Home -> Law Blog Directory -> Copyright Law Blogs -> Michael Geist

Copyright Law

: Michael Geist

61 Reforms to C-61, Day 30: TPMs - Anti-circumvention and Privacy

By Michael Geist

The inclusion of a privacy exception within Bill C-61's anti-circumvention provisions was not particularly surprising given that the U.S. DMCA includes one and there has been mounting concern about the privacy implications of DRM.  The issue has captured the attention of the Canadian privacy community for the past few years.  In 2006, a group of privacy and civil liberties organizations and experts sent a public letter to the responsible ministers calling for assurances that:

1. any proposed copyright reforms will prioritize privacy protection by including a full privacy consultation and a full privacy impact assessment with the introduction of any copyright reform bill;
2. any proposed anti-circumvention provisions will create no negative privacy impact; and
3. any proposed copyright reforms will include pro-active privacy protections that, for example, enshrine the rights of Canadians to access and enjoy copyright works anonymously and in private.

The group (of which I am a member) sent a follow-up letter earlier this year as did Privacy Commissioner of Canada Jennifer Stoddart, who posted a public letter expressing concern that copyright reform could have a negative impact on privacy. Given those concerns, an exception to protect personal information is not unexpected. However, Section 41.14 fails to provide Canadians with full privacy protection and Bill C-61 unquestionably makes it more difficult for Canadians to effectively protect their privacy.  
The reason for this is that though there is an exception that permits circumvention to protect (and prevent the collection or communication of) personal information, the ability to exercise this exception is rendered difficult by virtue of the inability to legally obtain devices (ie. software programs) for this very purpose.  Section 41.14(2) states that a person can offer circumvention devices or services for the protection of personal information only "to the extent that the services, technology, device or component do not unduly impair the technological measure."

Bill C-61 does not include a definition of "unduly impair."  However, according to an Industry Minister official (who was responding to a journalist inquiry):

"The intent of the provision is to ensure that while individuals may obtain devices and services that circumvent technological measures with a view to protecting privacy, any ensuing circumvention of the technological measure cannot be done in a manner that would enable unauthorised uses of the underlying copyright material by that person or by a third party."

In other words, you can use a circumvention device to protect your privacy but it cannot allow you to simultaneously access the underlying content.  Of course, once most circumvention devices circumvent a technological measure, the protected content will be in the clear.  Distribution of this form of device is therefore illegal.  Moreover, service providers will be likely be unwilling to use this provision for fear of facing liability.  Not only should the "unduly impair" wording be removed, but the bill should place a positive obligation on those companies that use DRM that may raise privacy concerns to provide the keys to circumvent their technological measure where requested to do so for privacy purposes.

Full post as published by Michael Geist on August 01, 2008 (boomark / email).