Privacy Basics
1. What is TekSavvy doing to protect its customers’ personal information?
2. What are IP address logs?
3. How long does TekSavvy store IP address log information?
4. So does this mean you can look up who has a certain IP address?
5. If TekSavvy forwards a notice of claimed copyright infringement, does that mean it has given someone else my personal information?
6. How will I know if TekSavvy has received a request for my personal information?
7. How will I know if TekSavvy has disclosed my personal information?
8. How many customers are affected by this?
9. How did TekSavvy handle copyright infringement notices in the past?
Notices of Claimed Infringement
10. What does the “notice-and-notice” regime require TekSavvy to do?
11. How much do copyright owners have to pay to send each notice?
12. I’ve received an emailed notice of claimed infringement, what is going to happen to me?
13. The notice of claimed infringement that was emailed to me sounds pretty American. It refers to American laws. Does it apply in Canada?
14. Did TekSavvy gather the information for the claimant who is alleging infringement?
15. I received a notice that seems to contain a "settlement offer". What should I do?
16. Do you process these notices automatically?
17. Are there any requirements as to form or contents to which notices of claimed infringement must adhere?
18. Okay, but what if the notice contains false or misleading information?
19. But you reject notices that don’t include all of the required criteria?
Next Steps
20. There’s something funny going on here. Could my MySavvy have been hacked?
21. What is TekSavvy’s role after it has forwarded a notice, sent back a receipt, and preserved the data it is required to preserve?
22. How will I know if a rights holder intends to pursue a copyright infringement claim?
23. Where can I go to seek legal advice if I need to?
24. What are the penalties under Canadian law for copyright infringement?
25. Why can’t TekSavvy provide me with legal advice?
Privacy Basics
1. What is TekSavvy doing to protect its customers’ personal information?
Subscriber information, individually-issued Internet Protocol addresses, and the link between them, are all personal information. Our users have a strong privacy interest in it. That privacy interest is protected by federal privacy legislation, and by the values of the Charter of Rights and Freedoms TekSavvy has always fought for our users’ rights. We take that privacy interest very seriously.
We will not provide your personal information to any copyright claimant unless we are ordered to do so by a court. And we will take every opportunity to make sure that our accountholders receive notice when a court is asked to disclose their personal information.
2. What are IP address logs?
TekSavvy leases the use of IP addresses, assigned to it by ARIN, to TekSavvy accounts that log on to our network. Except where the user has purchased use of a static IP address, these addresses are assigned dynamically. The typical TekSavvy IP address is therefore assigned to different accounts at different times.
IP address logs keep track of these assignments. They are automatically generated by our routing and authentication equipment. They are very large text files generated at high volume. In order to meet its legal obligations, TekSavvy now exports most of its IP address logs daily to a database system. The raw logs are then purged to make room for more. All raw log and database processing and storage takes place within our facilities in Canada.
3. How long does TekSavvy store IP address log information?
Log information remains within the database system for 30 days. We have no purpose for that information beyond that point, so it is automatically deleted, on a rolling basis.
In isolated cases, we are required to extract certain information from that system in order to preserve it for longer than 30 days. Occasionally we are required to do this by a court order in a criminal matter: see our transparency reporting. But the most common reason for a mandated longer preservation period is to comply with the Copyright Act.
Since January 2, 2015, we have been required to forward notices of claimed copyright infringement to the account information that matches the IP address and timestamp indicated on the notice. When we do so, we are also required to retain that IP-address-to-account correlation information, and the associated accountholder’s identity, for six months. If the copyright owner who sent the notice commences court proceedings, we may be required to retain it for more than six months.
4. So does this mean you can look up who has a certain IP address?
Yes. In order to be able to comply with the new Copyright Act provisions, we have now automated this ability, at considerable effort. We use this information for 30 days. It is deleted on a rolling 30-day basis. However, if you maintain a single session for longer than 30 days, and do not power-cycle your modem during that period, then we may have more than 30 days’ worth of information.
5. If TekSavvy forwards a notice of claimed copyright infringement, does that mean it has given someone else my personal information?
No. We forward the notice, based on a database lookup as to which account was associated with the relevant IP address at the relevant time. We do not provide any information about you back to the sender. Unless you contact them or, perhaps, follow a link included in the notice text, they do not know who you are.
6. How will I know if TekSavvy has received a request for my personal information?
When we become aware of any legal proceeding which contemplates providing your personal information to a third party, and provided we are not explicitly prohibited from doing so by law, TekSavvy will notify you by email, and provide as much information it has available about the legal proceeding under which the request is made.
7. How will I know if TekSavvy has disclosed my personal information?
TekSavvy will notify affected account-holders if we receive a court order compelling us to disclose their personal information. Again, this is unless explicitly prohibited from doing so by law. In the past, we have been explicitly prohibited from doing so only in the event of criminal matters, which have not been related to copyright.
8. How many customers are affected by this?
In the Voltage matter, we sent out notices to just over 1100 customers that their account information has been requested by Voltage. There were over 2000 IP addresses for which the information was requested.
With notice-and-notice, in late December 2014 we were receiving about 3000 copyright infringement notices each day. Most were formatted based on the U.S. Digital Millennium Copyright Act (“DMCA”) requirements. In early January 2015 this slowed down. This may be in order to reformat templates to meet the requirements of Canadian law, such as to automate based on a Canadian implementation of the ACNS XML schema.
9. How did TekSavvy handle copyright infringement notices in the past?
To answer this question, we need to distinguish between the voluntary notice-and-notice system that existed before 2015, in which TekSavvy did not participate; and the unique Voltage Pictures LLC mass claim made in 2012.
No voluntary notice-and-notice: TekSavvy was not a part of the voluntary notice-and-notice scheme developed by copyright owners and incumbent ISPs. As a result, compliance with the new Copyright Act provisions on notice-and-notice that came into force on January 2, 2015, has been a significant and expensive undertaking.
Voltage mass claim: However, TekSavvy was required to take action on copyright infringement allegation in a matter that began in 2012. Then, U.S.-based Voltage Pictures LLC filed a lawsuit demanding we disclose personal information of approximately 2,000 subscribers who Voltage said had infringed its copyright.
As an intermediary, TekSavvy did not take any position on copyright matters. However, we insisted that the court balance Voltage’s rights as a copyright holder against our users’ privacy interest. The court’s ruling limited Voltage’s request. It introduced conditions designed to protect subscribers’ privacy and discourage copyright trolling, and maintained strong court oversight on how this information is used and when it is disclosed.
No customer information will be provided to Voltage unless and until all conditions of the court order are met. Among the court’s requirements are that any subscriber notice “clearly state in bold type that no Court has yet made a determination that Subscriber has infringed or is liable in any way for payment of damages.”
Notices of Claimed Infringement
10. What does the “notice-and-notice” regime require TekSavvy to do?
“Notice-and-notice” is the nickname for the regime put into place by sections 41.25 and 41.26 of the Copyright Act, which came into force on January 2, 2015. The rules require digital network providers, like ISPs and VPNs, to handle notices sent by copyright owners to users whose electronic location, like an IP address, the copyright owner claims is the source of possible infringement.
To comply with the regime, the notices must identify:
• what infringement is alleged;
• the material to which the alleged infringement relates,
• the claimant’s name, address, and right with respect to it, and
• the electronic address, date and time of the alleged activity.
When a network provider like TekSavvy receives such a notice, we must do two things: forward the notice electronically to what we believe to be the corresponding accountholder, providing the notice’s sender with a success or failure receipt that does not identify the accountholder; and retain the information allowing the accountholder’s identity to be determined for six months. If the copyright owner who sent the notice commences court proceedings, we may be required to retain it for more than six months.
11. How much do copyright owners have to pay to send each notice?
Nothing. The Copyright Act grants the Minister of Industry the ability to fix the fee that can be charged for forwarding notices, sending back receipts, and preserving data. But the same Copyright Act subsection (41.26(2)) also prohibits the charging of any fee if none has been fixed. The Minister did not fix a fee, so TekSavvy cannot charge one.
There are two key implications to this.
First, without a fee, network providers cannot look to senders of these notices to recover their initial systems development and ongoing development and customer support costs.
Second, a copyright owner’s cost for sending each additional notice, once they have created an automated system for doing so, is close to zero. As for other forms of unsolicited commercial electronic messages, there is therefore little disincentive to sending unlimited numbers of notices, each of which network providers are then obliged to process.
12. I’ve received an emailed notice of claimed infringement, what is going to happen to me?
We do not know what further steps its sender will take, if any. What we can tell you is that we have given the sender no information that would identify you to them, and that a private party’s notice does not mean there has been any legal ruling. Only a court can do that.
We do check, either automatically or, if we have to, manually, that the notice makes claims regarding all of the required elements: infringement alleged; which material it relates to; claimant’s right, name, and address; and electronic address, date, and time of the alleged activity.
However, we do not and cannot check the accuracy of those claims. We cannot take a position on the accuracy of the notice. As an intermediary, TekSavvy has no knowledge what you do on the Internet. Depending on whether we were able to process it automatically, we have either little or no knowledge of the contents of the notice you received, either. That is why we add a wrapper to the notice that we forward, providing some context that may help users.
13. The notice of claimed infringement that was emailed to me sounds pretty American. It refers to American laws. Does it apply in Canada?
We don’t know, and can’t say.
The Copyright Act requires us to forward the notice and put a six-month hold on your correlation information if the notice meets all of the criteria described above. So if it states the infringement alleged; which material it relates to; claimant’s right, name, and address; and electronic address, date, and time of the alleged activity, then we must proceed.
That said, please note the following. Many automatically-generated notices contain text written with foreign law in mind, not Canadian law. You should therefore be especially careful when reading claims geared towards a foreign jurisdiction, like the United States. For instance, maximum statutory damages are far lower in Canada than in the U.S. Notice-and-notice does not trigger suspension of your Internet services, as its U.S. equivalent (notice-and-takedown) may.
14. Did TekSavvy gather the information for the claimant who is alleging infringement?
No. TekSavvy does not monitor our customers’ use of the Internet. We have no involvement in collecting the IP addresses presented in a claim by Voltage’s, or in a notice of claimed infringement. That is why we are in no position to speculate on the validity of a claim.
15. I received a notice that seems to contain a "settlement offer". What should I do?
As an intermediary, we can’t give legal advice. But there is no legal obligation to pay any settlement that someone comes along and offers you. There is no obligation to even contact a claimant. But clicking on a link provided by a claimant may have the effect of contacting them -- many such links are personalized.
16. Do you process these notices automatically?
In order to avoid human handling of these notices altogether, we aggressively seek opportunities to automate their processing. If the notice has been submitted using the online Web form or, via abuse@teksavvy.ca, using the Canadian implementation of the Automated Copyright Notice System structured-data schema, then we process it automatically.
Otherwise, one of our staff must review it manually to test that all of the required elements are present. Senders of copyright infringement claims that we were not able to process automatically are immediately notified by email how to present the information in a way that lets us do so.
17. Are there any requirements as to form or contents to which notices of claimed infringement must adhere?
In the one-off Voltage matter, the court looked into the issue of “copyright trolling or speculative invoicing”. It noted evidence that “suggests but does not prove that Voltage may have ulterior motives in commencing this action and may be a copyright troll.”
The court therefore required the following: “Any correspondence sent by Voltage to any Subscriber shall clearly state in bold type that no Court has yet made a determination that such Subscriber has infringed or is liable in any way for payment of damages.”
Under the notice-and-notice regime, the Minister of Industry has the power to make regulations. The regulations can prescribe the form that notices are to take, and can prescribe additional information that claimants must include in each notice. The regulations can also establish a fee that copyright owners must pay in order to compel the forwarding of each notice.
So far, the Minister has not made such regulations. As a result, the only requirements that notices of claimed copyright infringement must meet are that they state the infringement alleged; which material it relates to; the claimant’s right, name, and address; and the electronic address, date, and time of the alleged activity.
18. Okay, but what if the notice contains false or misleading information?
Wherever possible, we automate the processing of notices, by encouraging claimants to use a Web form or a Canada-specific XML schema that allows automatic verification of whether the notice makes claims regarding all of the required elements (infringement alleged; which material it relates to; claimant’s right, name, and address; and electronic address, date, and time of the alleged activity).
To do otherwise would be to incur even higher compliance costs, and to take on additional privacy risk. Where we become aware of a notice template that appears to infringe Canadian law, we will take steps to halt the sending of matching notices. But, put simply, we are not able to read every notice we receive.
We therefore suggest the following. First, read everything you receive with a critical eye: the information provided here is intended to help you do that. Second, if you think the notice contains false or misleading information, remove all personal information; paste it to a public place (like DSLreports) to allow for scrutiny; and bring it to the attention of relevant authorities.
19. But you reject notices that don’t include all of the required criteria?
Yes, we do. To be clear, we can’t check the accuracy of how the criteria are met. But we require that all of the criteria be present. For instance, we have noted the following.
The notice is required to “specify the infringement that is claimed”. Many notices do so neither in the structured XML data they present, nor in the text notice included with them. Instead, the textual part of the notice presents a list of possible infringement claims, without specifying which one applies to the notice that is being sent. For instance, they simply assert “infringements of copyright interests”, without stating what those infringements are. Or they assert that an account has been used to “illegally copy and/or distribute”, or to “host and/or facilitate the downloading and/or streaming of content”, but not which of these infringements is claimed.
Next Steps
20. There’s something funny going on here. Could my MySavvy have been hacked?
It is good practice to make sure you secure your account and the access you provide to it, especially wireless access. Your wireless network password (“encryption key”) should be password-protected. The password should be changed regularly. Those who have the password should maintain good virus protection. The accountholder should keep track of who has access to it. Your MySavvy allows you to check your bandwidth usage. Do so regularly, and make sure that what is happening and what you think is happening line up.
21. What is TekSavvy’s role after it has forwarded a notice, sent back a receipt, and preserved the data it is required to preserve?
TekSavvy’s role is to ensure that we fulfill our legal and ethical obligations. We must comply with the Copyright Act. We must also make sure our users’ privacy interests are fully respected:
Our customers must know what personal information we are preserving, for how long, and why. And we must ensure that no information is disclosed to any copyright claimant without a court order. If things progress further, and the claimant goes to court seeking such an order, we must take every opportunity to make sure our customer is aware of this as soon as possible, so that there is an opportunity to address the court before any disclosure is ordered.
22. How will I know if a rights holder intends to pursue a copyright infringement claim?
If things progress still further, disclosure is ordered and takes place, and the rights holder wishes to pursue copyright infringement claim, then you will receive a notification from the rights holder. At that point, the issue will be between you and the rights holder.
23. Where can I go to seek legal advice if I need to?
Many of the provincial law societies provides free lawyer referral services (scroll down to “Lawyer Referral Services”). They will provide you with the name of a lawyer and, depending on the province: a licensed paralegal and, through the referred lawyer or paralegal, a free consultation of up to 30 minutes to help you determine your rights and options.
24. What are the penalties under Canadian law for copyright infringement?
Copyright owners have the ability to sue infringers for the damages that the copyright owner demonstrates to the court that it has suffered, due to the infringement and the profits the infringer has made.
However, copyright owners also have the option of electing statutory damages at any time prior to final judgment, even if they cannot demonstrate damages or prove an infringer’s profits.
If the infringement was for non-commercial purposes, statutory damages are between $100 and $5000. If it was for commercial purposes, statutory damages are between $500 and $20,000.
25. Why can’t TekSavvy provide me with legal advice?
As an intermediary, it’s difficult for us to answer many of the questions that notices of claimed infringement provoke. We are not in a position to advise any third party on the application of the law to their particular situation, or the actions that they should take in response to a notice of claimed infringement, a motion for disclosure, or the defense of potential claims that may be made against you.
