Canada is moving forward with the implementation of its new copyright bill, which spells trouble for VPN providers based in the North American country. Under the new legislation Internet providers and VPN services will be required to log customers for at least six months, and forward takedown notices they receive from copyright holders. Aside from the obvious privacy implications, the new rules will drive up costs and increase liability for companies large and small.
Late last year the first provisions of Canada’s long awaited Copyright Modernization Act were implemented.
While the new law introduces great improvements in terms of fair use and non-commercial file-sharing, the “notice-and-notice” provisions are more problematic, especially for VPN providers and their customers.
Under the new law Internet providers and VPN services are required to forward copyright notices they receive from rightsholders to their customers. To be able to do so, the companies have to retain access logs for a minimum of six months so the pirating customers can be identified. Providers who do not comply face damages up to $10,000.
Specifically, the law requires providers to “[...] retain records that will allow the identity of the person to whom the electronic location belongs to be determined, and do so for six months [...].” Failing to forward a notice may result in “[...] statutory damages in an amount that the court considers just, but not less than $5,000 and not more than $10,000 [...].”
The new logging requirements in combination with a notice policy and fines are a disaster for VPN providers, and that’s not an overstatement.
The mandatory data retention is expected to lead to a customer exodus as it makes it impossible for providers to guarantee people’s anonymity, a key feature of any VPN service.
In addition, it will require VPN providers to implement an extensive logging and notice policy to deal with takedown notices. This will prove to be quite costly or simply impossible, especially for smaller companies that are sometimes run by individuals.
For example, many VPN providers assign shared IP-addresses to their customers, so even if they wanted to there is no option to accurately identify a copyright infringer. For these companies the only option will be to shut down, or move the company outside of Canada.
TorrentFreak contacted University of Ottawa professor Michael Geist, who signals two main issues for VPN providers. On the one hand there are the resources that come with the implementation of the new provisions, and on the other there is the privacy issue for VPN users.
“First, are the resources needed to comply with a notice-and-notice system. These can be significant and it is disappointing that the government has decided not to consult on potential fees for notices. The law gives them the right to establish a fee, but it seems as if they will not do so, at the last for the time being,” Geist tells TorrentFreak.
“Second, on the privacy issue, notice-and-notice does not require disclosure of the identity of the subscriber. The additional logging of user information does create a new privacy issue, however. This is particularly sensitive given the recent Snowden disclosures and the growing interest among Internet users to safeguard their privacy.”
In a blog post Geist further highlights that the Government’s tone on the notice-and-takedown provisions recently shifted. Initially it was meant to be balanced and functional for both copyright owners and internet intermediaries, but the scale has slowly tipped towards the interest of copyright holders.
“It is our goal that a system be in place that is both balanced and functional; but, most importantly, it must endeavour to deter infringement,” the latest version reads.
The Canadian Government currently invites stakeholders to voice their opinions through the public consultation, and it might be wise for VPN providers and users to voice their concerns. There is currently no date set for the implementation of the notice-and-notice provisions.