The Digital Privacy Act

Should businesses require a court order before asking internet service providers to disclose the personal information of their online users? Or should those users have a reasonable expectation of privacy, even when they are infringing copyright laws?

Earlier this months, the Digital Privacy Act, or S-4, was tabled in the Senate. In broad strokes, it updates the Personal Information Protection and Electronic Documents Act (PIPEDA) to set new regulations on what corporations must do in the event of a data breach. But tucked inside is an amendment that has quite a different purpose.

Section 9 of the Act amends PIPEDA to introduce new circumstances where a private sector data-holder may disclose Canadians’ personal information without their knowledge or consent — where “the disclosure is necessary to investigate a breach of an agreement.”

Digital privacy experts told this journalist that the bill could lead copyright holders to go after those who download copyright material without paying — so-called “copyright trolls” — by using the threat of litigation to generate revenue, instead of actively pursuing the licensing of their intellectual property

David Fraser, a partner at McInnes Cooper, says the bill “certainly puts them in a better and easier place to extort payments from users.”

Michael Geist, Research Chair of Internet and E-Commerce Law at the University of Ottawa , says the bill stands to greatly expand warrantless disclosure.

But Susan Abramovitch, partner at Gowlings Toronto, says there’s no reason to panic.

“I don’t see this as revolutionary as others might,” she told National.

“To the extent that people are infringing copyright, it’s fair to say that they have no reasonable expectation of privacy. This just assists copyright holders and content owners to get information which is otherwise very difficult to get,” Abramovitch says.

Currently, it’s just about impossible for content holders to go after pirates in Canadian courts, she says. because it’s nearly impossible to tease out just who is pirating content, without going through the Internet Service Providers.

Evidencing this, two prominent cases involving content holders trying to get personal information on copyright pirates — one launched by Voltage Pictures, and the other by BMG — offer very mixed messages on what content holders can do to go after pirates.

In BMG, a federal court found that copyright holders had no right to obtain the personal information of users suspected of download music without paying. The court of appeal upheld the decision. Nearly a decade later, in Voltage, a federal court found that a film studio did have the right to obtain information tied to IP addresses where it had reasonable belief that those addresses belong to those who had been pirating content. Even then, it put a heavy caution on the studio’s ability to go after those users, who had not been proven guilty of breaking copyright.

Given the contradiction, the length of those legal battles, and the restrictions placed on Voltage, there’s been little incentive for copyright holders to take a legal action.

With the Digital Privacy Act, those companies will be able to simply obtain that information from any cooperative Internet Service Provider, and sidestep the courts altogether.

Abramovitch says that makes sense.

“Using the courts is almost like putting the horse before the cart,” she says, noting the inherent catch-22 logic: To obtain the personal information of users, a copyright holder must convince a judge that they are breaking copyright — to prove that, you need information from the ISPs about their users. Updating the law would make PIPEDA more “agile”, she says.

John Simpson, trademark lawyer with Shift Law, disagrees. “I don’t think that encouraging private participation in law enforcement, which this does essentially, is a way to sure up copyright,” he says.

Besides, there are plenty of ways to afford more rights and powers to content holders, says Simpson. But creating a Wild West scenario for information sharing isn’t the way to do it.

“Many commentators felt that the amendments to the Copyright Modernization Act shifted the balance a little bit in favour of users, away from copyright owners,” he says. “I would certainly think that this is something that shifts the weights back in favour of copyright owners.

That balancing act — playing off privacy rights against the rights of copyright holders — is a tricky one that ultimately comes down to the good faith interests of the copyright owner. What exactly constitutes good faith is the real question. Simpson says that the amendments in the Digital Privacy Act open the door wider than just good faith protection of copyright, and towards “shakedown efforts.”

Abramovitch rejects the dichotomy: “I don’t think that anybody should be trying to strike a balance between infringers and copyright holders,” she says. “That should 100 per cent tip in favour to copyright holders.”

And ultimately, infringement will still need to be proven.