The Canadian Privacy Law Blog: Developments in privacy law and writings of a Canadian privacy lawyer, containing information related to the Personal Information Protection and Electronic Documents Act (aka PIPEDA) and other Canadian and international laws.
The author of this blog, David T.S. Fraser, is a Canadian privacy lawyer who practices with the firm of McInnes Cooper. He is the author of the Physicians' Privacy Manual. He has a national and international practice advising corporations and individuals on matters related to Canadian privacy laws.
For full contact information and a brief bio, please see David's profile.
The views expressed herein are solely the author's and should not be attributed to his employer or clients. Any postings on legal issues are provided as a public service, and do not constitute solicitation or provision of legal advice. The author makes no claims, promises or guarantees about the accuracy, completeness, or adequacy of the information contained herein or linked to. Nothing herein should be used as a substitute for the advice of competent counsel.
This web site is presented for informational purposes only. These materials do not constitute legal advice and do not create a solicitor-client relationship between you and David T.S. Fraser. If you are seeking specific advice related to Canadian privacy law or PIPEDA, contact the author, David T.S. Fraser.
Tuesday, January 31, 2006
The recent controversey over subpoenas of high-profile search engines has spurred a lot of discussion about what search engines know about you. For example, John Battelle was able to get confirmation from Google of what a lot of people have probably always suspected:
1) "Given a list of search terms, can Google produce a list of people who searched for that term, identified by IP address and/or Google cookie value?"
2) "Given an IP address or Google cookie value, can Google produce a list of the terms searched by the user of that IP address or cookie value?"
I put these to Google. To its credit, it rapidly replied that the answer in both cases is "yes." Just FYI.
What else does Google know? Given that Google operates
they know a heck of a lot. Every time you visit a site that uses adwords, your computer connects to google and tells them what you're viewing and probably what got you there. And all this can be matched by your google cookie or your IP address.
The question is, other than for personalized services, why should a company maintain information that is personally identifiable? Why keep logs that have your ip address down to the last digit when the same value can be obtained from the data by only keeping the first three units (192.168.168.* compared to 192.168.168.111)? The level of trust that consumers have for companies like Google is eroding and businesses should take heed of this. If you don't need the information in personally identifiable form, don't keep it.
It will not be long before the cost of keeping this stuff is prohibitive if you have to spend valuable personel time responding to subpoenas. I can imagine the FBI or some other three-letter-agency having a form subpoena that will seek all the records from Google, Yahoo!, DoubleClick and others about the supposed "owner" of a suspicious IP address. What did you search for? What did you read? When were you online? All this info is mantained by a small handful of companies.
The Canadian Privacy Law Blog is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 2.5 Canada License.