DPI doesn’t invade privacy
While CIPPIC is deservedly collecting praise for its successful challenge of Facebook’s privacy practices, it recently lost a challenge related to deep packet inspection (DPI).
CIPPIC had argued that: (1) Bell uses DPI to collect and use personal information without customers’ consent; (2) Bell collects more personal information than is necessary to ensure network integrity and service quality; and, (3) Bell does not adequately inform its customers of its practices.
In a letter to CIPPIC and Bell, the Privacy Commission concluded that only the third complaint was “well-founded”:
Accordingly, the complaint is not well-founded with regard to the two matters of consent and limiting collection, but well-founded with regard to the matters of openness.
In respect of increasing transparency, the changes sought appear relatively minor:
- Agreeing with Bell’s idea to add a FAQ on the Bell Privacy web pages
- Adding a statement to Bell’s existing FAQ on network management to state that the customer’s IP address is collected
- Adding a heading (along the lines of “Customer Service Information”) to Bell’s internet service agreements
The Privacy Commission made some important statements in its 18 page Report of Findings.
For example, the Privacy Commission found:
- Peer-to-Peer (P2P) applications are large users of bandwidth. Applications that are often used for music and movie file sharing between computers can consume a great deal of capacity and “slow down” other internet traffic;
- The investigation confirmed that the use of P2P does increase network traffic and that the widespread phenomenon of congestion is largely caused by user downloads or file sharing using P2P;
- DPI and other traffic management tools are among several means by which ISPs can optimize traffic flow.
To what extent will these findings be consistent with the CRTC’s review of network management practices? Is this a foreshadowing?
Update [August 28, 1:10 pm]
Here is a link to the OPC finding [
pdf, 2.19MB]

