Bell, one of Canada's big three telecoms, was quietly using customer credit score data to target online ads at subscribers.
Bell shut down the targeted ad program last month after Canada's privacy watchdog got involved. Now there are questions about whether it was legal to begin with.
Privacy Commissioner of Canada Daniel Therrien found several problems. For one, Bell customers were automatically signed up for the program and had to manually opt out.
Bell said last year that only about 2% of five million customers opted out.
In particular, Therrien said Bell's storing of credit scores was inappropriate.
It was all part of the Relevant Advertising Program, or RAP, and it involved far more than just a credit score. Biographical data, browsing history, and even a person's favourite hockey team would all form a personal profile.
A RAP profile would partly be shaped by the websites viewed. The idea was if a person frequented car websites they would see more ads for cars. The company would also pull information from a person's Bell account to inform targeting.
Privacy experts are conflicted on whether the program was legal. Canada's privacy laws allow for data to be saved for a reasonable amount of time, but not repurposed and saved indefinitely, said McInnes Cooper lawyer and privacy expert David Fraser.
"We're talking about sensitive information," said Fraser. "We're talking about possibly discriminatory information related to socio-economic status and things like that. A whole bunch of warning flags go up."
The company insists it maintains the privacy of its customers because profiles are created through computer algorithms and no customer information is ever shared with outside companies.
In fact, Bell argues RAP is also a win for consumers because they will see online ads for things they are actually interested in.
Bell plans to launch a new opt-in version of RAP. Meanwhile the Public Interest Advocacy Centre (PIAC) and the Consumers' Association of Canada have launched a CRTC complaint against Bell. A class-action lawsuit is also in the works.
"There's a real social danger when your telecom provider is looking into the contents of your messages and making behavioural inferences," said PIAC external legal counsel Geoffrey White in an interview.
Reached for comment, Bell said it only collects credit score information either to confirm someone's identity or to evaluate their credit worthiness, and that data is only stored as long as is necessary for those purposes.
That is true now. But it wasn't the case until the privacy commissioner ordered them to stop incorporating credit score information into RAP.
Paul McLeod is a politics reporter for BuzzFeed News and is based in Washington, DC.
Contact Paul McLeod at firstname.lastname@example.org.
Got a confidential tip? Submit it here.