Privacy Commissioner Calls Retailer Out On Consent Requirements
Published:
February 1, 2023
Author(s):
On January 26, 2023, the Office of the Privacy Commissioner of Canada (OPC) released a report of findings requiring companies using targeted advertising and offline conversion tracking to revisit and re-examine their practices. Following its investigation into Home Depot of Canada Inc.’s compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA), the OPC decided that organizations can’t rely on implied consent obtained via a privacy policy for such uses and disclosures of customer personal information, even where that information isn’t sensitive in nature. To help ensure alignment with Canadian requirements, businesses should review their current online behavioral advertising and offline conversion analytics practices to assess what information is collected, used and disclosed for such purposes, and how they’re obtaining consent. Time is of the essence for ensuring advertising analytics practices meet the appropriate consent threshold: Canada is poised to enact a new federal privacy law (the Consumer Privacy Consumer Privacy Protection Act) with consent requirements similar to PIPEDA – but with much more significant non-compliance penalties.
Retailer’s Consent Practices
The Office of the Privacy Commissioner of Canada launched its investigation when it received a complaint from a customer surprised to discover, upon a review of his Meta Platforms, Inc. (formerly Facebook) account information, that Meta had a record of many of his in-store purchases from a well-known retailer. The retailer confirmed that when in-store customers chose to receive an e-receipt instead of a paper receipt, it forwarded to Meta the customer’s hashed email address and in-store purchase details (for example, date and dollar amount of purchase, and general type of purchase such as “lumber” or “hardware”) using Meta’s “Offline Conversions” tool. Meta would then match the hashed email to the customer’s Facebook account. If the customer had a Facebook account, Meta would compare the customer’s offline purchase information to the retailer’s ads delivered to the customer by Meta to measure the effectiveness of those ads. Meta would provide the results of that analysis back to the retailer in the form of an aggregated report, giving insight into the impact of its advertising on its customers’ ‘offline’ purchasing behavior. Meta would also use the customer’s information for its own business purposes, including targeted advertising.
OPC’s Finding of Invalid Consent
The Office of the Privacy Commissioner of Canada found that the consent practices of neither company measured up.
No Valid Consent. The OPC determined the retailer didn’t obtain its customers’ valid consent for this practice. When in-store customers provided their email address to obtain an e-receipt, they wouldn’t reasonably expect the “secondary use” or disclosure of information to Meta to analyze the effectiveness of its Meta ads, or for Meta’s own purposes. Without adequate information about the use and disclosure presented to the customer when they provided their email address, the customer didn’t provide meaningful consent to this secondary use.
Privacy Policy Insufficient. The OPC further found the retailer couldn’t rely on its privacy policy as a means of obtaining customers’ implied consent to the sharing of the in-store purchase information with Meta and the uses as described. The OPC also determined that Meta couldn’t rely on its privacy policy as consent for Meta’s use of the customer’s personal information. Instead, the OPC found that customers should have been presented with an opt-in choice at the time of collection.
Please contact your McInnes Cooper lawyer or any member of our Privacy, Data Protection & Cyber Security Team @ McInnes Cooper to discuss compliance with your consent obligations.
Related Lawyers
Related Services
Related Industries
McInnes Cooper has prepared this document for information only; it is not intended to be legal advice. You should consult McInnes Cooper about your unique circumstances before acting on this information. McInnes Cooper excludes all liability for anything contained in this document and any use you make of it.
© McInnes Cooper, 2023. All rights reserved. McInnes Cooper owns the copyright in this document. You may reproduce and distribute this document in its entirety as long as you do not alter the form or the content and you give McInnes Cooper credit for it. You must obtain McInnes Cooper’s consent for any other form of reproduction or distribution. Email us at [email protected] to request our consent.
