The privacy implications of pay per view and piracy prevention measures

PIPEDA Case Summary #2004-276

(Principles 4.4 and 4.5 of Schedule 1; subsection 5(3))

Complaint

An individual alleged that a satellite television provider was indiscriminately collecting and using customer personal information that it gathered through a telephone connection.

Summary of Investigation

The company confirmed that it requires its satellite customers to keep their telephone line continuously plugged into the receiver box which is supplied by the company and through which programs are delivered for two purposes: to bill for pay per view services and to prevent piracy. The company explained these reasons to the complainant and denied that it monitored customer viewing habits; however, instead of being reassured, he continued to believe the company was collecting more information than necessary to prevent piracy, likening it to a continuous electronic search. He could not, however, provide the Office with any evidence to support his belief that customer viewing habits were being monitored.

The company explained that it was not technically possible, using its existing technology, to monitor customer viewing habits with respect to any programming other than pay per view, as the satellite transmission technology is a one-way broadcast and the set top boxes are not capable of recording such viewing habits. The company only has information about the packages a customer has purchased, for billing purposes.

As for pay per view, the company's systems are configured with a pay per view ordering system that allows a customer to electronically order a program. The transaction is temporarily recorded in the system's decoder box, which then dials in to the company to report the pay per view transaction so that the customer can be billed for the charges he or she incurs.

With respect to preventing piracy, the Office examined the technical aspects of the company's efforts to prevent piracy by requiring a continuous connection with a live telephone line and was satisfied that the continuous connection is effective for this purpose.

Findings

Issued September 2, 2004

Application : Principle 4.4 stipulates that the collection of personal information shall be limited to that which is necessary for the purposes identified by the organization; Principle 4.5 states that personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law; and subsection 5(3) states that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.

In making her determinations, the Assistant Privacy Commissioner deliberated as follows:

• The company's purposes, namely, to bill for pay per view services and to prevent piracy were ones that a reasonable person would find appropriate in the circumstances.
• There was no evidence that the company was collecting information from the telephone connection on subscribers' viewing habits. Information on program packages and other billing information was collected at the time of purchase — not through a telephone line.
• The company collects pay per view information through the connection, which is then used to bill the customer, thus fulfilling one of the company's purposes. The continuous connection was also effective in preventing piracy, the company's other purpose.
• The Assistant Commissioner was satisfied that the company is collecting and using customer personal information to fulfil its purposes of billing for pay per view services and preventing piracy and that it is not collecting or using excessive information for those purposes or any others. She therefore found the company in compliance with Principles 4.4 and 4.5, and subsection 5(3).

She concluded that the complaints were not well-founded.