On April 3, 2017, President Donald Trump signed into law the bill repealing Internet privacy protections that were approved by the Federal Communications Commission ("FCC") shortly before Donald Trump won the election. Now internet service providers ("ISPs") may track and sell the browsing habits of their customers without their knowledge or consent. This bill also prevents the FCC from enacting similar rules in the future.
The FCC rules, which were not yet in effect, would require ISPs to get consent from a consumer before disclosing his or her data to advertisers or other third parties. The repeal of these rules was backed by major U.S. telecoms who argued that ISPs were subject to stricter privacy laws than other data-collecting companies like Google or Facebook, which are overseen by the Federal Trade Commission and its less stringent privacy guidelines. These internet companies had a competitive advantage since they were able to collect personal information to target ads, whereas telecom companies could not.
ISPs have an enormous amount of data on individuals which they are able to collect from browsing behaviour – information that could relate to health concerns, geolocation, shopping habits and what apps you use. This is valuable information to advertisers and ISPs may be free to monetize consumer's browsing history.
Despite the possibility of being able to sell browsing histories, the major U.S. ISPs have stated that they have no intention of actually selling individual web browsing history of their customers and that they take consumer privacy very seriously, rightfully noting they do have privacy and data security obligations pursuant to the existing legislative framework.
What does this mean for Canadians? It has very little direct impact, unless you have an account with a U.S. ISP. Further, Canada is unlikely to follow the U.S. approach since it would be in conflict with the position taken by the regulators, including the Office of the Privacy Commissioner of Canada (the "OPC").
In Canada, ISPs cannot use your personal information for targeted advertising purposes unless you have given express opt-in consent. This was confirmed in 2015 by the OPC following their investigation into Bell's "Relevant Ads Program". This program would allow Bell to use subscriber information, such as webpages visited from a mobile device, postal code, gender, age range and payment patterns, to serve Bell customers with targeted advertising unless the customer specifically opted-out. Bell charged third parties a fee to deliver ads targeted at customers' specific interests. The OPC was of the view that this program violated Canadian privacy laws and concluded that use of an opt-out consent mechanism was not sufficient in this instance. Due to the sensitivity of the information, combined with the reasonable expectations of the consumer, it was decided that express opt-in consent was required.
This places Canada and the U.S. on opposite ends of the spectrum when it comes to the commercialization of data by ISPs. It will be interesting to see whether this may cause issues related to international trade negotiations. In particular, the North American Free Trade Agreement ("NAFTA") renegotiation is expected to start within the next few months, sparking the concern that the US may want Canada to adopt a similar approach to facilitate U.S. marketers doing business in Canada. We'll have to watch and see how this and other digital economy issues play out over the upcoming months and into the NAFTA negotiations.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
