If Left to Their Own Devices ... How Drm and Anti-Circumvention Laws Can Be Used to Hack Privacy

Abstract

This chapter examines Canada's recently proposed anti-circumvention laws set out in Bill C-60. The proposed laws would protect the copyright industries from individuals using devices to circumvent the technological protection measures (TPMs) and digital rights management (DRM) systems meant to protect copyright. The author argues that the proposed anti-circumvention laws fail to address any aspects of the privacy implications of DRM, despite the obvious privacy threats that automation, cryptographic techniques, and other DRM technologies impose. The author's analysis begins by distinguishing between technological protection measures (TPMs) and digital rights managements (DRM) systems, a set of technologies that can identify content and set out licensing conditions. The author subsequently examines how these technologies are used to enforce corporate copyright policies and express copyright permissions imposed by a DRM through a registration process that requires purchasers to hand over personal information.

Given DRM's extraordinary surveillance capabilities, the author argues that the Government of Canada has perilously failed to address any aspects of the privacy implications of DRM in drafting its anti-circumvention provisions. Such policy consideration are especially important in light of legislative reforms that use the law to further enable DRM and facilitate its implementation as a primary means of enforcing digital copyright. The author provides three public policy considerations in determining an "appropriate balance" for DRM and privacy: (i) the anonymity principle; (ii) individual access; and (iii) DRM licenses. The author concludes by giving three recommendations that would provide counter-measures necessary to offset the new powers and protections afforded to TPM and DRM if Canada's anti-circumvention laws are implemented as policy: (i) an express provision prohibiting the circumvention of privacy by TPM/DRM; (ii) an express provision stipulating that a DRM license is voidable when it violates privacy law; and (iii) an express provision permitting the circumvention of TPM/DRM for personal information protection purposes.

Keywords: DRM, technical protection measures, privacy, digital copyright reform, WIPO Copyright Treaty, anti-circumvention, paracopyright