What You Must Know About DRM

4 The Impact of DRM on Privacy In North America, the legal concept of privacy was first explored in an 1890 article in the Harvard Law Review by Professors Samuel Warren and Louis Brandeis, who defined privacy as "the right to be let alone." 11 This definition of privacy has evolved over the last century to include at least two strands: the right of individuals to control their physical space (i.e., their body or home) and to control their personal information. The latter right is known as "informational privacy" or "informational self-determination." Consequently, privacy includes the right of individuals to control the collection, use and disclosure of personal information about themselves. Personal information can be defined generally as identifiable information about an individual. In other words, it is information that serves to identify a person and could include his or her name, address, telephone number, date of birth, race and family status. It could also include an identifying number that the government has assigned to an individual in exchange for receiving benefits, a person's e-mail address, and a person's medical or financial history. Some companies that use DRM technologies rely on the technology's capacity to collect personal information and transmit it back to the publisher of the content. They may also use the personal information and other "click-stream" information as a means to track customers' demographics and usage patterns and, as a result, learn how to market to particular market segments more precisely. IT experts have reported on the privacy problems associated with DRM technologies. 12 Not all DRM applications function in the same way. Some monitor content and rights acquisition, some focus on downloading extensions for advertising purposes, while some monitor and profile content usage; some may even execute all functions at once. What is relevant is that in virtually all cases, DRM requires the collection of personal information (data collected from the user's operation of the DRM application and the content it provides access to) in order to work properly. According to a thoughtful paper entitled, Privacy Engineering for Digital Rights Management Systems, 13 privacy concerns arise in a number of ways, including: 1. ID linkage: This DRM model requires the user to provide an ID number that links the user's personal information (name, address, transaction history, etc.) with the device or service a person intends to use. (For example, the device could be a computer or cellphone.) These devices or services connect to a rights server (a catalogue of user access/usage rights associated with particular devices or services), so that when someone decides to use a device or service, or updates or changes to another device or service, the rights server catalogues these uses or changes using the initially registered ID provided by the user. The paper stresses, "[s]uch tracking for the purpose of tying content to a set of devices obviously puts at risk some previously private information about the user." 14 It is not clear, in most reports on the subject, which DRM applications actually catalogue and mine such ID numbers but, regardless, the capability still exists due to the "ongoing, periodic contact between user and distributor." 15