Is your dating app sharing your sexual habits with marketers? Is your fitness tracker monitoring your location when you're not working out?
There's an online tool making it a little easier for you to find out.
Access My Info Canada is a website that allows consumers to easily contact companies that make fitness trackers, telecommunications tools and dating applications, along with the government of Canada, to ask what kinds of data they're collecting and with whom they may be sharing it.
"This can help people answer questions if they've ever wondered if their cellphone provider is logging their location, or if their online dating app is ever sharing their sexual preferences," says Andrew Hilts, who developed the tool in collaboration with Citizen Lab, a research institute focused on human rights and digital technology based at the University of Toronto.
The website first launched in 2014, with a specific focus on telecommunications. Hilts decided to create the expanded version being released today after requesting information from fitness apps for a different project, with eye-opening results: he found, for example, that some companies were tracking users' locations even when they weren't working out.
Your weight? Your dating history?
The tool is designed to help consumers take advantage of their rights under Canadian privacy laws, which allow them to access and correct any personal information held by Canadian organizations or organizations that do business in Canada.
"We don't think many people know about this right," says Hilts, who is also the executive director of Open Effect, a non-profit that researches privacy and security issues.
The tool automatically helps people generate requests for the information companies might have about them — including personality traits, sexual preferences and dating history in the case of dating apps, or information about diet and weight in the case of fitness apps — and provides direct contact information for those companies' privacy officers.
- Website helps you see if telecoms are collecting your info
- Some fitness trackers vulnerable to monitoring
While companies theoretically tell people what kind of information they're collecting in their privacy policies, those policies tend to be vague, Hilts says.
"There's lots of uses of the words like 'may' and 'could' and as a result customers are probably more confused after reading the policy than before."
Data breach risks
Giving customers access to this information can be vital: it helps them understand what details may be made public if there's a data breach at a particular company, and decide whether or not to do business with companies based on their privacy practices and the data they gather.
- Ashley Madison could face suit after massive data breach
- Listen to Part 1 of a special series on big data and its implications for society, business and consumers on CBC Radio 1 at 9 p.m. on June 23
Hilts also hopes that it will help show companies that Canadian customers care about privacy, encourage them to provide customers with better access to their own information, and make them keep better track of what information they're collecting and why.
Hilts said the telecom tool has led to a number of positive changes. Internet service provider Teksavvy has announced that, as a result of requests made via Access My Info, it has taken steps to minimize the personal data it collects. The website's creators have also noticed that Rogers has improved the way it responded to information requests, such as clarifying whether it can disclose to customers that law enforcement had requested their data.
Because the expanded version of the website involves new industries and sectors, even its creators aren't sure exactly what information customers will get back, or whether the companies will respond at all. However, they have some recommendations for what to do if you don't get a satisfactory answer in response to your request, such as reminding companies that you have a right to complain to Canada's privacy commissioner if they don't fulfil their disclosure obligations.
The latest updates to the tool were funded by the Canadian Internet Registration Authority's community investment program.