CIPPIC Releases Study of DRM & Privacy

CIPPIC Releases Study of DRM & Privacy

Investigation Discloses Widespread Violations of Canadian Privacy Law

Ottawa, ON – September 18, 2007 – The Canadian Internet Policy & Public Interest Clinic (CIPPIC) of the Faculty of Law at the University of Ottawa today released the results of a comprehensive investigation into the privacy implications of digital rights management technologies, or “DRM”. The study, titled “Digital Rights Management and Consumer Privacy: An Assessment of DRM Applications Under Canadian Privacy Law”, investigated the DRM technologies used in 16 different digital products and services. The study concluded that many DRM technologies in fact pose threats to privacy and that organizations using those technologies often fail to comply with basic requirements of Canadian privacy law.

The study involved the investigation, under controlled laboratory conditions, of products and services such as music download services, ebooks, and software – all available in the Canadian marketplace. CIPPIC investigators observed the behaviour of the DRM and compared that behaviour with organizations’ disclosures in applicable privacy policies and license agreements, as well as with the organizations’ responses to direct inquiries.

Philippa Lawson, CIPPIC’s Executive Director, notes that the study substantiates one of the most common criticisms of DRM: “Consumer groups for a long time now have warned of DRM’s potential to undermine consumer privacy. This investigation substantiates those concerns: we observed undisclosed tracking of usage and surfing habits, and unexplained communications with third parties including marketing companies.”

David Fewer, Staff Counsel with CIPPIC and lead investigator of the study, notes that CIPPIC found widespread violations of applicable privacy law. “We found non-compliance with even basic requirements of PIPEDA, Canada’s federal private sector privacy law.”

The study was funded through the contributions program of the Office of the Privacy Commissioner of Canada.

The study is available on CIPPIC’s website:

About CIPPIC: CIPPIC is the Canadian Internet Policy and Public Interest Clinic, Canada’s only technology law clinic. CIPPIC was established in 2003 at the University of Ottawa, Faculty of Law, Common Law Section. CIPPIC’s mandate is to advocate for balance in policy and law-making on issues arising out of new technologies.

- 30 -

For Further information, see:


More detailed information about the study is available at CIPPIC’s DRM & Privacy Project wiki