What You Must Know About DRM

6 Integrating privacy into DRM technologies There are a number of both simple and complex measures that can be undertaken by both DRM developers and companies selling DRM-protected products to ensure that their technologies do not violate the privacy rights of consumers. As a starting point, companies that use DRM technologies should consider whether collecting personal information from consumers is even necessary. In the settlement reached in the Charley Pride CD case, the defendants agreed not to require consumers to provide "personally identifiable" information, as a condition for listening to the CD or downloading songs from the SunnComm Web site. We would encourage other companies selling DRM-protected products to consider eliminating the collection of unnecessary personal information. If any personal information is collected, it should only be obtained with the consent of the consumer. Consent in this context should be "informed consent" ­ the consumer must understand the nature and consequences of providing or withholding consent. If a consumer consents to the collection of his or her personal information, companies that use DRM should recognize that copyright holders and consumers actually share a common interest ­ controlling the flow of the information. For example, Harvard University Law Professor Jonathan Zittrain has argued that there is a profound relationship between those who wish to protect intellectual property and those who wish to protect privacy. Their common desire is control over the distribution of information. 20 Similarly, Mark Stefik, a research fellow and manager at the Xerox Palo Alto Research Center, has argued that the same technology that guards the property rights of publishers could also be used to protect the personal information of consumers. 21 Stefik outlines the manner in which this could be accomplished in an intriguing article in Scientific American titled "Trusted Systems." The thrust of many DRM technologies is to control information that is protected by copyright laws. Similarly, a key element of personal privacy is that individuals should have the right to control the collection, use and disclosure of their personal information. Consequently, the DRM methodology for strictly controlling the distribution of intellectual property in digital form offers an ideal model for protecting the personal information of consumers. In other words, DRM developers should implement a scheme that ensures that any personal information collected from consumers is protected as zealously as intellectual property. The following section explores ways to create such a scheme. In 2002, the Information and Privacy Commissioner/Ontario released a paper called, the 7 Essential Steps for Designing Privacy into Technology, 22 which provides a framework for undertaking a privacy analysis of any technology and its related components, ranging from legal issues to policy practices. The 7 Steps can be applied to DRM technologies in the following way: