The 3+3 Project: Rogers

• Rogers explicitly indicates that it complies with the Personal Information Protection and Electronic Documents Act (PIPEDA), all federal and provincial laws and regulations, and applicable privacy rules established by the Canadian Radio-television and Telecommunications Commission (CRTC).
• Rogers indicates that it will transfer information to various third parties in certain circumstances but makes no mention of whether these third parties provide PIPEDA-equivalent protection.

• The Rogers Group of Companies will not release your personal information with these exceptions:
• When you give us permission to do so;
• When we believe that the law requires it;
• To protect the rights or property of the Rogers Group of Companies;
• Under circumstances described to you when we collect the information, such as in a Terms of Service or Use agreement, or in the rules of contests or other promotions;
• To affiliated companies within the Rogers Group of Companies.”

• Rogers does not indicate that it notifies users when it receives third party data requests, however it indicates that users may send an inquiry to acquire such information.Provisions:

• The number of requests from third parties, broken down by government (law enforcement, etc.), commercial and non-commercial entities.
• How many requests it complied with.
• How many accounts the requests applied to.
• How many disclosures of information there were.

• Rogers published a Transparency Report in 2013 that included statistics about the number of requests for data it received, broken down by the type of request and its authority.
• It did not, however, include statistics about:
  • Number of requests complied with
  • Number of accounts the requests applied to
  • Number of disclosures
• It also appears the report may refer only to law enforcement and other governmental requests, not to requests from commercial entities (if any).
• Additionally, information about requests that were made without legal authority was not included in the report.

• The Rogers 2013 Transparency Report breaks down 6 types of requests received in 2013 and explains the legal authority associated with each.
• Other privacy-related provisions make much more general reference to conditions when disclosure will occur.
• Rogers states in the Rogers 2013 Transparency Report that customer name/address checks are “permitted” under “PIPEDA and CTRC Rules”. However, it has since stated, in July 2014, that it will now be requiring a court order or warrant before disclosing even basic customer information to law enforcement (for full details, see Criterion #10 [Open advocacy for user privacy rights]).
• None of the privacy materials indicate whether subscribers will be notified about disclosure.
• Rogers failed to earn a full star primarily on the third requirement: clarity as to whether or not users will be notified about disclosure.
• However, a certain lack of consistency regarding the standard for disclosure across various documents, as well as a failure to clearly explain in its privacy materials its shift to requiring a warrant even for name/address checks – which makes the Rogers 2013 Transparency Report out of date – would likely have kept it at a half star.
  • The Rogers Terms of Service state that “[u]nless you provide express consent, or disclosure is required pursuant to a legal power,” disclosure can occur only in specific limited circumstances [emphasis added]. This statement seems to reflect the shift to requiring a warrant for name/address checks. Note that it appears only in the Rogers Terms of Service, not in Rogers’ privacy materials.
  • The Rogers Terms of Service also lists the specific situations, other than disclosure being “required pursuant to a legal power”, in which user information “other than… name, address and listed telephone number” will be disclosed without user consent. However, the Rogers Terms of Service were not formally a part of Rogers’ evaluation, and in any event would not have affected Rogers’ score on this criterion.

• To provide a positive customer experience, and deliver, bill for, and collect payment for products and services;
• To understand customer requirements and make information available regarding products and services offered by Rogers and its agents, dealers and related companies;
• To manage and develop Rogers business and operations;
• To meet legal and regulatory requirements; and
• To obtain credit information or provide it to others.

• The Criminal Code and other laws allow government and law enforcement agencies to require us to provide customer information.
• The Personal Information Protection and Electronic Documents Act (PIPEDA) covers both how we protect customers’ information and how we disclose it.
• The CRTC Confidential Customer Information Rules (CRTC Rules) set out circumstances under which customer information – other than name, address and listed numbers, which can always be provided – may be disclosed to third parties including law enforcement agencies.

1. Customer name/address checks (PIPEDA and CRTC Rules “permit” confirmation of such information) (but see the “Update” below)
2. Court order/warrant (“Issued under the Criminal Code or other laws”)
3. Government requirement order (“Issued under laws such as the Customs Act or Income Tax Act”)
4. Emergency requests from police in life threatening situations (“The Criminal Code and PIPEDA”)
5. Child sexual exploitation emergency assistance requests (“The Criminal Code and PIPEDA”)
6. Court order to comply with a Mutual Legal Assistance Treaty request (“Issued under Mutual Legal Assistance in Criminal Matters Act”)

• When you give us permission to do so;
• When we believe that the law requires it;
• To protect the rights or property of the Rogers Group of Companies;
• Under circumstances described to you when we collect the information, such as in a Terms of Service or Use agreement, or in the rules of contests or other promotions;
• To affiliated companies within the Rogers Group of Companies.”

• Where “disclosure is required pursuant to a legal power”
• To the user
• To someone they reasonably believe is the user’s agent
• To another telephone company, for the purpose of providing a user with services
• To a company supplying the user “with telephone or telephone directory-related services”
• To collection agencies or agents who “perform other administrative functions for” Rogers
• To credit agencies, to check creditworthiness
• To law enforcement where Rogers reasonably believes the user has “knowingly supplied [Rogers] with false or misleading information or are otherwise involved in unlawful activities”
• To public authorities where there is “imminent danger to life or property”, or “for emergency public alerting purposes” where there is “an imminent or unfolding danger that threatens the life, health or security of an individual”

• Rogers provides definitions of “personal information” in the Rogers Group of Companies (Rogers) Commitment to Privacy and the FAQs about Rogers Commitment to Privacy which include some examples.
• Although the examples are not a closed list, most of the key elements required to do well on this criterion are not included. For example, there is no reference to IP addresses or meta-data. (There is a reference to meta-data in the Rogers 2013 Transparency Report, but as something that is not released without a warrant, not as part of a definition of personal information. This implies that Rogers likely considers meta-data personal information, but this is not clear.)
• The examples Rogers gave of what constituted “personal information” were considered sufficiently obvious and uninformative that it might have earned no star on this criterion, had there not been other carriers who gave no definition of personal information at all.

• Rogers makes a general statement that it keeps information as long as needed to fulfill the purposes for which it was collected, a statement so vague as to not inform the consumer beyond what PIPEDA requires (it merely restates PIPEDA’s Principle 5 - Limiting Use, Disclosure, and Retention). Rogers only indicates a retention period for one type of data (bills). However, it also indicates that “customers’ communications” are not retained at all.
• Had Rogers referred to the retention period for bills alone, this likely would have been a no-star statement. However, whether the content of communications is retained is of significant interest to users, so Rogers’ explicit exclusion of this material from what is retained at all moved it up to a half star. These considerations may be reflected in separate criteria in future. (Note: IXmaps would have awarded a half star to Rogers even without this explicit exclusion of certain material.)

•  Rogers’ only reference to where personal information is stored and/or processed is found in the Rogers Terms of Service. As the Rogers Terms of Service were not formally a part of Rogers’ evaluation, it cannot receive credit for this reference.
  • Had this provision been counted, Rogers would have earned a half star: it only indicates that there is a possibility that personal information may be stored or processed subject to a foreign jurisdiction. Jurisdiction details and types of disclosure the information may be subject to are not provided.

• Rogers gives no indication of the geographical locations or jurisdictions through which personal data is routed.

• Rogers gives no indication that it promotes domestic routing where possible.
• Rogers was listed on only one Canadian IXP (the Toronto Internet Exchange [TorIX]), where it was a conditional peer only.
• Open peering at TorIX might have merited a half star, as might conditional peering at a significant number of IXPs. Conditional peering at one IXP, however, merits no stars.
• Rogers does not peer openly at any Canadian public IXPs as of January 24, 2015. In addition to TorIX (http://www.torix.ca/), the IXPs reviewed were:
  • Manitoba Internet Exchange: http://www.mbix.ca/
  • Échange Internet de Montréal: http://www.qix.ca/en/
  • Ottawa Internet Exchange: http://www.ottix.net/
  • Halifax Internet Exchange: http://hfxix.ca/
  • Calgary Internet Exchange: http://yycix.ca/

• Involvement in public debates over mass state surveillance;
• Involvement in privacy or surveillance related legislative initiatives (e.g. the current Bill C-13 on lawful access);
• Defending user privacy rights in court; or
• Ties to advocacy organizations or initiatives promoting user privacy rights.

• Rogers’ reference in the Rogers 2013 Transparency Report to “push[ing] back” against orders it considers “too broad” would have been too vague to merit a full star on its own. However, Rogers’ statement in the Report that it “encourage[s] the Government of Canada to issue its own report on these requests [for user information]” constitutes a clear reference to support for user privacy rights, specifically via “involvement in public debates over mass state surveillance.”
  • Although this is only a single line, Rogers was under no obligation to take a position on the issue of the government issuing a report, and no indication was found that other carriers made statements on this issue.
• Rogers (alongside TELUS) is also currently fighting a “tower dump” order, involving information about 40,000-50,000 TELUS and Rogers customers, in R v Rogers Communications Partnership, 2014 ONSC 3853, but this is not (yet) mentioned in its privacy materials. Rogers should refer to this case in its 2014 Transparency Report.
• Rogers updated its policies after the Supreme Court of Canada ruling in R v Spencer, 2014 SCC 43, (a case about online privacy and disclosure by ISPs) to require warrants, court orders, or similar authority in more disclosure situations, but did not highlight this change in its privacy materials. Although Spencer could be said to require this change, not all companies have made such a declaration, and the recently-passed Bill C-13 removes liability for carriers who voluntarily disclose customer information. (For discussion of Spencer and warrants, see Alex Boutilier & Paul McLeod, “Supreme Court ruling hasn’t stopped police from warrantless requests for data” The Toronto Star (17 September 2014), online: <http://www.thestar.com>[5] and Christine Dobby, “Rogers to require warrants for police requests” The Globe and Mail (16 July 2014), online: The Globe and Mail <http://www.theglobeandmail.com>[6] .)

• The Peel Regional Police obtained a “tower dump” production order for the information of TELUS and Rogers customers attempting connections through any of 21 TELUS towers or 16 Rogers towers.
• 40,000-50,000 persons could be affected.
• The goal was “to further an investigation by identifying persons using cell phones in the vicinity of known criminal activity.” (R v Rogers Communications Partnership, 2014 ONSC 3853 at paragraph 1).
• TELUS and Rogers applied to quash the orders under s. 24(1) of the Canadian Charter of Rights and Freedoms: “Anyone whose rights or freedoms, as guaranteed by this Charter, have been infringed or denied may apply to a court of competent jurisdiction to obtain such remedy as the court considers appropriate and just in the circumstances.”
• “Rogers and Telus brought their Charter applications asserting the general proposition that production orders are obtained without due regard for the privacy interests of their customers. Litigating that issue, they submit, will provide guidance to the police and telecommunications industry in the future.” (R v Rogers Communications Partnership, 2014 ONSC 3853 at paragraph 24).
• Cell towers record whenever a user makes or attempts a communication (including a call, text, or email). Towers in cities cover 1-2 kilometres, and in the country 10-25 kilometres.
• The information provided under the orders would include, for all users making or attempting a communication:
  • Which tower they were using,
  • Their name and address, and
  • Their billing information, possibly including banking and credit card information.
• Where the recipient of a communication was also a TELUS or Rogers subscriber, that person’s information, including the tower they were using, would also need to be provided.
• The orders did not include:
  • How the information would be safeguarded.
  • Restrictions on the use of the information (i.e. it could be kept and used in other investigations).
• The Peel Regional Police successfully applied to revoke the original order saying they would be satisfied with a more limited order. (Whether their application for this second order was successful is not clear.)
• However, the Charter challenge to the original orders will proceed.

“The new policy of requiring a warrant even for basic requests will be better for customers, and law enforcement will still be able to protect the public, Rogers says. It stresses that, in keeping with the [Spencer] ruling, police would not need a warrant to get basic subscriber information in life-threatening emergencies. In addition, if police have an Internet Protocol, or IP, address of interest and want to obtain a warrant to investigate further, Rogers will tell them which city the relevant customer lives in so they know which judge to approach, [Rogers chief privacy officer Ken Engelhart] said. "But we won't give them any personal information — no name, no address."”

“Apart from situations involving life-threatening emergencies, Rogers said it now requires “lawful authority” – a court order, warrant or equivalent production order – to provide basic customer details to law-enforcement agencies or government agencies with the power to request information under legislation (for example, the Canada Revenue Agency). … Mr. Engelhart said the company decided to stop responding to [customer information requests relating to child exploitation cases] except in emergency situations immediately after the Supreme Court ruling [in R v Spencer]. He added that the change in policy announced Wednesday applies to a much broader category of “customer name/address checks,” under which Rogers received about 88,000 requests in 2013. He said the company will no longer confirm basic name, address and phone information without an order.”

• Rogers privacy (January 18, 2015).
• Rogers transparency (January 18, 2015).
• Rogers personal information (January 18, 2015).
• Rogers “personal information” (January 18, 2015).
• Rogers “customer information” (January 18, 2015).
• Rogers “subscriber information” (January 18, 2015).
• Rogers disclosure (January 18, 2015).
• Rogers “lawful access” (January 18, 2015).
• Rogers “warrant” (January 18, 2015).
• Rogers “legal authority” (January 18, 2015).
• Rogers bill c-13 (January 18, 2015).
• Rogers “Bill C-13” (January 18, 2015).
• Rogers user rights (January 18, 2015).
• Rogers user privacy (January 18, 2015).
• Rogers user rights (January 18, 2015).
• Canada user privacy rights rogers (January 18, 2015).
• Rogers privacy advocacy (January 18, 2015).
• Rogers privacy lawsuit (January 18, 2015).
• Rogers privacy litigation (January 18, 2015).

• Rogers AND Privacy policy.
• Rogers AND privacy challenges.
• Rogers Communication AND privacy issues.

• Rogers Privacy Case.

• “Rogers Communications” back to 01/01/2010 (January 18, 2015).
• “Rogers Wireless” back to 01/01/2010 (January 18, 2015).
• intervener & “Rogers Communications” back to 01/01/2010 (January 18, 2015).

• Rogers Communications in Case Name, limited to previous 5 years (January 18, 2015).
• rogers wireless in Case Name, limited to previous 5 years (January 18, 2015).
• “rogers communications” & intervener limited to previous 5 years (January 23, 2015).

• “Rogers Communications” (January 18, 2015).
• “Rogers Wireless” (January 18, 2015).

Appendix A: Provisions related to Transparency about conditions for third party data disclosures

(Criterion #4)

• Legal authority: PIPEDA and CRTC Rules permit confirming basic information like name, address and listed phone number.
• Details: These requests are to confirm a customer’s name and address, which we respond to so police do not issue a warrant to the wrong person.
• Examples of info provided: When provided with a name and address we will confirm whether or not the person is a Rogers customer and when provided with a listed phone number we’ll provide the name and address of a customer. IP address is not provided.

• Legal authority: Issued under the Criminal Code or other laws.
• Details: A court order or warrant includes production orders, summons, subpoenas and search warrants issued by a judge or other judicial officer. It compels us to provide customer information to police or other authorities or to attend court to provide evidence/testimony about customer information.
• Examples of info provided: Customer account information like name and address, payment history, billing records, or call records.

• Legal authority: Issued under laws such as the Customs Act or Income Tax Act.
• Details: An order that compels us to provide customer information to the requesting agency.
• Examples of info provided: Customer account information like payment history, billing records, or call records.

• Legal authority: The Criminal Code and PIPEDA.
• Details: We assist police services in emergency life threatening situations such as missing persons cases and individuals in distress.
• Examples of info provided: Helping locate someone with a cell phone and providing contact details for someone who has contacted emergency services and may be unable to communicate.

• Legal authority: The Criminal Code and PIPEDA.
• Details: We assist police during child exploitation investigations.
• Examples of info provided: Confirming a customer’s name and address when provided with an IP address so that police can get a search or arrest warrant to stop the sexual exploitation of a child.

• Legal authority: Issued under Mutual Legal Assistance in Criminal Matters Act.
• Details: We don’t respond to requests from foreign agencies, but we do advise them to have their country’s justice authority contact the Department of Justice Canada. If that country has a treaty or convention with Canada, the request is processed by Canadian authorities and an order may be issued by a Canadian court to gather evidence. We’re compelled to provide customer information to the police or other authority in Canada conducting the investigation.
• Examples of info provided: Customer account information like payment history, billing records, or call records.”

• you;
• a person who, in our reasonable judgment, is seeking the information as your agent;
• another telephone company, provided the information is required for the efficient and cost-effective provision of telephone service and disclosure is made on a confidential basis, with the information to be used only for that purpose;
• a company involved in supplying you with telephone or telephone directory-related services, provided the information is required for that purpose and disclosure is made on a confidential basis, with the information to be used only for that purpose;
• an agent retained by us in the collection of your account or to perform other administrative functions for us, provided the information is required for and used only for that purpose;
• an agent retained by us to evaluate your creditworthiness, provided the information is required for and is to be used only for that purpose;
• a law enforcement agency whenever we have reasonable grounds to believe that you have knowingly supplied us with false or misleading information or are otherwise involved in unlawful activities;
• a public authority or agent of a public authority if, in our reasonable judgment, it appears that there is imminent danger to life or property which could be avoided or minimized by disclosure of the information; or
• a public authority or agent of a public authority, for emergency public alerting purposes, if a public authority has determined that there is an imminent or unfolding danger that threatens the life, health or security of an individual and that the danger could be avoided or minimized by disclosure of the information.

• by written consent;
• by oral confirmation verified by an independent third party;
• by electronic confirmation through the use of a toll-free number;
• by electronic confirmation via the Internet;
• by oral consent, where an audio recording of the consent is retained by us; or by consent through other methods, as long as an objective documented record of your consent is created by you or by an independent third party.”

Appendix B: Sources

• Applies to: Rogers Communications, Rogers Cable, Rogers Wireless and Rogers Media (per its first provision).
• Last consulted January 18, 2015.

• This report does not specify its application.
  • However, it was issued by “Rogers Communications.” Rogers Communications’ annual report begins: “Rogers Communications is a diversified Canadian telecommunications and media company. Rogers Wireless is Canada’s largest wireless voice and data telecommunications services provider…”
  • In addition, the report includes examples of disclosure that clearly relate to wireless services, such as: “Helping locate someone with a cell phone and providing contact details for someone who has contacted emergency services and may be unable to communicate.”
  • It is therefore assumed that this report covers Rogers Wireless.
• Last consulted January 18, 2015.

• FAQs about Rogers Commitment to Privacy does not specify its application. However, it refers throughout to “The Rogers Group of Companies” which it states includes “Rogers Cable, Rogers Wireless and Rogers Media” (per “Do the Rogers Group of Companies ask for personal information?”).
• Last consulted January 18, 2015.

• This document is a landing page that links to Rogers’ privacy materials. It does not specify what is included in “Rogers” as it uses the term. As the policies it links to all appear to apply to Rogers’ wireless services, however, it is assumed this page does as well.
• Last consulted January 17, 2015.

• Last consulted January 17, 2015.