Is Bell's Plan to Monitor and Profile Millions of Canadians Legal?

Last week, Bell announced plans to implement new consumer monitoring and profiling practices that would greatly expand how it uses the information it collects on millions of subscribers. The planned scope of Bell's profiling is unprecedented in Canada, reflecting the power of a vertically-integrated media giant to effortlessly track their customers' location, media habits, search activity, website interests, and application usage.

The Bell plan generated a significant public backlash, with the Privacy Commissioner of Canada launching an immediate investigation. Yet the company steadfastly defended its plans, saying that users are supportive of the new policy and maintaining that it is fully compliant with Canadian law.

Given that many of its customers purchase bundled Internet and wireless services, the magnitude of the profiling extends to virtually all media and communications activity. Bell acknowledges that it will be tracking seemingly everything about its customers: which websites they visit, what search terms they enter, what television shows they watch, what applications they use, and what phone calls they make.

Moreover, all of that data will be correlated with additional data points such as location, age, gender, and even bill payment practices.

Why not 'opt-in'?

Bell says it intends to use the data in several ways. First, it will begin to use targeted advertising on its customers by using detailed consumer profiles. The default for the company is that all consumers will be profiled and targeted. If consumers don't want to receive these targeted ads, Bell will force them to opt-out. Second, Bell says it will aggregate its data to sell to other businesses and marketing companies so that they can use the Bell network usage for their own purposes.

Bell insists that its monitoring and profiling plans are legal, claiming that it followed "every guideline" released by the Privacy Commissioner of Canada. However, the upcoming investigation is likely to focus on whether its use of an opt-out system meets the legal standard.

Last year, the Privacy Commissioner released online behavioural advertising guidelines that permit the use of an opt-out approach in some circumstances. The guidelines may not govern here, however, since they explicitly do not apply to advertising in a mobile context.

The guidelines also emphasize that opt-outs can only be used if the information is non-sensitive. Given the breadth of data Bell would use -- including locational information, payment records, and profiles on interests and media activities -- it is hard to see how it can be fairly characterized as non-sensitive. Rather, to ensure compliance with the law, Bell should be adopting an opt-in model, where its customers are only subject to monitoring and profiling if they proactively make that choice.

How will profiling be used?

The legal concerns with the Bell profiling plan are not limited to the private sector privacy law. The Canadian Radio-television and Telecommunications Commission's policy on Internet traffic management states that Internet providers are not permitted to use personal information collected for managing their networks for other purposes. If Bell is obtaining some of the profiling information through the deep-packet inspection of customer Internet use, the plan to use the information for profiling purposes would appear to violate the CRTC policy.

Not only does the Bell profiling plan raise privacy law concerns, but customers are rightly concerned that their profile may be disclosed to law enforcement without a court order. The law currently permits disclosures as part of a law enforcement investigation without court oversight (though an Internet Service Provider can refuse the disclosure if there is no warrant). In the past, Bell has not committed to requiring law enforcement to obtain a court order before it discloses information.

Online behavioural advertising may be increasingly common, yet the Bell profiling and monitoring plan extends far beyond what virtually any other company could collect. That may prove appealing to advertisers, but millions of Bell customers may oppose efforts to extensively track their location, online activities, payment practices, and media habits.