Web 2.0 and Privacy

1. Eloïse Gratton, Technology Counsel Web 2.0 and Privacy • University of Montreal • October 3rd, 2008

2. Introduction - Internet Privacy • Scott McNealy, chairman of Sun Microsystems: • “You have zero privacy anyway. Get over it.” • Larry Ellison, CEO of Oracle: • “The privacy you're concerned about is largely an illusion. All you have to give up is your illusions, not any of your privacy.” • Google's lawyer team (Boring / Street View lawsuit): • “Today's satellite-image technology means that even in today's desert, complete privacy does not exist.”

3. New Types of Data on the Internet • Personal information: • Definition: « Information about, or linked to, a personally identifiable individual  » • New Data on the Internet: • Email addresses (personal vs. business) • IP addresses • Clickstream Data / Data collected by online tracking tools • User IDs

4. Privacy is Challenged Online • Collection of personal data on the Internet • Public Spaces on the Internet • Dictionary or Mail server Attacks • Collected by online tracking tools • Web Bugs, Spyware, Cookies • Provided voluntarily by online users • Privacy principles are challenged • Access, Authentication, Data Quality, Security, etc…

5. Expectation of Privacy on the Internet • Framework in Canada • PIPEDA and provincial substantially similar legislation (BC, Alberta and QC) • Canadian Charter of Rights and Freedoms (article 8) • Framework in the United States • Fourth Amendment to U.S. Constitution • Wiretap Act (1968) • Electronic Communications Privacy Act (ECPA) • Stored Communications Act (SCA)

6. Expectation of Privacy on the Internet • In Content of Emails: • Canada: Expectation of privacy • R. c. Weir (1998); R. c. Gauthier (1999), etc.. • U.S.: • Expectation in emails in transit (ECPA) • U.S. v. Maxwell (1996)*; U.S. c. Charbonneau (1997); Guest v. Leis, (2001); State v. Evers (2003); U.S. v. Lifshitz (2004), U.S. v. Long (2006)*, etc.. *stored emails as well • Warshak (2007): Expectation in stored emails as well (ECPA violates 4th Amend.)

7. Expectation of Privacy on the Internet • In IP Adresses and Subscriber Information: • Canada: There is an expectation of privacy • BMG Canada Inc. v. John Doe (2005) • R. c. Kwok (2008) *in appeal • U.S.: In general, no expectation of privacy • Exception: Reid case (April 2008) • IP infringement lawsuits: • TorrentSpy (2007) • Google / Viacom (2008)

8. Expectation of Privacy on the Internet • When Using Online Social Networks: • Law enforcement officials are using OSNs to search for evidence: • Ohio State University (2005), Glazerbrook (2007), Vermont Library (2008), etc… • Expectation of privacy in profile information • Default profile vs. Privacy settings • « Plain view » doctrine • Authentication issues • Disclosure to third parties • Privacy policies • Analogy with storage facility

9. Conclusion – Internet Privacy • Olmstead v. United States, 277 U.S. 438, 474 (1928) (Brandeis, J., dissenting). • Moreover, 'in the application of a Constitution, our contemplation cannot be only of what has been, but of what may be.' The progress of science in furnishing the government with means of espionage is not likely to stop with wire tapping. Ways may some day be developed by which the government, without removing papers from secret drawers, can reproduce them in court, and by which it will be enabled to expose to a jury the most intimate occurrences of the home. (…) Can it be that the Constitution affords no protection against such invasions of individual security?

10. Eloïse GrattonMcMillan LLP+514 994-7417eloise.gratton@mcmillan.ca Questions?