Canada is a popular base for VPN providers, as until recently it had no mandatory data retention laws. However, as we reported in our survey of Data retention, VPN logging and Internet Surveillance in Canada in May this year, Bill C11 – the Copyright Modernization Act began to come into force in November last year (2012). Although the Bill does include some welcome protections for consumers against overly aggressive copyright enforcement, it also requires ISPs to,
‘retain records that will allow the identity of the person to whom the electronic location belongs to be determined, and do so for six months […].” Failing to forward a notice may result in “[…] statutory damages in an amount that the court considers just, but not less than $5,000 and not more than $10,000’
As many VPNs continued to offer no logs services, we were unsure about whether VPN providers would also be included in these provisions, but it is now clear that they are, and will soon be required to keep logs of customers’ online activities and to forward DMCA notices to customers.
This is something of a double-whammy, as VPN providers will now not be able to guarantee users privacy, surely a (if not the) main reason most people use a VPN for in the first place! In fairness, the new ‘notice-and-notice provisions’ do not require service providers to disclose the identity individuals, but the fact such that logs exist at all is a major threat to users’ privacy.
It also means that Canadian VPN providers will have to implement extensive (and expensive) systems to monitor their customers, something that smaller companies, especially those using shared IP addresses, will find very difficult to carry out, likely resulting in many having to close down.
Basically, there is very little reason why anyone would choose to use a Canada based VPN service under the new rules. Fortunately, the ‘notice-and-notice provisions’ have not yet been implemented (nor has a date currently been set for them to be), and there is still time for netizens to make their feeling on the matter known through the Government’s public consultation.
If enough people make enough noise about the issue, especially in the wake of increased public awareness over privacy issues thanks to the actions of NSA whistleblower Edward Snowden, then perhaps the Government can be convinced to change its mind, and reverse the policy.