Search

Telecom Regulatory Policy CRTC 2009-723

Route reference: Telecom Notice of Consultation 2009-71

Ottawa, 25 November 2009

Regulatory measures associated with confidentiality provisions and privacy services

File number: 8663-C12-200903387

In this decision, consistent with the Policy Direction, the Commission modifies the regulatory measure pertaining to confidentiality provisions to allow for the disclosure of confidential customer information to affiliates that provide telecommunications and/or broadcasting services, subject to the safeguards set out in this decision. As well, the Commission maintains the regulatory measure pertaining to privacy services. The dissenting opinion of Commissioner Lamarre is attached.

Introduction

1. In Telecom Decision 2008-34, the Commission issued an action plan to review existing social and non-economic regulatory measures in light of the Governor in Council's Order Issuing a Direction to the CRTC on Implementation of the Canadian Telecommunications Policy Objectives, P.C. 2006-1534, 14 December 2006 (the Policy Direction).

2. As part of the action plan, the Commission identified the regulatory measures associated with privacy safeguards and obligations as a matter to be reviewed. In Telecom Notice of Consultation 2009-71, the Commission invited parties to comment on the continued appropriateness of these regulatory measures.

3. The Commission received submissions from Bell Aliant Regional Communications, Limited Partnership, Bell Canada, NorthernTel, Limited Partnership, Northwestel Inc., Saskatchewan Telecommunications, and Télébec, Limited Partnership (collectively, Bell Canada et al.); Bragg Communications Inc. (Bragg); the Coalition of Communication Consumers (Coalition); the Office of the Privacy Commissioner of Canada (OPCC); the Ontario Telecommunications Association (OTA); the Public Interest Advocacy Centre (PIAC), on behalf of the Consumers' Association of Canada and Canada Without Poverty (formerly the National Anti-Poverty Organization); Rogers Communications Inc. (RCI); and TELUS Communications Company (TCC).

4. The public record of this proceeding, which closed on 25 June 2009, is available on the Commission's website at www.crtc.ca under ''Public Proceedings'' or by using the file number provided above.

5. The regulatory measures associated with privacy safeguards and obligations are of two types: confidentiality provisions and privacy services. For each type, the Commission will first assess whether it can rely on market forces to achieve the purpose underlying the regulatory measure and whether the measure remains necessary. If the Commission determines that the measure will be maintained, it will then examine whether the measure should be modified. This review includes an identification of the telecommunications policy objectives of the Telecommunications Act (the Act) relevant to the purpose of each measure.

Confidentiality provisions

6. The customer confidentiality provisions, which were most recently modified in Telecom Decision 2007-13, prohibit telecommunications service providers (TSPs)1 from disclosing confidential customer information (CCI) without express consent of the customer, except in certain specified circumstances.

Should the regulatory measure pertaining to CCI be maintained and, if so, should it be modified?

7. Bell Canada et al., Bragg, the Coalition, the OTA, RCI, and TCC generally submitted that the regulatory measure is not necessary because reliance on market forces, combined with the Personal Information Protection and Electronic Documents Act (PIPEDA), would be sufficient to achieve its purpose.

8. RCI proposed that if the regulatory measure is maintained, TSPs should be allowed to disclose non-sensitive CCI between affiliates2 based on implied consent. RCI submitted that non-sensitive information would include marketing and service delivery information such as credit worthiness, billing information, current service subscriptions, and service upgrade preferences.

9. Bell Canada et al. and TCC supported RCI's proposal should the Commission maintain the regulatory measure.

10. The OPCC and PIAC submitted that the regulatory measure should be maintained since the Commission's powers represent an important layer of privacy protection for Canadians. PIAC also submitted that the sharing of CCI with affiliate companies should not be permitted because of the wide-ranging nature of affiliate structures and the potential for extensive disclosure of sensitive personal information without express consent.

11. The Commission considers that the purpose of the regulatory measure is to protect customers against the unwarranted disclosure of CCI. Furthermore, the Commission considers that the measure furthers the policy objective set out in paragraph 7(i) of the Act.3

12. The Commission notes that its mandate under the Act pertains to both individuals and business customers, whereas PIPEDA only applies to individuals. The Commission also notes that its decisions are binding and can be enforced on all TSPs. By contrast, PIPEDA does not provide the same powers or enforcement measures to the OPCC.

13. The Commission considers that the elimination of the regulatory measure would create gaps in the protection of customers' privacy. The Commission also considers that the regulatory measure is even more relevant today than when it was first implemented, due to the advent of new technologies and electronic commerce, which allow information to be easily processed, rearranged, and exchanged.

14. Based on the above, the Commission determines that market forces, in conjunction with PIPEDA, would not be sufficient to protect the privacy interests of all TSP customers. However, the Commission considers that the modification described below is required to make the regulatory measure consistent with the Policy Direction.

15. The Commission notes that many TSPs today offer services such as telephone, wireless, Internet, and video in bundles and that many customers have availed themselves of these bundles. The Commission also notes that TSPs offer their bundled services under a common brand either through one integrated company or through affiliated companies.

16. The Commission notes that TSPs must secure a customer's express consent each time they wish to disclose CCI to an affiliate to offer their bundled services. The Commission considers that this puts TSPs with affiliates at a competitive disadvantage in relation to integrated TSPs because the latter do not have to secure customer express consent to offer their bundled services. Consequently, the Commission considers that the current regulatory measure is not as symmetrical and competitively neutral as possible and, therefore, does not comply with the Policy Direction.

17. The Commission notes that under the current regulatory measure, TSPs can disclose CCI to any company involved in supplying the customer with telephone or directory related services, provided the information is disclosed on a confidential basis and is used only for the specific purpose of supplying telephone or directory related services. The Commission considers that it would be appropriate to adopt a similar rule for TSPs with affiliates for the purposes of disclosing CCI.

18. In light of the above, the Commission determines that TSPs are permitted to disclose CCI to an affiliate involved in supplying the customer with telecommunications and/or broadcasting services, provided the information is required for that purpose and disclosure is made on a confidential basis with the information to be used only for that purpose. The Commission has provided, in the Appendix to this decision, an example of the customer confidentiality provision which includes the new exception to the requirement to obtain customer express consent.

19. The Commission directs those Canadian carriers that offer services pursuant to approved tariffs to issue revised tariff pages reflecting the determination made in paragraph 18, no later than 7 December 2009. In addition, those Canadian carriers whose existing tariffs contain additional circumstances under which disclosure is permitted without express customer consent are to retain those circumstances in their tariffs.

20. The Commission also directs Canadian carriers to include, on a going-forward basis, provisions reflecting the determination made in paragraph 18 in customer service contracts and other arrangements for all forborne services, except forborne mobile wireless services that are not switched (affected forborne services). In addition, these provisions will also apply on a going-forward basis to all existing customers of affected forborne services.

21. The Commission further directs Canadian carriers, as a condition of providing telecommunications services to resellers, to include in their service contracts and other arrangements with such resellers the requirement that these resellers abide by the amended confidentiality provisions. These confidentiality provisions also apply, effective the date of this decision, to all existing contracts and other service arrangements between Canadian carriers and resellers.

Privacy services

22. The Commission requires certain TSPs to offer services designed to protect customer privacy (e.g. call display, call display blocking, and call trace). These requirements apply to all local exchange carriers, local service resellers, and local voice over Internet protocol service providers in both forborne and regulated markets.

Should the regulatory measure pertaining to privacy services be maintained and, if so, should it be modified?

23. All parties except RCI supported retaining the existing regulatory measure pertaining to privacy services. RCI submitted that market forces are sufficient to ensure that privacy services are maintained in forborne markets, as demonstrated by the provision of these services by many major wireless service providers.

24. The Commission notes that the purpose of the regulatory measure is to provide subscribers with means by which they can protect their privacy when using telecommunications services. The Commission considers that the measure furthers the policy objective set out in paragraph 7(i) of the Act.

25. The Commission considers that without the requirement for wireline TSPs to provide these privacy services, there is a risk that in forborne markets some of these services would be discontinued or only made available at much higher rates. The Commission considers that market forces alone are unlikely to protect the privacy interests of customers in such markets. The Commission also considers that the regulatory measure is applied as symmetrically as possible to wireline TSPs.

26. Based on the above, the Commission determines that the existing regulatory measure pertaining to privacy services is maintained without modification.

Policy Direction

27. The Commission considers that the regulatory measures regarding confidentiality, as amended in this decision, and privacy services are consistent with the Policy Direction.

28. The dissenting opinion of Commissioner Lamarre is attached.

Secretary General

Related documents

This document is available in alternative format upon request, and may also be examined in PDF format or in HTML at the following Internet site: http://www.crtc.gc.ca

Appendix

Example4 of a TSP's customer confidentiality provision

Unless a customer provides express consent or disclosure is pursuant to a legal power, all information kept by the company regarding the customer, other than the customer's name, address, and listed telephone number, is confidential and may not be disclosed by the company to anyone other than

Footnotes

[1]   This includes all TSPs except providers of wireless services that are not switched, such as paging providers.

[2]  Subsection 35(3) of the Act states that an ''affiliate, in relation to a Canadian carrier, means a person who controls the carrier, or who is controlled by the carrier or by any person who controls the carrier.''

[3]  Paragraph 7(i) of the Act: to contribute to the protection of the privacy of persons

[4]  Existing approved tariffs of certain Canadian carriers contain additional circumstances under which disclosure is permitted without express customer consent.

Dissenting opinion of Commissioner Suzanne Lamarre

1. I endorse my colleagues' majority decision, except on one specific issue. I would not have permitted the TSPs to disclose CCI to an affiliate involved in supplying the customer with telecommunications and/or broadcasting services, even under the conditions set out in paragraph 18 of the majority decision. My colleagues' argument for this aspect of their decision is that prohibiting the disclosure of confidential information between affiliated carriers without the customer's express consent puts TSPs with an affiliate structure at a disadvantage in relation to integrated TSPs. My colleagues conclude that this measure is not applied in a symmetrical and competitively neutral manner and therefore does not comply with the Policy Direction. It is my opinion that, for the following reasons, this conclusion is unwarranted, given the wording of the Policy Direction, and is not consistent with the objectives of the Canadian telecommunications policy as set out in section 7 of the Telecommunications Act (the Act).

2. The Policy Direction requires that the Commission, when implementing regulatory measures in the exercise of its powers and duties, use measures which, ''if they are not of an economic nature, to the greatest extent possible, are implemented in a symmetrical and competitively neutral manner.'' (emphasis added)

3. We should first note that the Policy Direction does not override the policy objectives set out in section 7 of the Act. Indeed, section 47 of the Act specifically states: ''The Commission shall exercise its powers and perform its duties under this Act and any special Act (a) with a view to implementing the Canadian telecommunications policy objectives […] and (b) in accordance with any orders made by the Governor in Council under section 8 or any standards prescribed by the Minister under section 15.'' (emphasis added) This means that in assessing the parties' request, the Commission must consider the actual purpose of the objective set out in paragraph 7(i), ''to contribute to the protection of the privacy of persons,'' while reconciling it with the Policy Direction.

4. Furthermore, the purpose clearly underlying the regulatory measure in question was a non-economic one, the protection of privacy, which is ''often viewed as a fundamental human right.''1

5. Finally, the Commission is required to identify a measure that is, to the greatest extent possible, symmetrical and competitively neutral. Not at any price, and not in violation of the Commission's other statutory obligations, but absolutely and only to the greatest extent possible.

6. In reading some arguments, one would think that it is necessary to adopt only perfectly symmetrical and competitively neutral measures, regardless of the other objectives of the Canadian telecommunications policy or of the limits of market forces. This is not the case. The Policy Direction clearly provides for moderating the symmetrical and competitively neutral character of a regulatory measure, and there are several elements that lead me to believe that in this case, this moderation should have been invoked in order to retain the existing measure without modifying it.

7. The first of these elements is the terminology used in the Canadian telecommunications policy, which requires that the Commission contribute to the protection of privacy. The meaning of the word ''contribute'' is ''to help to bring about a result.''2 In adopting policies and regulations underlying these policies, the Commission must therefore take positive and deliberate action to protect privacy.

8. The second element is the relationship between the inconvenience for TSPs that the regulatory measure appears to cause and the inconvenience its absence causes to customers. The regulatory measure required the customer's express consent for the disclosure of confidential information to affiliates. This is a simple, transparent, and predictable remedy that allows the TSPs to do what they want to do. Of course it involves administrative inconvenience, but this is not, in my opinion, a competitive disadvantage brought about by regulation. The inconvenience rather stems from the TSP's corporate structure.

9. TSPs with an affiliate structure decided on that structure for business reasons, which they believed were excellent reasons, during their evolution. They have benefitted, and continue to benefit, from all the advantages of such a structure. The flip side is simply that they must now live with a minor administrative inconvenience in their marketing efforts to expand their targets and market share.

10. The third element to be considered concerns the TSPs' customers. If their express consent is no longer required, they have no means of preventing the disclosure of confidential information to affiliates. Implied consent is too broad in scope to constitute adequate protection. And after the fact, there is even less that customers can do to remedy the undesirable effects of the disclosure. Once disclosed, the information is no longer confidential because it has been shared.

11. The scope of what constitutes privacy and the degree of sensitivity associated with personal information are both subjective elements particular to each individual. Some will feel neither uneasy nor concerned about such disclosure; others even see it as an advantage and would, I admit, be annoyed by a rule prohibiting disclosure. These customers could continue giving express consent. However, others see it, legitimately, as a privacy violation. The representations made by the Office of the Privacy Commissioner of Canada and the Public Interest Advocacy Centre are credible and eloquent in this respect. In my opinion, it is not reasonable to deprive customers, who rightly believe that privacy protection is a fundamental right, of a say in the disclosure of their confidential information.

12. There are those who would be tempted to say, in reply to my last statement, that customers can change providers; I would ask that they refrain from doing so. Such a response would be tantamount to treating the right to privacy protection as a consumer good, which it is not. While no one involved in this proceeding has suggested or insinuated that the right to privacy is a consumer good, it is clear that the insistence on emphasizing competition to justify modifying the existing regulatory measure in this case may lead us toward that slippery slope.

Conclusion

13. In this instance, the inconvenience that the disclosure of confidential information causes to customers is disproportionate to the inconvenience that prohibiting disclosure causes to TSPs and their affiliates.

14. Permitting TSPs to disclose CCI to their affiliates without express customer consent creates a breach of privacy protection that is clearly contrary to the policy objective set out in paragraph 7(i) of the Act. This breach will be created to mitigate an inconvenience that relates to the structure of certain carriers, a structure that stems from strategic choices made by the carriers themselves. Moreover, the size of the breach and the damage it will cause to the privacy of TSP customers will be known only after it is too late to remedy it.

15. The existing measure prohibiting TSPs from disclosing CCI to their affiliates is not perfectly symmetrical and competitively neutral, but in light of all the elements discussed above, it is symmetrical and competitively neutral to the greatest extent possible without impeding the implementation of the Canadian telecommunications policy objectives set out in section 7 of the Act. Accordingly, the existing measure furthers the implementation of the Canadian telecommunications policy objectives in a manner that complies with the Policy Direction.

Footnotes

[1]  Submission by the Privacy Commissioner of Canada entitled ''Re: Telecom Public Notice CRTC 2009-71– Review of the regulatory measures associated with confidential customer information and privacy; CRTC Reference: 8663-C12-200903387,'' 20 March 2009, paragraph 11

[2]  Canadian Oxford Dictionary, 2004; in French « contribuer: participer à un résultat par sa présence, par une action », Larousse Grand Format 2003, s.v. contribuer.

Date modified: