The 3+3 Project: Virgin

Half Star: The carrier only vaguely states that it operates according to applicable legislation or doesn’t mention third party PIPEDA-equivalent protection.

No Star: The carrier makes no indication that it complies with PIPEDA or substantially equivalent privacy legislation.

Explanation:

• Virgin does not make any explicit reference to the Personal Information Protection and Electronic Documents Act (PIPEDA), to similar applicable legislation, or to third party PIPEDA-equivalent protection.
• The Virgin Mobile Canada Privacy Policy does refer to complying “with all Canadian requirements to protect identifiable information about you”. However, this criterion requires a reference to legislation. In addition, the reference appears to be a reference to data security alone. PIPEDA goes beyond these considerations.
• The Virgin Mobile Canada Privacy Policy states that it may disclose customer personal information to third parties and “has implemented safeguards to ensure that our service providers treat Personal Information in a way that is consistent with the terms of this Privacy Policy”. However, since the Virgin Mobile Canada Privacy Policy does not mention PIPEDA or other applicable legislation, this cannot constitute a statement that third parties must provide PIPEDA-equivalent protection.
• The Virgin Mobile Canada Terms and Conditions of Service refer to “protect[ing] your personal information in a manner consistent with Virgin Mobile’s Privacy Policies available at vm.ca/privacy and applicable laws.” As the Virgin Mobile Canada Terms and Conditions of Service were not formally a part of Virgin’s evaluation, however, it cannot receive credit for this reference.
  • Had this provision been counted, Virgin might or might not have earned a half star: it makes a clear reference to “applicable law”, but only in the context of protecting personal information. PIPEDA goes beyond these considerations. It is also not necessarily clear that this is a reference to privacy laws.

Provisions:

“Our Commitment

Virgin Mobile Canada ("Virgin Mobile") respects and complies with all Canadian requirements to protect identifiable information about you ("Personal Information"). The purpose of this Privacy Policy is to inform you about why we collect and how we use your personally identifiable information ("Personal Information"), and to provide you with contact information should you have any questions or concerns about Virgin Mobile's privacy practices.” – Virgin Mobile Canada Privacy Policy (Accessed Jan 3, 2015).

“Disclosure of Your Personal Information

Virgin Mobile does not sell, or trade your Personal Information to third parties.

Virgin Mobile may provide its third party service providers and processors with access to your Personal Information. These services providers may include: credit card verification providers, our data warehouse and customer relationship management centre, marketing organizations, who may provide support marketing and promotional communications; internet service providers who administer our web page and provide internet services and host our facilities; and consumer research companies that assist Virgin Mobile with understanding consumer interests by conducting surveys. Some of these service providers may be located outside of Canada. Virgin Mobile only shares your Personal Information to the extent required for the performance of such services. Virgin Mobile has implemented safeguards to ensure that our service providers treat Personal Information in a way that is consistent with the terms of this Privacy Policy and that it is never used except to fulfill services to Virgin Mobile.

Where you expressly consent, Virgin Mobile will disclose your Personal Information to third parties in order that you may access third party content services and participate in third party promotions.

Virgin Mobile may also disclose your Personal Information as permitted or required by law. For example, Virgin Mobile will disclose Personal Information to those governmental bodies who have authority to obtain it, in order to comply with a warrant or subpoena issued by a court of competent jurisdiction, and to comply with record production requirements.

In the event of a sale of all or substantially all of the assets of Virgin Mobile, Virgin Mobile may transfer Personal Information in its control to a third party purchaser that agrees to use Personal Information for the same reasons identified in this Privacy Policy.”

– Virgin Mobile Canada Privacy Policy (Accessed Dec 24, 2015).

“44. How does Virgin Mobile protect my personal information? Your privacy is important to Virgin Mobile. Virgin Mobile’s commitment to privacy protection is found at the end of these Terms and Conditions of Service for your convenient reference. Virgin Mobile protects your personal information in a manner consistent with Virgin Mobile’s Privacy Policies available at vm.ca/privacy and applicable laws. By entering into this Agreement, you agree that Virgin Mobile may share your information with Bell Mobility, Bell Canada, Bell ExpressVu, Bell Media, Bell Aliant, Solo Mobile, the Source and their affiliates.”

– Virgin Mobile Canada Terms and Conditions of Service (“Your Information”) (Accessed Jan 3, 2015). Note that the Virgin Mobile Canada Terms and Conditions of Service were not formally a part of Virgin’s evaluation. Had this provision been counted, Virgin would have earned a half star.

Half Star: A carrier does not indicate that it will notify users when it receives requests, however it indicates that users may send an inquiry in order to acquire such information.*

*Note: This criterion was applied generously: carriers who indicated users could learn about disclosures of their information were scored a half star.

No Star: The carrier makes no mention of how users may learn of third party requests for their personal information.

Explanation:

• Virgin states that it may disclose personal information to third parties but fails to indicate whether it will notify customers of any, let alone all, third party data requests.
• Virgin does not indicate that users can obtain information about requests for their information by sending an inquiry.

Provisions: None

For provisions related to when Virgin may disclose personal information, see Criterion #4 (Transparency about conditions for third party data disclosures).

• The number of requests from third parties, broken down by government (law enforcement, etc.), commercial and non-commercial entities.
• How many requests it complied with.
• How many accounts the requests applied to.
• How many disclosures of information there were.

Half Star: The carrier has published SOME information but leaves many important statistics out.

No Star: The carrier has published no information relating to these types of statistics.

Note: This criterion was edited for ease of use and clarity in presentation here. In highlighting the absence of specific important statistics, we may have applied this criterion more strictly than IXmaps. However, we are not aware of any divergence with IXmaps as to the final score awarded to any carrier.

Explanation:

• Virgin has published no information about third party data requests and disclosures.
  • Although under the right conditions Virgin, as a Bell company, could receive consideration for a report by Bell, if it clearly included Virgin statistics, Bell has also not published any information relating to these types of statistics.

Provisions: None

(1) The carrier explicitly states the circumstances under which personal information will be disclosed to third parties.

(2) It must make clear what standard must be met by the third party in order for this disclosure to be made (e.g. whether a warrant is required).

(3) It must be clear whether or not a subscriber/user will be notified in the case that his or her information is disclosed to a third party and especially the specific conditions under which such information will be disclosed without consent.

Half Star: The carrier refers to some but not all of (1), (2) and (3) or is vague about them.*

*Note: In order to achieve consistency, this criterion was applied generously: carriers that had some discussion of when disclosure of user information could occur received a half star. A carrier would have had to fail entirely to discuss disclosure to receive no star, which none did. This criterion is likely to be revised and simplified in future years to improve consistent application and permit more meaningful distinctions between carriers.

No Star: The carrier fails to indicate any of (1), (2), or (3).

Note: Our evaluation of this criterion looked at discussion of disclosure to any third party, including sharing with affiliated companies, while IXmaps focused on disclosure when compelled by law. However, both approaches yielded the same score on this criterion.

Explanation:

• Virgin gives examples of when disclosure to third parties may occur, including when service providers need it to perform services, “as permitted or required by law,” and when users consent.
• Virgin does not make clear the standard to be met for disclosure to third parties to be made, or whether users will be notified of disclosures.

Provisions:

“Virgin Mobile protects the Personal Information that you provide to us. Virgin Mobile only collects, uses and discloses Personal Information that you supply in order to provide you with the services you have requested.” – Virgin Mobile Canada Privacy Policy (“Our Commitment”) (Accessed Jan 3, 2015).

“How Do We Use Personal Information?

Virgin Mobile may use your Personal Information for the following purposes:

…

To cooperate with law enforcement enquiries, we may be required to disclose information about you to law enforcement or other government officials to respond to claims or legal process. Such disclosure may be required to protect you or us from illegal activity or liability, or to protect the property of Virgin Mobile or the safety of its employees or others”

– Virgin Mobile Canada Privacy Policy (Accessed Dec 24, 2014).

“Disclosure of Your Personal Information

Virgin Mobile does not sell, or trade your Personal Information to third parties.

Virgin Mobile may provide its third party service providers and processors with access to your Personal Information. These services providers may include: credit card verification providers, our data warehouse and customer relationship management centre, marketing organizations, who may provide support marketing and promotional communications; internet service providers who administer our web page and provide internet services and host our facilities; and consumer research companies that assist Virgin Mobile with understanding consumer interests by conducting surveys. Some of these service providers may be located outside of Canada. Virgin Mobile only shares your Personal Information to the extent required for the performance of such services. Virgin Mobile has implemented safeguards to ensure that our service providers treat Personal Information in a way that is consistent with the terms of this Privacy Policy and that it is never used except to fulfill services to Virgin Mobile.

Where you expressly consent, Virgin Mobile will disclose your Personal Information to third parties in order that you may access third party content services and participate in third party promotions.

Virgin Mobile may also disclose your Personal Information as permitted or required by law. For example, Virgin Mobile will disclose Personal Information to those governmental bodies who have authority to obtain it, in order to comply with a warrant or subpoena issued by a court of competent jurisdiction, and to comply with record production requirements.

In the event of a sale of all or substantially all of the assets of Virgin Mobile, Virgin Mobile may transfer Personal Information in its control to a third party purchaser that agrees to use Personal Information for the same reasons identified in this Privacy Policy.”

– Virgin Mobile Canada Privacy Policy (Accessed Dec 24, 2014).

“44. How does Virgin Mobile protect my personal information? Your privacy is important to Virgin Mobile. Virgin Mobile’s commitment to privacy protection is found at the end of these Terms and Conditions of Service for your convenient reference. Virgin Mobile protects your personal information in a manner consistent with Virgin Mobile’s Privacy Policies available at vm.ca/privacy and applicable laws. By entering into this Agreement, you agree that Virgin Mobile may share your information with Bell Mobility, Bell Canada, Bell ExpressVu, Bell Media, Bell Aliant, Solo Mobile, the Source and their affiliates.”

– Virgin Mobile Canada Terms and Conditions of Service (“Your Information”) (Accessed Jan 3, 2015). Note that the Virgin Mobile Canada Terms and Conditions of Service were not formally a part of Virgin’s evaluation (and in any event, would not have affected Virgin’s score on this criterion).

Half Star: The carrier only implicitly states forms of data included in a definition of ‘personal information’, and/or provides a definition which (a) incorporates a closed list of what constitutes personal information that (b) excludes one or more of IP addresses, IMSI/IMSEI numbers, MAC addresses, userIDs, meta-data, browser history, personal account information, or credit card information.

No Star: The carrier gives no definition of ‘personal information’.

Note: IP addresses, IMSI/IMEI numbers and MAC addresses are all used to identify individual devices connected to the Internet. This information could be used to identify individuals and track their locations. For more information, click here.

Explanation:

• Virgin provides a definition of “personal information” in the Virgin Mobile Canada Privacy Policy which includes some examples.
• Although the examples are not a closed list, most of the key elements required to do well on this criterion are not included. For example, there is no reference to IP addresses or meta-data.
• Virgin’s definition of personal information was the poorest among carriers receiving a half star. Its examples were sufficiently obvious and uninformative that it might have earned no star on this criterion, had there not been other carriers who gave no definition of personal information at all.
• The Virgin Mobile Canada Terms and Conditions of Service offer additional examples of what constitutes “personal information”. The inclusion of “service usage such as wireless call records, long distance usage or Internet surfing habits” make the Virgin Mobile Canada Terms and Conditions of Service definition a better definition than the one in Virgin’s privacy materials. However, the Virgin Mobile Canada Terms and Conditions of Service were not formally a part of Virgin’s evaluation, and even if they had been, the additional examples would not have been sufficient to raise Virgin’s score on this criterion.

Provisions:

“Personal Information that Virgin Mobile collects includes information such as your name, address, telephone number, credit card information and verification (where you provide a credit card for payment) or if you apply to come and work with us, your resume and references (including all the information that you may provide in such documents). Additionally, when you choose to participate in marketing programs, you may also provide additional Personal Information.” – Virgin Mobile Canada Privacy Policy (“What Personal Information Do We Collect?”) (Accessed Dec 24, 2014).

“The Virgin Mobile Privacy Policy applies to your Personal Information. Personal information can include:

• Your name, address and phone number(s).
• Other information about the Virgin Mobile product(s) that you subscribe to, such as calling features or programming.
• Your service usage such as wireless call records, long distance usage or Internet surfing habits.
• Account information such as the status of your account or your method of payment.”

– Virgin Mobile Canada Terms and Conditions of Service (“Privacy Policy”) (Accessed Dec 24, 2014). Note that the Virgin Mobile Canada Terms and Conditions of Service were not formally a part of Virgin’s evaluation (and in any event, would not have affected Virgin’s score on this criterion).

Half Star: The carrier only states the retention period for limited types of information. For example, a company may state that it retains consumers’ browsing history for 2 weeks, but provides no information on call log retention.

No Star: The carrier either provides no information on data retention periods OR provides a statement so vague as to not inform the consumer beyond what PIPEDA requires. For instance, “[Our company] shall retain personal information only as long as necessary for the fulfillment of the purposes for which it was collected.” (Example wording is from Bell’s privacy policy.)

Explanation:

Virgin provides a statement so vague as to not inform the consumer beyond what PIPEDA requires. It merely restates PIPEDA’s Principle 5 - Limiting Use, Disclosure, and Retention.

Provisions:

“Retention of Your Personal Information

Virgin Mobile will only keep your Personal Information for as long as it is required for internal business purposes and in order to satisfy various accounting and legal requirements. When we no longer require your Personal Information, we will take steps to ensure that is destroyed, or that your personally identifiable information is removed.”

– Virgin Mobile Canada Privacy Policy (Accessed Dec 24, 2014).

Half Star: The carrier only indicates that there is a possibility that data may be stored and/or processed subject to a foreign jurisdiction. No jurisdiction is noted or details are not provided.

No Star: The carrier fails to clearly indicate whether or not data may be stored and/or processed such that it may be subject to a foreign jurisdiction.

Explanation:

• Virgin mentions that personal information may be stored outside Canada, but without providing any details on specific jurisdictions or what types of disclosure such information may be subject to.

Provisions:

“Virgin Mobile stores most of its electronic and paper documents at its head office in Toronto, Canada. As indicated [below], as some companies providing services to Virgin Mobile may be located outside of Canada, your Personal Information may also be stored in those jurisdictions.” – Virgin Mobile Canada Privacy Policy (“How is Your Personal Information Stored?”) (Accessed Dec 24, 2014).

“Virgin Mobile may provide its third party service providers and processors with access to your Personal Information. These services providers may include: credit card verification providers, our data warehouse and customer relationship management centre, marketing organizations, who may provide support marketing and promotional communications; internet service providers who administer our web page and provide internet services and host our facilities; and consumer research companies that assist Virgin Mobile with understanding consumer interests by conducting surveys. Some of these service providers may be located outside of Canada…” – Virgin Mobile Canada Privacy Policy (“Disclosure of Your Personal Information”) (Accessed Dec 24, 2014).

Half Star: The carrier is vague about the geographical locations or jurisdictional exposure of personal data routing.

No Star: The carrier gives no indication of the geographical locations or jurisdictions where personal data is routed.

Explanation:

• Virgin gives no indication as to the geographical locations or jurisdictions through which personal data is routed.

Provisions: None

Half Star: The carrier is vague about its policies for ensuring Canadian routing of domestic traffic and the measures it takes to ensure this. In the absence of a clear policy statement, a carrier (whether Canadian or foreign) that peers openly at some but not all Canadian public IXPs in its operating regions will earn a half star.

No Star: The carrier gives no indication of any policy or concrete measures to promote domestic routing when possible, nor does it peer openly at any Canadian public IXPs.

Note: Due to minor changes in wording during the evaluation process, we may have applied this criterion more strictly than IXmaps. However, we are not aware of any divergence with IXmaps as to the final score awarded to any carrier.

Explanation:

• Virgin gives no indication that it promotes domestic routing where possible.
• Virgin does not peer openly at any Canadian public IXPs as of January 9, 2015. The IXPs reviewed were:
  • Manitoba Internet Exchange: http://www.mbix.ca/
  • Échange Internet de Montréal: http://www.qix.ca/en/
  • Toronto Internet Exchange: http://www.torix.ca/
  • Ottawa Internet Exchange: http://www.ottix.net/
  • Halifax Internet Exchange: http://hfxix.ca/
  • Calgary Internet Exchange: http://yycix.ca/
• Virgin is a Bell company. If Bell had been peering openly at Canadian IXPs during the research period, we might have asked whether that meant Virgin’s traffic was being routed domestically as well. However, since Bell earned no star on this issue, the question of whether Virgin should get credit for actions by Bell has been left for the future.

Provisions: None

For an explanation of IXPs and open and conditional peering, see the project overview.

• Involvement in public debates over mass state surveillance;
• Involvement in privacy or surveillance related legislative initiatives (e.g. the current Bill C-13 on lawful access);
• Defending user privacy rights in court; or
• Ties to advocacy organizations or initiatives promoting user privacy rights.

Half Star: The carrier has defended user privacy rights politically, in court or legislatively, but there is no reference to this in its privacy pages.

No Star: There is no readily available public evidence that the carrier has taken a positive pro-privacy position in any of the above areas.

Note: While this criterion was edited for ease of use and clarity in presentation here, we are not aware of any divergence with IXmaps with regard to application.

• No indication of Virgin publicly supporting user privacy rights was found.
• A search of legal databases for cases involving Virgin did not turn up any case law where Virgin defended user privacy rights in court.
• Virgin is a Bell company, but as Bell also earned no star on this criterion, the question of whether Virgin should get credit for actions by Bell did not arise.

Provisions and other sources: None

Google searches used in seeking public evidence of a pro-privacy position (The most recent search date is given next to each search term. Material up to 5 years old was reviewed.)

“Virgin Mobile Canada privacy” (December 24, 2014).

“cell privacy Virgin Mobile Canada” (December 24, 2014).

“Virgin Mobile” privacy (February 24, 2015).

“Virgin Mobile” transparency (February 24, 2015).

“Virgin Mobile” “personal information” (February 24, 2015).

“Virgin Mobile” “customer information” (February 24, 2015).

“Virgin Mobile” “subscriber information” (February 24, 2015).

“Virgin Mobile” disclosure (February 24, 2015).

“Virgin Mobile” “lawful access” (February 24, 2015).

“Virgin Mobile” “warrant” (February 24, 2015).

“Virgin Mobile” “legal authority” (February 24, 2015).

“Virgin Mobile” “Bill C-13” (February 24, 2015).

Searches used in seeking case law where Virgin defended user privacy rights in Canadian courts (The most recent search date is given next to each search term. Material up to 5 years old was reviewed.)

Westlaw Canada:

• “Virgin Mobile” (December 24 2014).
• “Virgin Mobile privacy” (December 24 2014).

Quicklaw:

• “Virgin Mobile” (January 23, 2015).
• “Virgin Mobile privacy” (January 23, 2015).

CanLii:

• “Virgin Mobile” (January 23, 2015).
• “Virgin Mobile privacy” (January 23, 2015).

Appendix A: Sources

Virgin Mobile Canada Privacy Policy

• Applies to: Virgin Mobile Canada.
  • The first sentence in the Virgin Mobile Canada Privacy Policy begins: “Virgin Mobile Canada (“Virgin Mobile”) respects…” suggesting that “Virgin Mobile” as used throughout the policy means “Virgin Mobile Canada.” (per “Our Commitment”).
  • At the end of the policy, Virgin states that “[w]hen it comes to your preferences for privacy and marketing, ‘Virgin Mobile and its affiliates’ refers to the following companies:
    • Bell Canada
    • Bell Mobility Inc.
    • Bell Aliant Regional Communications Inc.
    • Bell ExpressVu L.P.
    • The Source (Bell) Electronics Inc.
    • Bell Media Inc.”

(per “What Does “Virgin Mobile And Its Affiliates” Mean?”). However, neither the phrase “Virgin Mobile and its affiliates” nor the term “affiliates” occur elsewhere in the Virgin Mobile Canada Privacy Policy, and so it does not appear that the Virgin Mobile Canada Privacy Policy covers Virgin’s affiliates.

• The dates on which the provisions relied on were accessed are reproduced alongside each provision, below.

Media releases on Virgin website back to 2009: http://www.virginmobile.ca/en/media-releases/index.html?itcid=FOT:25

• Last consulted February 24, 2015.