According to an article from Yahoo, University of Ottawa’s Canadian Internet Policy and Public Interest Clinic (CIPPIC) conducted a study and concluded that digital rights management (DRM) technology may be violating Canadian privacy laws as outlined by the Personal Information Protection and Electronic Documents Act (PIPEDA). I promise you there will be no more acronyms.

The violation allegedly occurs when companies using DRM within their products (i.e. DRM protected music) fail to disclose in their privacy policies the personal information the vendor collects and embeds for DRM purposes.

“If there’s personal information collection use or disclosure going on, there has to be consent and the form of consent has to be appropriate to the circumstances,” Fewer said.

“We agree that in many cases consent doesn’t have to come in the form of expressed consent. But, in other circumstances, particularly where it was unexpected or whether what was being collected was related to core biographical data, we would have thought you would need to see expressed consent.”

The article goes on to mention that the main concern comes from a privacy policy’s lack of disclosure regarding the third-party companies and marketers found linked with the DRM systems and where your information is used. They use Intuit’s QuickTax as an example.

“It wasn’t the use of QuickTax itself that triggered the concern, but rather the use of Intuit’s online filing service where we found buried in one of the disclosures the notice that, as an international corporation, Intuit would send information across the border,” Fewer said.

“Now if you’re Canadian and are concerned about your financial data going to the U.S. where it might be vulnerable to the Patriot Act, you may want to know that kind of information up front,” he added.

Another major piece of the study looks at IP addresses and how it is collected, used and disclosed. Currently under Canadian laws, IP addresses aren’t regarded as ‘personal information’ so it may be communicated freely.

However contradictorily, certain Canadian courts along with the Privacy Commissioner have released decisions where the IP address has been interpreted as personal information. It isn’t just government who is taking camp on both sides of the argument, but big companies as well. For example, Sony BMG, who have said that IP addresses are not personal information, happily sue people in file sharing lawsuits on the basis of IP addresses and linking them to activities. The IP address argument is one that involves many nations and is continually debated.

Copyright and privacy laws in Canada have always been slightly differing from those of the United States, proving to be tricky for many corporations to operate in both environments with the same policies. A good example of this was Canada’s levy on blank media that was suspected to be used to record copyright material (yes, that’s right, they assumed we were all guilty and charged us for it). At first it included MP3 players, adoringly labeled the ‘iPod tax’ – roughly equating to $1CDN per GB of storage. The Canadian Federal Court of Appeal eventually ruled that it was unlawful to include MP3 players as blank media and Apple reimbursed their customers.