The Canadian Access to Social Media Information (CATSMI) Project operates out of the University of Victoria. It is a distinctly Canadian research project, but we believe that our findings have a very wide relevance. The central hypothesis of this project is that the evolution of a more “social web” poses significant challenges to theories of informational privacy as well as to the national legal systems and regulatory policies that have been based on these theories.
The main objective of the Project is to determine how the expectations of social networking websites and environments, whose raison d’etre is the facilitation of the sharing of personal information about and by users, can be reconciled with prevailing understandings about “reasonable expectations of privacy” and the existing regimes that are designed to protect personal data. Organizations have to make decisions about the granularity and range of privacy choices to offer users. Are there significant variances between organizations’ perspectives and policies on access to personal information by data subjects on the one hand, and those of government authorities on the other? Are data subjects meaningfully made aware of their own rights to access data, and the capabilities of authorities to access the same subjects’ data?
The Project has adopted a three-track process to understand the relationship between social networking services and government intelligence and policing services. First, we have analyzed the stated policies and publicly available lawful access documents that social networking services have prepared. These documents were accessed via public Internet repositories or, in one case, through private sources. This has revealed how personal information is made available by social networking services, and the conditions for providing it to government agencies.
Second, researchers investigated whether members of social networking services could access their own records and correct misleading or incorrect fields, and thus enforce their privacy rights under the Personal Information Protection and Electronic Documents Act (PIPEDA), and substantially similar provincial legislation. This approach allows us to ascertain the actual access that Canadians might have to the profiles that they, and networking services they are associated with, are developing. It also let us ascertain whether records provided to service members contain similar, more, or less information than the data fields that may be made available to law enforcement.
Third, Project members have evaluated how existing disclosure policies are, or would be, affected by forthcoming Canadian lawful access legislation. This final level of analysis will clarify whether Canadian authorities will have new powers in excess of social networking companies’ existing disclosure conditions.
The outcome of our analysis is a better understanding of how Canadians’ information is collected and made available to social network members and third-parties. By analyzing the practices of major social networking sites we have sought to make it clear to Canadians how their personal information might be accessed by authorities.
CATSMI’s research is funded through the Office of the Privacy Commissioner of Canada’s Contributions program. The use of these funds is independent of the Commissioner; as such, information in this document reflects work that emerges from independent academic research and does not necessarily reflect the Privacy Commissioner’s own position(s). Funding has also come from a Social Sciences and Human Research Council (SSHRC) grant: “Social Networking and Privacy Protection: The Conflicts, the Politics, the Technologies (2010-13).