Rogers found to have violated PIPEDA through voiceprint program

Rogers Communications Inc. violated a customer’s privacy by not deleting her voiceprint from its program, even though she had told the company to do so, the Office of the Privacy Commissioner (OPC) found, citing provisions of the Personal Information Protection and Electronic Documents Act (PIPEDA). The OPC made its report of findings in March, but it was only released last week. In 2018, Rogers installed a biometric voiceprinting service called Voice ID in order to authenticate account holders. A woman complained to the commissioner that after her first call to the telecom, she was enrolled in Voice ID, even though she told the customer service representative (CSR) that she did not consent to joining the program. A month later, a second call from the firm informed her she was still a member of Voice ID. She was deleted from the database but re-registered during a third call from Rogers. Rogers uses a call back system to determine if customers want to be on Voice ID. If they decline, they are contacted 30 days later. If they still decline, they will be contacted 90 days later. After that, the voiceprint is discarded. This raised the question of sensitivity of the data. “Our office does, however, recognize that while all biometric information is generally considered sensitive, not all biometric information is equally sensitive,” the OPC wrote in its decision. “For instance, genetic information and faceprints will generally be considered to be of higher sensitivity.” The office found that Rogers' collection of voiceprints was reasonable and dismissed the first half of the complainant’s claim. It agreed with her on the question of consent. The commissioner found that a one-line recorded message from the telecom saying recordings would be used for identification purposes was not sufficient to warn clients about privacy concerns. Callers would not understand that the word identification meant voiceprints. The recording of the complainant’s first call had been deleted and was not available for the OPC to review. It determined that she was, in fact, withdrawn from the program after the second phone call. “From our review of the third call, we noted that the representative did not ask for consent or even advise the complainant of the Voice ID enrolment,” the office said. Rogers conceded that the CSR had erred in not doing so, perhaps enrolling her by mistake when transferring her call to another department. The OPC made five recommendations to bring Rogers into alignment with PIPEDA: obtaining opt-in consent from customers; telling them they could opt-out and deleting the voiceprint upon opting out; deleting voiceprints of those who have already opted out; ensuring revised consent measures are properly implemented; and getting those who have opted in to reaffirm their consent. –Reporting by Paul Park at ppark@thewirereport.ca and editing by Jenna Cocullo at jcocullo@thewirereport.ca.

Rogers found to have violated PIPEDA through voiceprint program

News | October 7, 2022

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Rogers found to have violated PIPEDA through voiceprint program

News | October 7, 2022

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Facebook looks to take privacy fight to Supreme Court of Canada

Ethics committee calls for overhaul of Privacy Act to protect public servants’ data

Telesat deal good for Canada, Champagne tells INDU committee

Two years in, balancing change and privacy the main task for Philippe Dufresne

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us