages and disadvantages as regards privacy. THE CONTEXT OF PRIVACY IN CANADA In Canada, there are data protection laws at the federal level and in the provinces of Quebec and Ontario. These laws, all of which are subject to oversight by independent agencies, create codes of fair information practices governing the collection, use and disclosure of personal information held by departments and agencies of their respective governments. The Quebec law is broadest in application and the Quebec government plans to introduce legislation that will expand privacy provisions to the provincially regulated private sector. In addition, recent revisions to the Civil Code in Quebec establish clear principles respecting the right to privacy in both the public and private sector. Canada's Charter of Rights and Freedoms does not provide explicit protection for privacy. However, judicial interpretations of Section 8 of the Charter, "the right to be secure against unreasonable search or seizure," have recognized the individual's reasonable expectations of privacy. The Quebec Charter of Human Rights and Freedoms offers strong privacy provisions. It provides that any person has a right to respect for his or her private life. Canada's Criminal Code makes the unlawful interception of private communications a criminal offence. "Private communication" includes a "telecommunication" which is made under circumstances where it is reasonable for the originator to expect that it will not be intercepted. In an attempt to establish international standards for the protection of personal information and transborder flows of personal data, the Organisation for Economic and Cooperative Development (OECD), of which Canada is a member, developed in 1982 a set of privacy guidelines. These guidelines are intended to overcome difficulties in protecting personal data rights in different jurisdictions. The OECD encouraged member countries to adopt these guidelines and urged companies to adopt voluntary privacy codes based on those guidelines. However, in the ten years since their introduction, compliance within member countries has been uneven. In Canada, efforts by the private sector to implement this code have been disappointing. - 6 - TELECOMMUNICATIONS PRIVACY PROTECTION IN FEDERAL JURISDICTION The Minister's authority for telecommunications derives from the Department of Communications Act which sets out his mandate in broad terms and includes the power to "recommend, coordinate and promote national policies and programs with respect to communication services for Canada" and to "assist Canadian communications systems and facilities to adjust to changing domestic and international conditions." The Minister could, for example, promote privacy and data protection guidelines for the telecommunications services industry. The recently introduced telecommunications legislation (Bill C-62), includes a specific reference to privacy protection as a policy objective of the Bill. This reference will require the CRTC to address privacy issues when exercising its regulatory responsibilities. The Bill also grants the CRTC the power to regulate, taking into account users' rights to freedom of expression, certain categories of unsolicited telecommunications transmitted over the telecommunications facilities of a Canadian carrier. Under the Radiocommunication Act, the Minister has responsibility for the issuance of radio licences. The Act makes it an offence to intercept and divulge any radiocommunication other than broadcasting (for example, a conversation on a cellular telephone) except as permitted by the originator or otherwise permitted by regulations made under the Act. It is important to note that, in the field of radiocommunications, interception in itself is not an offence unless the communication is used or divulged. In Canada, there has been no court case involving, for example, the unlawful interception of cellular telephone communications. The Department of Communications is reviewing its public education role with a view to improving the public's awareness of the potential lack of privacy associated with the use of cellular phones. The CRTC's Terms of Service for federally regulated telephone companies provide a means by which privacy and confidentiality practices can be monitored and enforced. These regulations include a confidentiality provision which sets out the rights and obligations of both the company and its customers. They also prevent disclosure of personal information regarding the customer, other than the customer's name, address and listed telephone number, without authorization in writing unless legally required. However, this provision does not prevent the telephone company from providing the customer's name, address and telephone number to third parties such as telemarketers. - 7 - There have been several initiatives in the private sector to address privacy issues, mainly in the form of privacy guidelines or principles. Industry associations such as the Canadian Bankers Association, who are heavy users of telecommunications services, the Canadian Cable Television Association (CCTA), Stentor, the Canadian Direct Marketing Association and the Canadian Standards Association have developed, or are developing, privacy guidelines for their members. In addition, a national survey of Canadians' attitudes towards privacy is currently being planned with the participation of the federal Privacy Commissioner's Office, Stentor, Consumer and Corporate Affairs and the Department of Communications, as well as various industry organizations and other federal Departments. THE NEED FOR TELECOMMUNICATIONS PRIVACY PRINCIPLES Despite the many public and private initiatives under way to address the public's concerns over privacy protection in telecommunications, there is a need for greater coherence and focus. While the planned telecommunications legislation would give the CRTC the power to regulate privacy protection in telecommunications, the government remains responsible for providing public policy guidance in this area. A comprehensive policy framework on privacy in telecommunications is needed. A set of privacy principles would provide this policy framework. The Minister of Communications proposes therefore to develop, through a public consultation process, a set of telecommunications privacy principles for implementation by telecommunications carriers and service providers. These principles, with a statutory basis provided by the proposed telecommunications legislation (Bill C-62), would articulate public expectations for privacy in telecommunications services. They would provide the public, the regulator and the telecommunications industry with an effective framework within which to assess the privacy implications of new services and develop, and enforce, appropriate privacy safeguards in the rapidly changing telecommunications environment. This approach is supported by the Privacy Commissioner. These telecommunications privacy principles could also serve as a response to the European Community Directives on Data Protection. Canada's Privacy Commissioner has warned that the Directives, if they become law, could become a non-tariff trade barrier to Canadian companies wishing to do business with the EC members. - 8 - There are some options which can be considered for implementing the principles. One option is to encourage telecommunications carriers and service providers to implement them on a voluntary basis. This approach would be less intrusive and more flexible than regulations, particularly with the fast- changing technology of the telecommunications environment. It is similar to the approach taken for implementing the OECD guidelines and to the approach taken by a number of private sector organisations such as the Canadian Banking Association, the Canadian Standards Association, the Canadian Cable Television Association and Stentor. Another option is to enforce the principles through regulation. This approach would require a statutory basis under which the regulations could be drafted. At present it is unclear what current legislation in federal jurisdiction could be used to make the privacy principles binding on the telecommunications industry. However, passage of the telecommunications legislation (Bill C-62) by Parliament would provide a statutory basis for enforcing privacy protection. As mentioned, the legislation will require the CRTC to consider privacy issues when exercising its regulatory powers. The CRTC could also use the principles as guidelines for regulating privacy in telecommunications. CONCLUSION There is a growing public concern with privacy threats brought about by computer-based telecommunications services. Privacy issues are also the subject of a large body of literature by experts who warn governments and industry that privacy may well become one of the most important social issues of the information age. In this context, it is vital that this important issue be subject to full and open public debate. While the concept of privacy may seem simple enough, the development and practical implementation of policy raises difficult problems in balancing the privacy interests of individuals against the economic and social benefits of advanced telecommunications services and products. The Minister of Communications therefore submits the attached Telecommunications Privacy Principles for public comment. Public comment is also invited on appropriate methods for implementing the principles. TELECOMMUNICATIONS PRIVACY PRINCIPLES PREAMBLE In introducing these five principles, I am proposing a basic code of conduct for addressing privacy issues in the provision of telecommunications services. In this context I understand privacy to mean: - protection against unwanted intrusion, that is the right to be left alone and not to be monitored; - the ability to control information about oneself, and one's activities, that is the right to reserve or to remain anonymous. At the heart of these principles is the belief that privacy considerations must be explicitly recognized as a factor in the provision and regulation of telecommunications services. Users shouthe right to expect a basic level of privacy from their telephone system as well as to be informed about those factors that may affect their privacy. These principles are intended to ensure that the public's demands for more efficient and sophisticated telecommunications services are balanced with appropriate safeguards for the privacy of individual users. They also recognize that the privacy needs of different groups of users can vary and that it is necessary to strike a balance between these various needs. PRINCIPLES Canadians have become accustomed to having one of the best telecommunications systems in the world. Users expect to be able to communicate with other Canadians easily and at reasonable rates. Users also expect that their privacy will be protected when using telecommunications services: 1. CANADIANS VALUE THEIR PRIVACY. PRIVACY CONSIDERATIONS MUST BE RECOGNIZED EXPLICITLY IN THE PROVISION, USE AND REGULATION OF TELECOMMUNICATIONS SERVICES. ****** - 2 - With rapid advances in telecommunications technology, both aspects of user privacy, that is the ability to control the outflow of information about oneself and to be protected against unwanted intrusion, are now in jeopardy. Many Canadians are unaware of these potential threats to their privacy: 2. CANADIANS NEED TO KNOW THE IMPLICATIONS OF THEIR USE OF TELECOMMUNICATIONS SERVICES FOR THEIR PERSONAL PRIVACY. TELECOMMUNICATIONS SERVICE PROVIDERS AND GOVERNMENT HAVE A RESPONSIBILITY TO PROVIDE THIS INFORMATION. ****** Computer technology in telecommunications networks enables service providers to offer and consumers to choose from a variety of services with varying degrees of privacy protection. Some services, such as the use of caller display, which displays the caller's phone number on the receiver's set, or the use of cellular phones, present advantages for many users. However, they are also seen by others as a threat to the level of privacy which they have come to expect from their telephone system: 3. WHEN TELECOMMUNICATION SERVICES ARE INTRODUCED THAT COMPROMISE CURRENT LEVELS OF PRIVACY, APPROPRIATE PROVISIONS MUST BE MADE TO RESTORE THESE LEVELS OF PRIVACY UNLESS THERE IS GOOD CAUSE FOR NOT DOING SO. CONSUMERS SHOULD NOT HAVE TO PAY EXTRA FOR MAINTAINING CURRENT LEVELS OF PRIVACY. ****** Modern telecommunications networks and services contain a host of features which make them more efficient. However, these features also make it easier to collect, store, access, match and redistribute information about transactions and individuals who use them. Privacy concerns arise when this information is made available to third parties without the consent of the individuals involved. - 3 - 4. IT IS FUNDAMENTAL TO PRIVACY THAT THERE BE REASONABLE LIMITS TO THE COLLECTION, USE AND DISCLOSURE OF PERSONAL INFORMATION GENERATED BY TELECOMMUNICATIONS NETWORKS AND SERVICE PROVIDERS. EXCEPT WHERE CLEARLY IN THE PUBLIC INTEREST, OR AS REQUIRED BY LAW, SUCH INFORMATION SHOULD BE COLLECTED, USED AND DISCLOSED ONLY WITH THE EXPRESS CONSENT OF THE PERSONS INVOLVED. ****** Changes in telecommunications technology and services may in time alter our privacy expectations. This could lead to greater privacy expectations as users demand more protection against real or perceived threats to their privacy: 5. PRIVACY EXPECTATIONS OF CANADIANS MAY CHANGE OVER TIME. METHODS OF PROTECTING TELECOMMUNICATIONS PRIVACY MUST BE REVIEWED FROM TIME TO TIME TO MEET THESE CHANGING EXPECTATIONS. ****** Perrin Beatty Minister of Communications