The 3+3 Project: Fido

Half Star: The carrier only vaguely states that it operates according to applicable legislation or doesn’t mention third party PIPEDA-equivalent protection.

No Star: The carrier makes no indication that it complies with PIPEDA or substantially equivalent privacy legislation.

Explanation:

• Fido explicitly indicates that it complies with the Personal Information Protection and Electronic Documents Act (PIPEDA), all federal and provincial laws and regulations, and applicable privacy rules established by the Canadian Radio-television and Telecommunications Commission (CRTC).
• Fido indicates that it will transfer information to various third parties in certain circumstances but makes no mention of whether these third parties provide PIPEDA-equivalent protection.

Provisions:

“2. Fido’s privacy practices are in accordance with all federal and provincial laws and regulations. We are compliant with the Personal Information Protection and Electronic Documents Act and where applicable with the privacy rules established by the Canadian Radio-television and Telecommunications Commission.” – Fido Privacy Policy.

“7. Fido shares information with other Fido related companies, including the Rogers companies, in order to offer customers products and services that they may find attractive. Notices on sharing information are contained on Fido’s invoice and on fido.ca. If customers do not want to be marketed with these products and services, they can contact Fido at 1-888-481-3436.” – Fido Privacy Policy.

“Your account information may, from time to time, be disclosed to Fido’s affiliates, including other members of the Rogers Communications Inc. organization and to our agents and dealers in order to service your account, respond to your questions and telemarket (including by way of automatic dialing and announcing devices) and promote additional products and services offered by Fido and the other members of the Rogers organization that may interest you. If you do not wish to receive offers or information from or related to Fido and related Rogers entities, please contact our Customer Service at 1-888-481-3436.” – Fido Terms and Conditions (“Privacy and Confidentiality of Your Information”/Provision #30). (Note that the Fido Terms and Conditions were not formally a part of Fido’s evaluation, and in any event would not have affected Fido’s score on this criterion.)

The Fido Terms and Conditions indicate various circumstances in which personal information may be disclosed to third parties. See Criterion #4 (Transparency about conditions for third party data disclosures) for details. Note that the Fido Terms and Conditions were not formally a part of Fido’s evaluation, and in any event would not have affected its score on this criterion.

Half Star: A carrier does not indicate that it will notify users when it receives requests, however it indicates that users may send an inquiry in order to acquire such information.**Note: This criterion was applied generously: carriers who indicated users could learn about disclosures of their information were scored a half star.

No Star: The carrier makes no mention of how users may learn of third party requests for their personal information.

Explanation:

• Fido does not indicate that it notifies users when it receives third party data requests, however it indicates that users may send an inquiry to acquire such information.

Provisions:

“5. Fido informs customers of the existence, use and disclosure of their personal information upon request and gives them access to their information.” – Fido Privacy Policy.

• The number of requests from third parties, broken down by government (law enforcement, etc.), commercial and non-commercial entities.
• How many requests it complied with.
• How many accounts the requests applied to.
• How many disclosures of information there were.

Half Star: The carrier has published SOME information but leaves many important statistics out.

No Star: The carrier has published no information relating to these types of statistics.

Note: This criterion was edited for ease of use and clarity in presentation here. In highlighting the absence of specific important statistics, we may have applied this criterion more strictly than IXmaps. However, we are not aware of any divergence with IXmaps as to the final score awarded to any carrier.

Explanation:

• Fido has published no information about third party data requests and disclosures.
  • While Fido’s parent company, Rogers, has released a 2013 Transparency Report, neither Fido nor Rogers indicates whether Fido statistics are included in this report. (For Fido to receive credit for Rogers’ report, Fido statistics would have had to be clearly included in Rogers’ report, and Fido would have had to clearly indicate this in its own privacy materials. Neither was true here.)

Provisions: None

(1) The carrier explicitly states the circumstances under which personal information will be disclosed to third parties.

(2) It must make clear what standard must be met by the third party in order for this disclosure to be made (e.g. whether a warrant is required).

(3) It must be clear whether or not a subscriber/user will be notified in the case that his or her information is disclosed to a third party and especially the specific conditions under which such information will be disclosed without consent.

Half Star: The carrier refers to some but not all of (1), (2) and (3) or is vague about them.*

*Note: In order to achieve consistency, this criterion was applied generously: carriers that had some discussion of when disclosure of user information could occur received a half star. A carrier would have had to fail entirely to discuss disclosure to receive no star, which none did. This criterion is likely to be revised and simplified in future years to improve consistent application and permit more meaningful distinctions between carriers.

No Star: The carrier fails to indicate any of (1), (2), or (3).

Note: Our evaluation of this criterion looked at discussion of disclosure to any third party, including sharing with affiliated companies, while IXmaps focused on disclosure when compelled by law. However, both approaches yielded the same score on this criterion.

Explanation:

• The Fido Privacy Policy states Fido will not disclose information except: for the purposes for which it was collected, with user consent, or “as required by law”. It does not go into any detail regarding what “as required by law” means.
• Fido is unclear as to what standards various third parties must meet in order for disclosure to be made.
• Fido does not state whether users will be alerted to disclosures of their information.
• The Fido Terms and Conditions lists the specific situations, other than disclosure being “required pursuant to a legal power”, in which user information will be disclosed without user consent. However, the Fido Terms and Conditions were not formally a part of Fido’s evaluation (and in any event would not have affected Fido’s score on this criterion).

Provisions:

“3. At Fido, we collect customer information for one or more of the following purposes:

• To provide a positive customer experience, and deliver, bill for, and collect payment for products and services;
• To understand customer requirements and make information available regarding products and services offered by Fido directly or through its network of distributors, and its related companies, including the Rogers group of companies;
• To manage and develop Fido’s business and operations;
• To meet legal and regulatory requirements; and
• To obtain credit information or provide it to others.

4. Fido does not use or disclose personal information for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Fido retains personal information only as long as necessary for the fulfillment of those purposes.” – Fido Privacy Policy.

“7. Fido shares information with other Fido related companies, including the Rogers companies, in order to offer customers products and services that they may find attractive. Notices on sharing information are contained on Fido’s invoice and on fido.ca. If customers do not want to be marketed with these products and services, they can contact Fido at 1-888-481-3436.” – Fido Privacy Policy.

“Your account information may, from time to time, be disclosed to Fido’s affiliates, including other members of the Rogers Communications Inc. organization and to our agents and dealers in order to service your account, respond to your questions and telemarket (including by way of automatic dialing and announcing devices) and promote additional products and services offered by Fido and the other members of the Rogers organization that may interest you. If you do not wish to receive offers or information from or related to Fido and related Rogers entities, please contact our Customer Service at 1-888-481-3436.” – Fido Terms and Conditions (“Privacy and Confidentiality of Your Information”/Provision #30). (Note that the Fido Terms and Conditions were not formally a part of Fido’s evaluation, and in any event would not have affected Fido’s score on this criterion.)

The Fido Terms and Conditions contain provisions pertaining to whom and in what circumstances personal information will be disclosed without a user’s consent. As the full provisions are long, the exact text is in Appendix A at the end of this document. However, to paraphrase, Fido will only disclose personal information without consent:

• Where “disclosure is required pursuant to a legal power”
• To the user
• To someone they reasonably believe is the user’s agent
• To another telephone company, for the purpose of providing a user with services
• To a company supplying the user “with telephone or telephone directory-related services”
• To collection agencies or agents who “perform other administrative functions for” Fido
• To credit agencies, to check creditworthiness
• To law enforcement, where Fido reasonably believes the user has “knowingly supplied [Fido] with false or misleading information or are otherwise involved in unlawful activities”
• To public authorities where there is “imminent danger to life or property”

– Fido Terms and Conditions (“Privacy and Confidentiality of Your Information”/Provision #30). (Note that the Fido Terms and Conditions were not formally a part of Fido’s evaluation, and in any event would not have affected Fido’s score on this criterion.)

Half Star: The carrier only implicitly states forms of data included in a definition of ‘personal information’, and/or provides a definition which (a) incorporates a closed list of what constitutes personal information that (b) excludes one or more of IP addresses, IMSI/IMSEI numbers, MAC addresses, userIDs, meta-data, browser history, personal account information, or credit card information.

No Star: The carrier gives no definition of ‘personal information’.

Note: IP addresses, IMSI/IMEI numbers and MAC addresses are all used to identify individual devices connected to the Internet. This information could be used to identify individuals and track their locations. For more information, click here.

Explanation:

• Fido gives no definition of “personal information”.

Provisions: None

Half Star: The carrier only states the retention period for limited types of information. For example, a company may state that it retains consumers’ browsing history for 2 weeks, but provides no information on call log retention.

No Star: The carrier either provides no information on data retention periods OR provides a statement so vague as to not inform the consumer beyond what PIPEDA requires. For instance, “[Our company] shall retain personal information only as long as necessary for the fulfillment of the purposes for which it was collected.” (Example wording is from Bell’s privacy policy.)

Explanation:

• Fido provides a statement so vague as to not inform the consumer beyond what PIPEDA requires. It merely restates PIPEDA’s Principle 5 - Limiting Use, Disclosure, and Retention.

Provisions:

“4. Fido does not use or disclose personal information for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Fido retains personal information only as long as necessary for the fulfilment of those purposes.” – Fido Privacy Policy.

Half Star: The carrier only indicates that there is a possibility that data may be stored and/or processed subject to a foreign jurisdiction. No jurisdiction is noted or details are not provided.

No Star: The carrier fails to clearly indicate whether or not data may be stored and/or processed such that it may be subject to a foreign jurisdiction.

Explanation:

• Fido’s only reference to where personal information is stored and/or processed is found in the Fido Terms and Conditions. As the Fido Terms and Conditions were not formally a part of Fido’s evaluation, it cannot receive credit for this reference.
  • Had this provision been counted, Fido would have earned a half star: it only indicates that there is a possibility that personal information may be stored or processed in a foreign jurisdiction. Jurisdiction details and types of disclosure personal information may be subject to are not provided.

Provisions: None in privacy materials

“Personal information collected in connection with the provision of the Services may be stored and processed in or outside Canada and may be subject to the laws of other jurisdictions.” – Fido Terms and Conditions (“Privacy and Confidentiality of Your Information”/Provision #30).

Half Star: The carrier is vague about the geographical locations or jurisdictional exposure of personal data routing.

No Star: The carrier gives no indication of the geographical locations or jurisdictions where personal data is routed.

Explanation:

• Fido gives no indication as to the geographical locations or jurisdictions through which personal data is routed.

Provisions: None

Half Star: The carrier is vague about its policies for ensuring Canadian routing of domestic traffic and the measures it takes to ensure this. In the absence of a clear policy statement, a carrier (whether Canadian or foreign) that peers openly at some but not all Canadian public IXPs in its operating regions will earn a half star.

No Star: The carrier gives no indication of any policy or concrete measures to promote domestic routing when possible, nor does it peer openly at any Canadian public IXPs.

Explanation:

• Fido gives no indication that it promotes domestic routing where possible.
• Fido does not peer at any Canadian public IXPs as of January 26, 2015. The IXPs reviewed were:
  • Manitoba Internet Exchange: http://www.mbix.ca/
  • Échange Internet de Montréal: http://www.qix.ca/en/
  • Toronto Internet Exchange: http://www.torix.ca/
  • Ottawa Internet Exchange: http://www.ottix.net/
  • Halifax Internet Exchange: http://hfxix.ca/
  • Calgary Internet Exchange: http://yycix.ca/
• Fido is a subsidiary of Rogers. If Rogers had been peering openly at Canadian IXPs during the research period, we might have asked whether that meant Fido’s traffic was being routed domestically as well. However, since Rogers earned no star on this issue, the question of whether Fido should get credit for actions by Rogers has been left for the future.

Provisions: None

For an explanation of IXPs and open and conditional peering, see the project overview.

• Involvement in public debates over mass state surveillance;
• Involvement in privacy or surveillance related legislative initiatives (e.g. the current Bill C-13 on lawful access);
• Defending user privacy rights in court; or
• Ties to advocacy organizations or initiatives promoting user privacy rights.

Half Star: The carrier has defended user privacy rights politically, in court or legislatively, but there is no reference to this in its privacy pages.

No Star: There is no readily available public evidence that the carrier has taken a positive pro-privacy position in any of the above areas.

Note: While this criterion was edited for ease of use and clarity in presentation here, we are not aware of any divergence with IXmaps with regard to application.

Explanation:

• No indication of Fido publicly supporting user privacy rights was found.
• A search of legal databases for Canadian cases involving Fido did not turn up any case law where Fido defended user privacy rights in court.
• Fido is a subsidiary of Rogers. Rogers has publicly supported user privacy rights, including via a current Canadian court case (see the Rogers report for details). However, Fido did not make any reference to Rogers’ actions in its privacy materials, nor was it obviously involved in Rogers’ privacy-related litigation. Therefore, it cannot receive any credit for Rogers’ actions.

Google searches used in seeking public evidence of a pro-privacy position (The most recent search date is given next to each search term. Material up to 5 years old was reviewed.)

Fido privacy (January 18, 2015).

Fido privacy [but not]“fido alliance” (January 23, 2015).[2]

Fido transparency (January 23, 2015).

Fido personal information (January 18, 2015).

Fido “personal information” (January 23, 2015).

Fido “customer information” (January 23, 2015).

Fido “subscriber information” (January 23, 2015).

Fido disclosure (January 23, 2015).

Fido “lawful access” (January 23, 2015).

Fido “warrant” (January 23, 2015).

Fido “legal authority” (January 23, 2015).

Fido “Bill C-13” (January 23, 2015).

Fido “privacy” (January 23, 2015).

Fido privacy advocacy (January 18, 2015).

Fido “privacy advocacy” (January 23, 2015).

Fido user privacy (January 18, 2015).

Fido “user privacy” (January 23, 2015).

Fido customer privacy (January 18, 2015).

Fido “customer privacy” (January 23, 2015).

Fido privacy complaints (January 18, 2015).

Fido “privacy complaints” (January 23, 2015).

Fido privacy issue (January 18, 2015).

Fido “privacy issue” (January 23, 2015).

Searches used in seeking case law where Fido defended user privacy rights in Canadian courts (The most recent search date is given next to each search term. Material up to 5 years old was reviewed.)

Westlaw Canada:

• “Fido Solutions” back to 01/01/2010 (January 23, 2015).

Quicklaw:

• fido solutions in Case Name, limited to previous 5 years (January 23, 2015).

• “fido solutions” & intervener limited to previous 5 years (January 23, 2015).

CanLii:

• “Fido Solutions” (January 23, 2015).

Appendix A: Provisions related to Transparency about conditions for third party data disclosures(Criterion #4)

“Unless you provide express consent, or disclosure is required pursuant to a legal power, all information regarding you kept by us, other than your name, address and listed telephone number, is confidential and may not be disclosed by us to anyone other than:

• you;
• a person who, in our reasonable judgment, is seeking the information as your agent;
• another telephone company, provided the information is required for the efficient and cost-effective provision of telephone service and disclosure is made on a confidential basis, with the information to be used only for that purpose;
• a company involved in supplying you with telephone or telephone-directory-related services, provided the information is required for that purpose and disclosure is made on a confidential basis, with the information to be used only for that purpose;
• an agent retained by us in the collection of your account or to perform other administrative functions for us, provided the information is required for and used only for that purpose;
• an agent retained by us to evaluate your creditworthiness, provided the information is required for and is to be used only for that purpose;
• a law enforcement agency whenever we have reasonable grounds to believe that you have knowingly supplied us with false or misleading information or are otherwise involved in unlawful activities; or
• a public authority or agent of a public authority if, in our reasonable judgment, it appears that there is imminent danger to life or property which could be avoided or minimized by disclosure of the information.”

Express consent to disclosure may be obtained as follows:

• by written consent;
• by oral confirmation verified by an independent third party;
• by electronic confirmation through the use of a toll-free number;
• by electronic confirmation via the Internet;
• by oral consent, where an audio recording of the consent is retained by us; or
• by consent through other methods, as long as an objective documented record of your consent is created by you or by an independent third party.”

– Fido Terms and Conditions (“Privacy and Confidentiality of Your Information”/Provision #30). (Note that the Fido Terms and Conditions and this provision were not formally a part of Fido’s evaluation.)

Appendix B: Sources

Fido Privacy Policy

• Applies to: Fido Solutions (per its first provision).
• Last consulted January 23, 2015.

News Releases on Fido website back to April 12, 2012 (earliest date available on the Fido website): https://www.fido.ca/web/content/media/news_releases

• Last consulted January 18, 2015.