Digital inclusion

Transparency

In 2016, there was continued global discussion about disclosures of personal information to government organizations for law enforcement purposes. Accurate information about the nature and volume of personal information requests by law enforcement to private companies helps inform this ongoing discussion, and will shape our country’s privacy landscape. It is in that spirit that we provide our fourth annual transparency report, which provides insight into our approach responding to requests as well as the volume and types of requests we receive. We are proud of our record of openly sharing with our customers the details about how we respectfully handle and secure their data.

At TELUS, we respect our customers’ privacy and take great care to safeguard personal information. As part of our ongoing commitment to putting customers first, we have a long-standing policy of protecting privacy in all of our business operations. As a national telecommunications company, we routinely receive requests for information about our customers from law enforcement agencies and other government organizations. We are legally required to respond. This transparency reporting is intended to provide insight into our approach responding to these requests and data regarding the numbers and types of information requests we received in 2016. We report this data alongside 2015 and 2014 data for comparison purposes.

Industry Canada published voluntary Transparency Reporting Guidelines in 2015. TELUS’ transparency reporting practices were already consistent in approach, although there were some differences. We have historically provided more detailed breakdowns of the law enforcement requests we receive and in other areas, we provided less detail.

This year’s transparency reporting mirrors our previous formats, allowing us to provide trends year over year and also the greatest degree of granularity that we believe is helpful and informative.

The most notable variation in the data was between 2014 and 2015, when name and address requests went from more than 30,000 to zero. This was due to the 2014 R.v. Spencer decision of the Supreme Court of Canada, which clarified law enforcement agencies require a warrant to obtain the name and address information of our customers unless an individual’s life, health or security is at risk, or the information is readily available in a published telephone directory. The decision resulted in the complete elimination in 2015 of voluntary disclosures made in response to non-emergency requests without a warrant.

Similar to 2014 and 2015, the vast majority of the requests we received in 2016, were for information to help find or communicate with someone in an emergency. Calls from a local police detachment or 9-1-1 operator centre asking for help locating someone who is lost or suicidal are typical examples of this type of request. We provided information in response to 58,721 requests for information in an emergency last year, an average of 161 requests every day.

Consistent with our Customers First philosophy, TELUS will challenge information requests that go beyond what is lawful. For example, we will challenge any request or court order that we believe goes beyond what a judge is authorized to order under applicable legislation, such as the Criminal Code, and we will only release confidential customer information when we are satisfied it is appropriate to do so. When necessary we will take an issue to court and have done so in the past.


65,183 requests

Approximate number of requests for customer information from government organizations in 2016 (33.4% decrease from 2014)

In 2016, we challenged or declined to provide information in response to an estimated eight per cent of the court orders we received because we thought the order was invalid or over-reaching. This compares with an estimated 15 per cent in 2015 — a seven per cent decline that we cannot attribute to any one factor; however, we do believe this variance can largely be attributed to the continuing increase in due care that law enforcement exercises in preparing their requests for records via court order. This demonstrates a positive outcome in the protection of customer privacy.

TELUS intends to continue advocating for our customers’ privacy, while responding to legal court orders as required. It is a fine balance, and we are pleased to present this transparency disclosure as part of the evolving dialogue on this matter of personal security.

Approximate numbers of requests from government organizations¹

2016 2015 2014
Court Orders/ Subpoenas2 5,196 4,517 4,005
Court Orders 4,678 3,993 3,550
Subpoenas 517 523 453
MLAT Orders 1 1 2
Customer Name and Address Check3 30,946
Emergency Calls 58,721 51,413 61,596
Internet Child Exploitation Emergency Assistance Requests 144
Legislative Demands 1,266 1,237 1,247
TOTAL 65,183 57,167 97,938
2016 2015 2014
Court Orders/ Subpoenas2 5,196 4,517 4,005
Court Orders 4,678 3,993 3,550
Subpoenas 517 523 453
MLAT Orders 1 1 2
Customer Name and Address Check3 30,946
Emergency Calls 58,721 51,413 61,596
Internet Child Exploitation Emergency Assistance Requests 144
Legislative Demands 1,266 1,237 1,247
TOTAL 65,183 57,167 97,938
  1. 1 TELUS has calculated these numbers based on how requests are recorded in our systems. We note that this may or may not be consistent with how other telecommunication services providers calculate the number of requests they receive in these categories.
  2. 2 TELUS measures the number of requests in this category based on numbers of court orders or subpoenas received, rather than the number of impacted subscribers. Many court orders and subpoenas request information with respect to more than one TELUS subscriber.
  3. 3 Since 2015, this process has been handled by Court Order.

Types of requests TELUS receives

Court Order/ Subpoena Description: an order or subpoena is a legal demand from a court or other legal authority directing TELUS to provide customer information. The information may be associated with any TELUS service, including wireless, wireline or Internet. Most orders and subpoenas require us to provide historic information, such as telephone records. A small minority of the court orders require TELUS to provide real-time information (e.g., the content of a telephone call, by means of a wiretap, or the location of a cell phone).

Applicable law: Criminal Code of Canada.

MLAT Orders Description: these requests take the form of an order issued by a Canadian court pursuant to the Mutual Legal Assistance in Criminal Matters Act. Typically, these are requests for aid from a law enforcement agency in another country related to a criminal investigation, and require an order from a Canadian court. We don’t respond to requests that come directly from foreign agencies, but will provide information if ordered to do so by a Canadian court.

Applicable law: The Mutual Legal Assistance in Criminal Matters Act.

Customer Name and Address Checks Description: these are requests for TELUS to provide basic customer information, such as customer name and address on a voluntary basis. These requests were usually made to identify an individual associated with a telephone number, most often so police can ensure they are serving a warrant on or arresting the correct individual. The June 2014 decision of the Supreme Court of Canada in the case of R. v. Spencer made it clear that a court order is required for TELUS to provide customer name and address information except in an emergency or where the information is published in a directory. Consequently, TELUS has not complied with any non-emergency requests for voluntary disclosure since this decision.

Applicable law: Personal Information Protection and Electronic Documents Act (PIPEDA), CRTC rules with respect to customer confidentiality; see also applicable TELUS Service Terms and customer Privacy Commitment.

Emergency Calls Description: these are urgent requests for help locating or assisting where an individual’s life or property is at imminent risk. For example, TELUS will provide police or other emergency responders with location information for a wireless device belonging to someone who is lost or in danger.

More than half of such requests (42,761 in 2016) came from 9-1-1 call centres seeking help locating a caller in distress. The remaining 5,443 requests came from local police or emergency service providers.

In these cases we only provide the information needed to respond to the emergency.

Applicable law: PIPEDA and CRTC rules with respect to customer confidentiality.

Internet Child Exploitation Emergency Assistance Requests Description: In response to police requests, in the past TELUS would disclose the name and address of a customer using an IP address to help the police investigate a real-time case of online child sexual exploitation. Previously, it was understood that such disclosure without a court order was permitted under Canadian law and TELUS’ service terms. However, the Supreme Court of Canada in the Spencer case (referred to above) has ruled that such disclosure requires a court order, except in an emergency. Accordingly, TELUS has amended its practices in this regard.

Since that court decision, TELUS collaborated with law enforcement agencies to establish a new process to expedite the sharing of this critical information through court orders where children are in danger, while abiding by the spirit and language of the Spencer decision.

TELUS has always required a court order to provide customer information associated with an IP address in other cases.

Applicable law: PIPEDA, Criminal Code of Canada

Legislative Demands Description: this is a request for information by a government body, where TELUS is required by applicable legislation, to provide the information. For example, pursuant to the Income Tax Act, the Canada Revenue Agency may require TELUS to disclose certain customer information.

Applicable law: any federal or provincial legislation that authorizes a government body to request information from TELUS.

Court Order/ Subpoena Description: an order or subpoena is a legal demand from a court or other legal authority directing TELUS to provide customer information. The information may be associated with any TELUS service, including wireless, wireline or Internet. Most orders and subpoenas require us to provide historic information, such as telephone records. A small minority of the court orders require TELUS to provide real-time information (e.g., the content of a telephone call, by means of a wiretap, or the location of a cell phone).

Applicable law: Criminal Code of Canada.

MLAT Orders Description: these requests take the form of an order issued by a Canadian court pursuant to the Mutual Legal Assistance in Criminal Matters Act. Typically, these are requests for aid from a law enforcement agency in another country related to a criminal investigation, and require an order from a Canadian court. We don’t respond to requests that come directly from foreign agencies, but will provide information if ordered to do so by a Canadian court.

Applicable law: The Mutual Legal Assistance in Criminal Matters Act.

Customer Name and Address Checks Description: these are requests for TELUS to provide basic customer information, such as customer name and address on a voluntary basis. These requests were usually made to identify an individual associated with a telephone number, most often so police can ensure they are serving a warrant on or arresting the correct individual. The June 2014 decision of the Supreme Court of Canada in the case of R. v. Spencer made it clear that a court order is required for TELUS to provide customer name and address information except in an emergency or where the information is published in a directory. Consequently, TELUS has not complied with any non-emergency requests for voluntary disclosure since this decision.

Applicable law: Personal Information Protection and Electronic Documents Act (PIPEDA), CRTC rules with respect to customer confidentiality; see also applicable TELUS Service Terms and customer Privacy Commitment.

Emergency Calls Description: these are urgent requests for help locating or assisting where an individual’s life or property is at imminent risk. For example, TELUS will provide police or other emergency responders with location information for a wireless device belonging to someone who is lost or in danger.

More than half of such requests (42,761 in 2016) came from 9-1-1 call centres seeking help locating a caller in distress. The remaining 5,443 requests came from local police or emergency service providers.

In these cases we only provide the information needed to respond to the emergency.

Applicable law: PIPEDA and CRTC rules with respect to customer confidentiality.

Internet Child Exploitation Emergency Assistance Requests Description: In response to police requests, in the past TELUS would disclose the name and address of a customer using an IP address to help the police investigate a real-time case of online child sexual exploitation. Previously, it was understood that such disclosure without a court order was permitted under Canadian law and TELUS’ service terms. However, the Supreme Court of Canada in the Spencer case (referred to above) has ruled that such disclosure requires a court order, except in an emergency. Accordingly, TELUS has amended its practices in this regard.

Since that court decision, TELUS collaborated with law enforcement agencies to establish a new process to expedite the sharing of this critical information through court orders where children are in danger, while abiding by the spirit and language of the Spencer decision.

TELUS has always required a court order to provide customer information associated with an IP address in other cases.

Applicable law: PIPEDA, Criminal Code of Canada

Legislative Demands Description: this is a request for information by a government body, where TELUS is required by applicable legislation, to provide the information. For example, pursuant to the Income Tax Act, the Canada Revenue Agency may require TELUS to disclose certain customer information.

Applicable law: any federal or provincial legislation that authorizes a government body to request information from TELUS.

 

Frequently asked questions

What is the process for responding to information requests?

TELUS has a process for carefully assessing information requests received from law enforcement agencies and other government organizations:

  • A request is received and logged by TELUS’ Corporate Security department.
  • A specially trained and authorized TELUS Security team member reviews the request to ensure it has been correctly prepared and is legally valid. In the case of emergency calls, this involves obtaining confirmation that the situation involves an imminent risk to an individual’s life or property.
  • If the representative has concerns, they are brought to the attention of a supervisor, TELUS’ legal department and privacy office, or the agency or organization, as appropriate, for resolution.
  • Once the representative is satisfied that the request is valid, they will take appropriate steps to properly respond to the information request. For example, this could include searching relevant TELUS databases for the requested information.

How long does TELUS keep my information?

TELUS keeps customer information only as long as necessary to comply with the law and to fulfill our business purposes. For example, TELUS retains copies of customer bills for approximately seven years to satisfy legal requirements such as taxation law.

What legislation applies to the protection of customer privacy?

TELUS’ telecommunications businesses are governed by the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and by rules prescribed by the CRTC with respect to customer confidentiality.

This transparency reporting covers TELUS’ telecommunications businesses in Canada, including wireless, wireline and Internet.