Keeping Internet users in the know, or in the dark?

OSHAWA, ONTARIO – A new study of Canada’s Internet service provider (ISP) industry gives consumers a new tool to monitor how well their ISP is doing at safeguarding the privacy of personal information. The report Keeping Internet Users in the Know or in the Dark? culminates years of research by Dr. Jonathan Obar of the University of Ontario Institute of Technology (UOIT) and Professor Andrew Clement of the University of Toronto.

With the help of students at the University of Toronto’s Centre for Innovation Law and Policy, the researchers examined the data privacy transparency of 43 large and small ISPs that provide Internet and mobile services to Canadians.

• Link to full report

Dr. Obar and Prof. Clement have created a ranking system based on various privacy transparency criteria, such as:

• Stated compliance with Canadian privacy law.
• Information about where data is processed, stored and routed.
• Whether personal data is disclosed to security agencies and other third parties.
• Stated avoidance of data transfer to U.S. entities that could expose data to surveillance by the U.S. National Security Agency (NSA).

“Canadian consumers have much to be concerned about with the findings of this study,” said Dr. Obar, Assistant Professor with UOIT’s Faculty of Social Science and Humanities. “While some carriers have made notable improvements since our first study two years ago, most have a long way to go. The bottom line, our internet and mobile providers must do more to help Canadians protect their personal data in a world where increasingly, digital dossiers and big data are being used to determine who gets to cross the border, who gets stopped by the police, and someday soon, who gets into university, who gets a loan, and who gets a job.”

Key findings

• Internet carriers are generally not transparent about their handling of personal information.
• No carrier earned a full star for any of these four criteria:
  • A public commitment to inform users of all third-party data requests.
  • The normal retention periods for personal information.
  • Transparency about where personal information is stored and/or processed.
  • Transparency about where personal information is routed.
  • The ‘fighting brands’ of major mobile carriers, Virgin Mobile, Fido and Koodo, all score below average and are significantly less transparent than their corporate owners, Bell, Rogers and Telus respectively.
  • Only one company stands out by earning more than five stars (TekSavvy).
  • For the first time in 2014, Canadian internet carriers have begun issuing Transparency Reports.
  • No foreign transit provider indicates explicit compliance with Canadian privacy law. 

“As more and more aspects of our lives are being lived online, whether on the computer or on our mobile devices, Canadians need to ensure that entrusting data with an ISP is coupled with the protection of our digital destinies,” said Dr. Obar. “The good news is that Canadian ISPs are beginning to respond to public pressure in this area, but more is needed.”

Selected media links from March 12, 2015

• CBC News
• National Post
• Huffington Post