OTTAWA, August 21, 2014 – Understanding a website’s privacy practices should not require a law degree or time-consuming search for relevant information, says Privacy Commissioner of Canada Daniel Therrien. Online privacy transparency has emerged as a significant concern and is among the key issues highlighted in the Commissioner’s 2013 Annual Report to Parliament on the Personal Information Protection and Electronic Documents Act, Canada’s federal private sector privacy law.
The Office of the Privacy Commissioner of Canada (OPC) addressed the issue of transparency in a number of contexts over the 2013 year, including investigations, the development of guidance for organizations and the Office’s participation in a global Internet privacy sweep.
“In today’s digital marketplace, websites and apps regularly collect a wide range of personal information—everything from a person’s location and online activities to their personal preferences and credit card information,” Commissioner Therrien says.
“Online environments are creating new challenges for organizations to communicate effectively about what personal information is being collected and what will be done with it. Companies must develop dynamic, creative ways of sharing privacy-related information to allow individuals to make informed decisions.”
Here are examples of recent transparency-related initiatives:
Sweeping changes
In May 2013, the OPC coordinated the first-ever global Internet Privacy Sweep
. The 19 participating privacy enforcement authorities examined how more than 2,000 websites and mobile apps provided information about their privacy practices. From websites with no privacy policy at all to others that had them hidden, the sweep identified numerous concerns. Our Office sent letters to a number of organizations outlining the concerns identified in the sweep and about 40 of them agreed to make changes to their privacy communications, thus eliminating the need for any formal investigation.
Free app frustration
This year’s annual report includes an investigation by the OPC related to online privacy transparency involving Apple Canada.
The company sought credit card and date of birth information from customers to create an Apple ID that would allow clients to download applications from the Apple website, even if the apps were free.
The OPC found collecting birthdates was a legitimate way to authenticate the identities of users, but felt the practice was not well explained in Apple’s privacy policy.
While Apple explained there was a way to download free apps without providing credit card information, the OPC found the workaround for the free apps was not evident.
The OPC recommended the company make it clear to users that they could download free apps without providing a credit card number. The OPC was pleased that Apple agreed to implement the OPC’s recommendations by the fall.
Online ads
In another investigation, the OPC found Google was installing cookies on people’s browsers that allowed advertisers to target individuals with products or services based on websites they may have been looking at.
An individual complained to the Office after searching for medical devices for sleep apnea only to later be bombarded by ads for the devices while surfing the web on completely unrelated matters. The man asserted that he had not consented to the collection and use of his sensitive health information for this purpose.
An investigation found that the use of sensitive personal information in this manner did not correspond to the wording stated in Google’s own privacy policy.
Further, the investigation identified shortcomings in the way the company monitors its advertisers and the OPC made several recommendations aimed at stopping privacy-intrusive ads.
Seeking consent online
In collaboration with provincial colleagues, the OPC developed guidance to help organizations obtain meaningful consent for the online collection, use and disclosure of personal information.
2013 Complaints to the OPC
The OPC accepted 426 formal complaints under PIPEDA in 2013, almost double the number accepted the previous year.
Much of the increase was a result of 168 complaints related to a new Bell Canada marketing initiative announced in October. The OPC grouped those complaints together and pressed forward with a single Commissioner-initiated complaint expected to be completed this year.
SOURCE: Office of the Privacy Commissioner of Canada