PIAC REPORT: National Identity Cards, Biometrics and the Consumer: Displacing the Personal from the Person

As Canada continues to bolster national security post September 11th, and consumer commerce becomes increasingly jeopardized by identity theft, a National Identity Card scheme has been discussed as a potential solution. However, critics charge that National Identity Cards could turn into “de facto internal passports” which would be required to access almost all government or business services. Additionally, this new Card could lead to serious breaches to personal privacy. First, this report focuses on the security solutions offered by a National Identity Card, in terms of (a) National Security, (b) Identity Theft. Second, the privacy implications of a National Identity Card program will be identified, including a discussion of the effect of The Personal Information Protection and Electronic Documents Act (PIPEDA) in enabling infringement of personal privacy in the context of a National Identity Card scheme.
A National ID Card may likely be an inadequate solution to bolster national security because it fails to achieve the three broad goals set in Canada’s National Security Policy. National Identity Cards would link names with faces, and possibly even with biometric data, but would not, on its own, identify those persons harboring malicious intentions. Additionally, National Identity Cards would likely not help to curb identity theft, as identity theft has many causes. Even those for which a National ID Card might directly apply, there are weaknesses and dangers in its use. This report examines the reasons behind these shortcoming in terms of (1) Easy Credit, (2) Consumer Control of Credit Bureau Files and (3) Function Creep.
A National Identity Card program will also face technological and practical shortcomings. (1) They will be prone to fraud and counterfeit, just like other forms of identification. (2) Specifying who will be issued a Card, and who will not, includes the potential for social exclusion. And, (3) because of serious concerns about its accuracy and reliability, biometric indicators may in fact make National Identity Cards less secure. Given the pitfalls associated with a National Identity Card program, consumers are justified to be concerned about fraud, the implications of misidentification, as well as the cost of implementation.
A National Identity Card will also involve a vast accumulation of consumer information, which is cause for concern from a privacy standpoint. The major privacy implications stem from function creep, the threat posed by use of collected information for purposes other than that for which it was originally collected. Further, protecting the databases holding personal information is not only costly, but difficult to assure. Finally, exceptions under PIPEDA permit information to be exchanged between and within government, as well as between businesses and government for the protection of national security. This report concludes that the use of National Identity Cards, with or without biometrics, in interactions between individuals and the state or commercial entities, in a context of inadequate legal and technological safeguards, would introduce new ways of violating individual privacy and integrity. It would also be unacceptably costly given the expected, poor, results. However, should the Canadian federal government pursue the idea of a National Identity Card, recommendations have been supplied to reduce the risk of harm to consumers and citizens with respect to privacy and civil rights.
Read the full report:
 

 

PIAC REPORT: Spyware: Looking Out for Consumers

Spyware is essentially software that limits users’ control over their computers, and often is installed surreptitiously. Historically much of this type of software tracked users’ online behaviour and delivered pop-up advertising, leading to the label “spyware”. Its association with pop-up advertising and its difficult uninstall methods soon led to its reputation as an Internet scourge. “Spyware” as a broad category now includes many behaviours beyond spying, from the more ‘innocent’ displaying of advertisements right through to the delivery of viruses allowing for the remote control of the user’s computer.
Over the last few years, spyware infection rates rose dramatically until their peak in late 2004. While there was a reduction in spyware installation rates between late 2004 and late 2005, likely due to Windows security patches, consumer education and advancements in anti-spyware software, infection rates again are climbing to near-record levels in the first quarter of 2006.
This trend is a serious threat, since spyware lowers consumer confidence in e-commerce, costs consumers tremendous amounts of time and money, and threatens governments and corporations with the possibility of large-scale security vulnerabilities. Spyware is also responsible for an increasing amount of service calls and computer crashes each year.
Extreme spyware activities likely violate several Canadian laws, including consumer protection legislation, PIPEDA, Criminal Code provisions, the Competition Act and the common law tort of trespass to chattels. However, neither remedies currently available to individual users nor deterrents to spyware producers are sufficient to address the problem. While intentionally deceptive or misleading installations are likely caught by several statutes, it is often selectively omitted information, rather than outright deceptive statements, that characterize the spyware installation process. It is uncertain if these more common behaviours are actionable, despite the fact that a large majority of computer users report having no knowledge of the software in question, or how it was installed. Government actors in Canada are not actively pursuing any enforcement activities against spyware companies on their own initiative at the moment. This is likely due to a lack of resources or a view that spyware regulation does not fit the specific department’s mandate.
In this environment a legislative response may be necessary, but there is a major difficulty in regulating spyware: its lack of a cohesive definition. Any definition based on post-installation behaviours will ultimately leave significant discretion and potentially create unintended liability, because spyware behaviours can almost always have legitimate purposes in other contexts. Because of this limitation, the most appropriate legislative response should target the installation procedure, and require specific disclosures for potentially unwanted software behaviours that inhibit user control. This strategy will lead to a spyware definition built around the consent of the user, avoiding the need to outlaw specific software functionality and clarifying the emerging software installation regime.
Further regulation can rein in absurdly large affiliate networks, prevent the targeting of children to obtain installations, and perhaps pressure advertising companies to exercise more due diligence in controlling where their advertisements are displayed. Uninstall requirements could also be established, to eliminate misleading or ineffective uninstall procedures.
Critics of spyware regulation state that regulating bad actors on the Internet is impossible due to jurisdictional issues, or that additional notice will not affect user behaviour. Furthermore, legitimate software vendors likely fear overly broad legislation that could lead to unintended liability. While jurisdictional problems will always stand in the way of effective Internet regulation, this concern should not prevent spyware regulation since many large, established companies engage in spyware practices. These corporations can certainly be regulated with some success. The concern over additional notice similarly should not prevent regulation. While the relationship between notice and user behaviour may be questionable, uncertainty should not prevent legislators from establishing baseline standards to protect the public. Finally, legislation could be drafted in such a way as to minimize compliance efforts by legitimate software vendors, since most legitimate software will not engage in ‘potentially unwanted’ software activity. Generally any software that allows the user to control it will not be affected by legislation, and the vast majority of legitimate software allows the user to do so.
While US government actors have been criticized for their slow progress in tackling the threat posed by spyware, the Canadian government has done little concrete to date. Spyware nonetheless has been harming Canadian for several years and this inaction is becoming noticeable. Parliament should immediately determine which department is responsible for enforcing laws against spyware activity, and allocate the necessary resources to investigate and prosecute offenders. Spyware legislation, focused on the installation procedure, can then be introduced to aid in the fight, ensuring a strong reaction to the problem while minimally burdening legitimate software vendors.
While spyware has highlighted the need for clearer rules in software installation procedures, regulation of spyware should be viewed with a greater goal in mind: a stronger statement of users’ rights over their computers. Users should always be presumed to desire complete control over their computer, and any attempt to limit that control through the installation of software should be done in a transparent fashion that requires fair and obvious consent.
This report therefore makes recommendations for a multi-facted approach to controlling spyware that includes regulation of certain aspects of spyware. In particular, this report recommends the following:

• Give a clear mandate and allocate resources towards the department best able to handle spyware complaints and enforce current laws against spyware activity.
• Enforce current consumer protection and competition laws against companies who engage in the worst spyware activity.
• Continue and strengthen consumer education initiatives regarding spyware, accentuating:
  • Only download from websites you trust;
  • Update your operating system software;
  • Install a trusted anti-spyware solution.
• Build support in the software community for clearer rules of installation for potentially unwanted software.
• Develop initiatives towards more accountability in the advertising industry, clarifying how advertising money gets to spyware distributors and what advertisers, advertising companies and brokers can do about it.
• Introduce spyware-specific legislation that:
  • Creates liability for software producers for the actions of their affiliates;
  • Clarifies the rules of installing potentially unwanted software by creating clear disclosure requirements;
  • Creates a higher threshold of consent for software installations than simple contractual consent, namely “fair and obvious” consent;
  • Creates a private right of action, with statutory damages, for unwanted installations of spyware;
  • Specifically empowers an agency with spyware enforcement and permits that agency to cooperate with foreign counterparts
  • Regulates the practice of targeting software installations towards children;
  • Requires standard uninstall procedures for all software;
  • Contains exemptions for operating systems.

Although spyware appears to be on its way to becoming a fact consumers are resigned to, the truth is that the dangers of its unchecked growth are too large to ignore and the options for slowing its growth are both possible and not overly onerous. This report is a call to action on the part of consumers, governments and industry to work together to ensure consumers’ computers remain useful and unpolluted.
Download full report:
 

PIAC Report: Spyware: Looking Out for Consumers
Download File: spyware_piac_report.pdf [size: 0.84 mb]

Canadians Attitudes to Financial Services

National Survey conducted for PIAC by EKOS Research Associates on Canadians Attitudes to Financial Services [pdf file: 0.65mb]
 

Where Should the Green Choices Be Made

September 27, 2006
For immediate release
Attention: Business/Energy Editors
PIAC Report: Require local electricity retailers use renewable sources
(OTTAWA)—The Public Interest Advocacy Centre (PIAC) today released a report recommending all electricity suppliers be required to obtain a percentage of their supply from renewable sources.
The report, Where Should the Green Choices Be Made published September 2006, was funded by Industry Canada. It is available at:

Fighting for consumer rights

Where Should the Green Choices Be Made endorses the “portfolio standard” requiring public and private retailers of energy including local distribution companies, ensure a target percentage of their electricity sold can be replaced by natural processes such as sunshine, wind, flowing water, biological processes or geothermal heat flow.
The PIAC study also suggest voluntary approaches such as green marketing will not have a enough impact to produce the desired results.
“Canadian policy makers must face the fact that market forces alone will not do the job. We need to develop new regulatory models,” says Michael Janigan, PIAC Executive Director and General Counsel.
The study examined approaches to encouraging the development and use of renewable energy in North American jurisdictions including details concerning the minimum renewable requirements in a number of American states.
Michael Janigan
Executive Director and General Counsel
Public Interest Advocacy Centre
(613) 562-4002×26
 

Green Choices Report
Download File: green_choices.pdf [size: 0.28 mb]

Letting Everyone Help: Removing Barriers to Consumer Participation In Energy Conservation

Final Report: LETTING EVERYONE HELP: REMOVING BARRIERS TO CONSUMER PARTICIPATION IN ENERGY CONSERVATION [pdf file: 0.46mb]
PIAC, February 2006
Executive Summary
The necessity to reduce overall consumption of energy is a goal common to Canadian governments at all levels. This goal is driven, in part, by the duty to reduce emissions pursuant to Canada’s international agreements and the stark economic reality of the costs associated with construction of new power generation to meet increasing demand.
With rising energy prices beginning to mirror such increases in demand, efforts to reduce consumption have taken on new urgency for Canadian consumers. Not only are conservation efforts essential as part of an overall strategy for meeting Canadian energy needs, but they are increasingly necessary for Canadian households to undertake to avoid economic burden.
However, not all Canadians may have the ability to reduce household energy consumption because of barriers to participation. These barriers may include the inability to finance changes to heating equipment or household features that would reduce energy bills. There can be language and educational barriers which may constrain take-up. As well, there are structural barriers to many rental households participating in conservation programs. Landlords that pass on energy costs to tenants may be ambivalent about making expenditures to benefit such tenants and tenants whose energy costs are included in their rent have little incentive to expend household income on conservation.
Statistics Canada defines low income as “an income threshold below which an average family will likely devote a larger share of its income to the necessities of food, shelter and clothing that an average family would”. In 2000, the incidence of low income households among the Canadian population was 16.2%. The average Canadian household expended 20.4 % on shelter costs (including utilities) .
It is unlikely that energy costs are going to be reduced in the near term. Analysts predict that the long term prices for natural gas and energy are up and are likely to stay that way. In the Northeastern United States, low income customers have already experienced potentially catastrophic increases in heating between 9.4% and 113.6% in heating bills since 2001 with the likelihood of more such increases occurring as demand increases . The need for the removal of barriers, and in particular financial barriers, to access to energy conservation measures is likely becoming acute in Canadian jurisdictions as well.
An Ontario-based study in 2004 proposed a package of basic and extended measures which involved home assessments, energy conserving equipment and education. The cost of basic measures was $1000 and those of extended measures including the replacement of furnaces and appliances was $3700 . These monetary amounts show a requirement for external funding for low income customers to access the conservation savings conservatively estimated in this report at 20% of energy costs. The structural problems associated with the misplaced benefit incentives referred to above also has to be solved for low income tenant renters.
There are numerous examples of successful programs that have been undertaken in various jurisdictions to address the problems of barrier reduction. One of the most successful models has been undertaken in the United Kingdom associated with the policy concept of “fuel poverty”. Fuel poverty is said to exist where a household has to spend over 10% of its income on all fuel use to heat the home to an adequate standard of warmth. The major causes of fuel poverty has been identified by the government as poor home energy efficiency and low incomes. The U.K. program to end fuel poverty has set definite goals for ending fuel poverty within a fifteen year window.
This report also describes programs that address the energy needs of disadvantaged groups; such needs that may, if not remedied impair their ability to participate in conservation programs. These include emergency programs, energy bill assistance, and consumer protection measures. Emergency programs address particular crises, chiefly financial that may result in the disconnection of customers from the network. Energy Bill assistance programs attempt to remedy systemic financial ability to pay energy bills from meager household income. Consumer protection programs cover a wide variety of programs from protection of customers from disconnection in winter to implementation of higher efficiency standards for housing or electrical appliances.
The report principally concentrates on programs associated with enabling conservation efforts on the part of utility customers who would otherwise be unable to do so. The measures described include those offered in the United Kingdom, the United States and Canada. In the United States, there are four major mechanisms for addressing the removal of barriers. These are Low Income Home Energy Assistance Program (LIHEAP), Weatherization Assistance Program (WAP), System Benefits Funds, or Utility financing. The conservation and weatherization services funded by these programs generally involve common sense measures that are made accessible to program participants. These measures include energy audits, fuel switching including hot water conversion, insulation for attics, compact fluorescent lighting, energy efficient refrigerators, energy efficient furnaces, water heater blankets, weatherstripping, caulking, and repairs to reduce air infiltration.
In the United Kingdom, the campaign against fuel poverty attempts to carry out the government directed strategy through mechanisms that include both public and private initatives. These include the establishment of energy efficiency obligations through Ofgem, the regulator of gas and electricity suppliers. Such obligations, called the Energy Efficiency Commitment (EEC), require and incent such suppliers to carry out improvements in energy efficiency by way of innovative actions. Over a three year period from 2002-2005, the EEC resulted in savings of approximately $70 CDN per year to low income households. The EEC programs consist primarily of the same menu of measures funded in the United States that are described above. Other programs include the funding of energy efficient partnerships to achieve energy efficiency in the building process by doing such things as developing national standards and best practices. Local authorities fund home inprovement agencies that provide cost effective repair and maintenance assistance to clients that are unsuitably housed.
The report also describes efforts to extend low income conservation programs to disadvantaged customers in various Canadian provinces. In Quebec, Equiterre carries out audits and follow up refits and education of customers which have achieved estimated savings in aggregate that are double the cost of the program. As well, the expenditures have been shown to produce job growth at a higher rate than power generation projects.
In Ontario, electric distribution companies have embarked upon major initiatives at the behest of the Ontario Energy Board to fund conservation programs from their rates. Social housing buildings have been targeted for energy audits to identify all possible ways to save energy from switching light bulbs to installing a new furnace. Natural gas local distribution companies (LDCs) have been delivering demand side management programs to gas consumers for over a decade. The report describes how one LDC, Enbridge will be attempting to make its residential conservation programs more accessible to low income customers through a strategy of education and outreach. In addition to the efforts by gas and electric LDCs the Ontario government’s own conservation bureau operated by the Ontario Power Authority will spend $235 million (with another 75 million dollars leveraged) over five years on low income programs addressing the needs of low income homeowners and low income and social housing tenants.
The OPA’s program measures derive from a study financed by the Ontario Government and the Toronto Atmospheric Fund referenced earlier. The study gave the following general recommendations for low income conservation programs:

1. The focus should be on savings associated with energy for the safe preparation of food, home heating and cooling (for vulnerable groups)
2. The plan should meet immediate needs of low-income and at the same time produce long term (but based on preventative measures)
3. Prior to program implementation, the overall strategic program planning should be negotiated with low income and advocacy groups
4. Clear and simple screening process for identifying program participants
5. All low-income households need to be included (including renters)
6. The program funds should not come out of other subsidies or financial support given to participants
7. Upfront cost to participants will not be required for energy efficiency upgrade programs
8. Energy efficiency and conservation programs should address the following components:
   1. Appliances
   2. Envelopes
   3. Heating
   1. Cooling

1. Delivery of programs should be done by local community groups with experiences in delivering energy efficient programsIn assessing the cost effectiveness of low income conservation programs, it is important that the overall impact of conservation programs upon demand and the resultant avoided costs be considered. In Ontario, for example, every 1000 MWs of new electricity production requires an expenditure of at least $1.6 billion. It means that expenditures such as those of the OPA above are at least 50% justified by the avoided costs alone as they will reduce demand by 100 MW.Other studies have confirmed the viability of these programs. Assessments of California’s Low Income Efficiency Plan filed with the California Public Utilities Commission show bill savings to cost ratios which range from .31 to .97. This provides comfort that the additional avoided costs and societal benefits create a total amount that far eclipses the costs for the implementation of the usual range of conservation measures previously discussed.As well, an important 1999 study has shown that the non-energy, non-environmental benefits to the utility of investing in low income efficiency programs are substantial. These benefits include lower utility costs for accounts collection, emergency services, bad debts and reconnections and societal benefits mainly in the form of reduced social service delivery costs. The authors of the study conservatively estimate that such benefits, in aggregate should approximate 50% of the program costs for the utility .
   While there is no formula for removals of barriers to access for conservation programs, the following should be considered as part of the package:
2. Customer education and outreach, including home audits and follow up;
3. Elimination or reduction of up-front costs

1. Service delivery that is rationalized to involve delivery agents with experience with the communityFinally, there are two general observations that can be made about the effectiveness of such programs to date:
2. The programs have a material effect upon the well-being of the consumer participants, including but not limited to a reduction in household expenses.

1. The program outlays are easily justified financially from the standpoint of any reasonable accounting for benefits, and politically from its ability to provide a higher standard of living for those citizens who are too marginalized to obtain an equivalent positive effect on their own.

Radio Frequency Identification (RFID) and Privacy: Shopping into Surveillance

Download File: rfid.pdf [size: 0.21 mb]

Executive Summary

Radio Frequency Identification (RFID) is a technology that allows people and objects to be identified and tracked via a radio frequency signal. This report looks at privacy issues surrounding the likely use of RFID by major retailers, and suggests limits to these systems consistent with present privacy laws, as well as comments on whether the present privacy law regimes adequately protect consumers from retail surveillance. As this is a new technology, the report will seek to define the new technology, and to report on its applications and likely applications thus far as well as to report on consumer attitudes to the technology.
RFID is well-established in the supply chain of major retailers already. To a certain extent, RFID use in manufacturing and supply chain management has been encouraged by government safety concerns with products such as pharmaceuticals and automobile tires. However, government, when encouraging such ‘pre-retail’ uses, does not generally require privacy impact assessments, which might limit the extension of RFIDs from manufacturing into the retail environment.
Consumers soon will face RFIDs at the retail level. It is this ‘item-level’ use of RFID that raises consumer privacy and related concerns. Item level RFIDs produce individual data which, when linked to an individual shopper through a loyalty card or otherwise, constitutes a form of low-level, distributed consumer surveillance. This potential surveillance raises the specter of consumer profiles that track consumer behaviour in relation to objects. Such profiles may become available to not only the original retailer, but also affiliated companies, or even to the federal government under national security exceptions to Canada’s private sector privacy law. RFID tags, if left live ‘post-sales’ (whether consciously for warranty and related purposes or unconsciously – that is, not ‘killed’ at the point of sale) risk being read by third parties, if encryption or similar security measures are not applied by the original retailer.
RFID technology presents a novel challenge to Canadian privacy law. The “primitive” surveillance capabilities of RFID at present are unlikely to violate a reasonable expectation of privacy as interpreted by the Supreme Court of Canada. However, Canada’s private sector Personal Information Protection and Electronic Documents Act (PIPEDA) does appear to severely limit RFID use for consumer surveillance purposes. RFID technology has caught the eye of Canada’s Office of the Privacy Commissioner (OPCC), which has asked retailers for details of their planned RFID uses.
PIPEDA appears to require retailers who wish to track individual shoppers to obtain the informed consent of customers for the use or disclosure of the shopping patterns the RFID chips reveal about their customers. Such ‘informed consent’ will be difficult to achieve without extensive disclosure to the customer of the full implications of RFID surveillance and a positive indication of consent to the use and disclosure of RFID surveillance.
Retailers with more modest goals of controlling in-store inventory, rather than tracking customers will face less rigour in informing customers of RFID use. But, they will still be required as a matter of course to ‘kill’ RFID tags at the point-of-sale or undertake encryption or similar technological measures to safeguard the personal information of their shoppers from third party interception post-sales. Such retailers would appear to be prohibited from associating personal information from loyalty card or other customer information databases with RFID data obtained from interaction of individual customers with RFID chipped products.
Consumer polling appears to indicate great consumer discomfort in the surveillance aspect of RFID technology. While consumers may welcome certain safety and convenience benefits from RFID, their concern with privacy-invasive aspects of RFID outweighs it to the point where RFID use as surveillance appears unreasonable. In addition, some of the benefits of RFID promised by retailers may in fact interfere with established consumer rights and expectations – for example regarding hassle-free return policies.
As RFID implementation is moving forward quickly, it is recommended that immediate action be undertaken by the OPCC to provide RFID-specific guidelines which explain the constraints on the use of the technology for consumer surveillance and profiling, at least in the absence of very clear, and informed consumer consent. Ideally, the OPCC should ask that RFID- or surveillance-specific provisions be added to PIPEDA during the Parliamentary review of the legislation slated for 2006.

Advocis/POLLARA Report on Canadian’s Views of Banks and Life and Health Insurance

Currently, restrictions prevent banks from selling life and health insurance from their branches. In order to understand the public’s views on this issue, Advocis commissioned POLLARA to conduct a telephone survey of the Canadian general public. The primary objective of this study is to explore Canadians’ attitudes toward the removal of consumer protections related to the sale of life and health insurance by banks. Specifically, this study explores the public’s:
• Perceptions of the provision of service by banks and bank branch employees;
• Concerns about privacy and coercive tied-selling;
• Opinions of current consumer protections regarding the sale of life and health insurance from bank branches; and,
• Perceptions of the amount of access they have to information about life and health insurance.
PIAC does not endorse the specific findings of this poll but is providing this link as part of its coverage of the debate over the appropriate regulation of banking.
 

CBA Research Report on Banks and Insurance: Canadian Attitudes toward Access to Insurance Information and Obligation to Purchase

The Canadian Bankers Association (CBA) today released the results of a poll that shows that, when it comes to shopping around for insurance, Canadians want to be more informed. Insurance salespeople and brokers have claimed that Canadians have enough insurance product information and that they would feel obligated to buy insurance from a bank source if they read a brochure or received a referral to a qualified insurance professional through a bank branch. A new poll by The Strategic Counsel, commissioned by the CBA and released today, found the exact opposite.
PIAC does not endorse the specific findings of this poll but is providing this link as part of its coverage of the debate over the appropriate regulation of banking.
 

Bank Mergers and the Public Interest

This report looks at the rules and legislation that govern mergers of large Canadian banks from the consumer point of view and assesses how large bank mergers would likely affect consumers in relation to issues of access, choice and price of banking services. Large bank mergers are permitted in Canada, subject to a series of reviews, with final approval by the Minister of Finance, but none have been approved in recent years.
This report was prompted by a public review, initiated in 2002 by the federal government, of some of the policies that govern bank mergers. The purpose of the review was to look at the public interest implications of large bank mergers and determine what public interest considerations should be taken into account by the Minister of Finance in making a decision concerning a bank merger proposal. Despite the subject matter of this consultation there was minimal representation from the general public or consumers to the legislative committees that were tasked with this matter in contrast to significant representation and input by banks.
Media Release: Bank Mergers and the Public Interest [pdf file: 0.02mb]
Bank Mergers and the Public Interest (Full Report) [pdf file: 0.13mb]
Executive Summary [pdf file: 0.02mb]
Sommaire exécutif [pdf file: 0.03mb]
 

Credit Reporting: How Are Consumers Faring?

This report looks at the consumer’s experience of credit reporting. Credit reporting agencies are private companies that collect and organize information about a consumer’s credit history and current transactions and then sell it in the form of a consumer report.
Download Report [pdf file: 0.88mb]