The Canadian Access to Social Media Information (CATSMI) Project has examined over 20 of the most popular social networking services used in Canada, based on a survey of marketing research that evaluated the relative popularity of social networks. We examined the following: Blogger (Google); Club Penguin; Facebook; Flickr (Yahoo!); Foursquare; Google+; Instagram (immediately after acquisition by Facebook); LinkedIn; LiveJournal; MySpace; Nexopia; Ping (Apple); Plenty of Fish; Reddit; Tumblr; Wikimedia Foundation; Wordpress.com; World of Warcraft (Blizzard); YouTube (Google); and Zynga.
We focused on the companies that provide the social network (e.g. Twitter), rather than the companies who provide applications to communicate with social networks (e.g. Tweetdeck, a desktop client that lets individuals post to, and read from, the Twitter social networking service). Thus, we have analyzed only these networking companies’ privacy policies and tested access to the information they collect about Canadians.
Our team analyzed the content of a sample of privacy statements and corporate data disclosure policies. After evaluating sample statements, we composed a matrix of the social networks under study and identified relatively common key disclosure practices that emerged from our initial evaluation. The matrix helped us develop a comparative framework to categorize and differentiate between privacy statements and disclosure agreements associated with the social networking services under study.
Our documentary analysis was supplemented by testing the services’ compliance with access requests against Section 4.9 Schedule 1 of Canada’s federal privacy legislation, the Personal Information Protection and Electronic Documents Act (PIPEDA). Our requests were filed where members of the research team had a pre-existing relationship with a network; as such, only the following services were tested for Section 4.9 Schedule 1 compliance: Twitter; Facebook; LiveJournal; Ping (Apple); Tumblr; Google Domains Services; Wordpress.com; Flickr; Google+/Google Services (non-domain services); and LinkedIn.
Documentary analysis was also supplemented by research interviews with members of Canadian law enforcement with a specialization in using social media for policing practices, such as intelligence gathering and criminal investigation that relies on professional relationships with social networking services themselves. Interviews were recorded, but the names and organizations have been kept anonymous.
The final aspect of our methodology involved contrasting existing privacy law and policies against both contemporary policing activities and the federal government’s lawful access legislation. With regards to the legislation, we primarily focused on Bill C-30 which was titled “Protecting Children from Internet Predators Act.” From this comparison, we can determine inductively how lawful access legislation might lead to changes in existing policing practices and to the access and disclosure requirements that services providers might have to accommodate.