Project Arachnid Privacy Policy

This Project Arachnid Privacy Policy was last updated June 20, 2024.

The Canadian Centre for Child Protection Inc. (“C3P”, “we”, “our”) may update this Project Arachnid Privacy Policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal, or regulatory reasons.

The C3P Privacy Policy applies generally to C3P’s programs, initiatives and websites (unless otherwise stated). This Project Arachnid Privacy Policy describes C3P’s privacy practices that are specific to Project Arachnid. If there is a conflict between the C3P Privacy Policy and this Project Arachnid Privacy Policy, then this Project Arachnid Privacy Policy shall prevail in connection with Personal Information processed as part of the operation of Project Arachnid.

Please see the C3P Privacy Policy for more information about our privacy practices.

  1. About Privacy

    Personal Information

    “Personal Information” is information about an identifiable individual.

    Privacy Laws

    We adhere to Canadian private-sector privacy laws, including the federal Personal Information Protection and Electronic Documents Act1 (“PIPEDA”), when and as they apply to C3P’s activities. Where the laws don’t apply, C3P believes that maintaining the privacy of Personal Information is still of the utmost importance and accordingly it adheres to the spirit of PIPEDA.

  2. About Project Arachnid

    Purpose

    C3P is committed to assisting victims and survivors of child sexual abuse, and Project Arachnid is a key tool that is used to do that. The purpose for handling Personal Information through Project Arachnid is to safeguard a particular child or children generally, reduce sexual abuse and exploitation of children, and reduce the public availability of child sexual abuse material (“CSAM”) and other harmful-abusive material of children. C3P believes these activities serve the interest of vulnerable and abused children and the public, and together constitute a legitimate interest pursued by C3P.

  3. Collection and Use

    We collect public-facing content on the Internet that is reasonably suspected to be or relates to CSAM or harmful-abusive material of children. For each image and video collected, a unique hash value is created to distinguish one from another and retained for future use. Trained analysts assess the images and videos for the purpose of classification. Project Arachnid also uses hash values from trusted third parties. With hash values, Project Arachnid can detect known CSAM or harmful-abusive material on the Internet. Once detected, Project Arachnid sends removal requests to websites and online service providers.

    The majority of the individuals depicted in CSAM and harmful-abusive material are unidentified, meaning that their identities are not known to the entities collaborating in Project Arachnid.

  4. Disclosure

    Hotlines and Agencies

    C3P works with hotlines and agencies in other countries acting in the public interest against child sexual abuse. As part of their operations, like C3P, most of these hotlines and agencies receive reports of CSAM online and then either facilitate reporting to law enforcement or issue removal requests to websites and online service providers in their jurisdictions. Hotlines and agencies may, upon request, be permitted to use the hash values generated by Project Arachnid to reduce duplication of assessment in their own operations, or be granted access to images and videos for the purpose of classifying whether they are CSAM or harmful-abusive material. C3P requires compliance with all applicable data protection laws and imposes strict privacy obligations on all hotlines and agencies working with C3P.

    Organizations

    Project Arachnid assists organizations with the detection of known CSAM and harmful-abusive material by allowing comparison between incoming or existing media (or hash values of such media) on an organization’s service and Project Arachnid’s hash values and related data. C3P requires compliance with all applicable data protection laws and imposes strict privacy obligations on all organizations using C3P data.

    Removal Requests

    When an image or video displayed online is believed to contain CSAM or harmful-abusive material, a notice may be generated through Project Arachnid or manually by a trained analyst and issued directly to the website operator and/or the website’s host/infrastructure provider requesting its removal. Communications may also occur with hotlines, agencies or other third parties tasked with providing such notifications to providers in their own jurisdiction.

  5. Research

    Given the innovative approach to tackling this problem through a combination of technology and collaborative assessment efforts, recognizing that the public availability of CSAM is a global problem, and believing that it is in the public interest to ensure data that can assist in addressing the issue is available, it is anticipated that from time to time information used or generated through Project Arachnid will be used to conduct research.

    To the greatest extent possible, any such research is either conducted solely by C3P, C3P in conjunction with a trusted professional or group of professionals, or trusted third parties (e.g., researchers and other organizations working to protect children and remove CSAM online). We use contractual and technical safeguards to protect all data, including any Personal Information, shared with third parties in this context.

    Regardless of who conducts the research, any research results will be presented in the aggregate and not include Personal Information.

  6. Consent

    We obtain consent as required under privacy laws or rely on exceptions to consent for the handling of Personal Information. If you would like to make a request to withdraw your consent, contact our privacy officer here: https://protectchildren.ca/en/privacy-policy/privacy-contact/.

    You can also contact our privacy officer by mail at:

    Privacy Officer, Canadian Centre for Child Protection Inc.
    615 Academy Road, Winnipeg, Manitoba R3N 0E7

  7. Protection and Retention

    C3P has implemented and enforces stringent technological, organizational, contractual and physical safeguards to protect the information within Project Arachnid. Safeguards are and will continue to be reassessed and updated as needed. Examples of safeguards that are in place include:

    • Classifications can only be performed by individuals who are trained and who have undergone appropriate security screening.
    • Classifications only occur within physical office spaces that are not accessible to individuals unauthorized to perform classifications.
    • C3P has measures in place to monitor computer systems and servers against intrusion.
    • C3P uses encryption to protect information.

    C3P does not store Personal Information longer than is necessary for fulfilling the activities described in this Project Arachnid Privacy Policy and to comply with legal and regulatory requirements. Personal Information collected for Project Arachnid is stored in Manitoba, Canada.

  8. Individuals Outside Canada

    C3P and Project Arachnid are based in Canada. Individuals who choose to provide information from any other regions of the world consent to the transfer of such information to Canada for storage and processing.

    Personal Information about non-Canadian residents will be processed in accordance with this Project Arachnid Privacy Policy.

  9. Inquiries

    We are committed to protecting Personal Information within our control. Please contact our privacy officer online or by mail (see below) if:

    • You have any questions or concerns about our privacy practices.
    • You would like to make a request in respect of your Personal Information (e.g. access, update or correction).

    Note that, depending on your request, we may have to verify your identify.

    To contact our privacy officer online:

    https://protectchildren.ca/en/privacy-policy/privacy-contact/.

    To contact our privacy officer by mail:

    Privacy Officer, Canadian Centre for Child Protection Inc.
    615 Academy Road, Winnipeg, Manitoba R3N 0E7

    Victims/survivors, either on their own or through a lawyer or designated support person, are able to obtain information from, make requests of, and share information with, C3P. C3P will make all reasonable efforts to respond to questions or inquiries and address concerns that may be raised by victims/survivors and/or their legal counsel.

  1. 1 Canada is considered as providing an adequate level of protection for personal data transferred from the European Community to recipients subject to PIPEDA (see 2002/2/EC: Commission Decision of 20 December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act). ↩