OTTAWA, Aug. 21, 2014 /CNW/ - Understanding a website's privacy
practices should not require a law degree or time-consuming search for
relevant information, says Privacy Commissioner of Canada Daniel
Therrien. Online privacy transparency has emerged as a significant
concern and is among the key issues highlighted in the Commissioner's
2013 Annual Report to Parliament on the Personal Information Protection and Electronic Documents Act, Canada's federal private sector privacy law.
The Office of the Privacy Commissioner of Canada (OPC) addressed the
issue of transparency in a number of contexts over the 2013 year,
including investigations, the development of guidance for organizations
and the Office's participation in a global Internet privacy sweep.
"In today's digital marketplace, websites and apps regularly collect a
wide range of personal information—everything from a person's location
and online activities to their personal preferences and credit card
information," Commissioner Therrien says.
"Online environments are creating new challenges for organizations to
communicate effectively about what personal information is being
collected and what will be done with it. Companies must develop
dynamic, creative ways of sharing privacy-related information to allow
individuals to make informed decisions."
Here are examples of recent transparency-related initiatives:
In May 2013, the OPC coordinated the first-ever global Internet Privacy Sweep. The 19 participating privacy enforcement authorities examined how more
than 2,000 websites and mobile apps provided information about their
others that had them hidden, the sweep identified numerous concerns.
Our Office sent letters to a number of organizations outlining the
concerns identified in the sweep and about 40 of them agreed to make
changes to their privacy communications, thus eliminating the need for
any formal investigation.
Free app frustration
This year's annual report includes an investigation by the OPC related
to online privacy transparency involving Apple Canada.
The company sought credit card and date of birth information from
customers to create an Apple ID that would allow clients to download
applications from the Apple website, even if the apps were free.
The OPC found collecting birthdates was a legitimate way to authenticate
the identities of users, but felt the practice was not well explained
While Apple explained there was a way to download free apps without
providing credit card information, the OPC found the workaround for the
free apps was not evident.
The OPC recommended the company make it clear to users that they could
download free apps without providing a credit card number. The OPC was
pleased that Apple agreed to implement the OPC's recommendations by the
In another investigation, the OPC found Google was installing cookies on
people's browsers that allowed advertisers to target individuals with
products or services based on websites they may have been looking at.
An individual complained to the Office after searching for medical
devices for sleep apnea only to later be bombarded by ads for the
devices while surfing the web on completely unrelated matters. The man
asserted that he had not consented to the collection and use of his
sensitive health information for this purpose.
An investigation found that the use of sensitive personal information in
this manner did not correspond to the wording stated in Google's own
Further, the investigation identified shortcomings in the way the
company monitors its advertisers and the OPC made several
recommendations aimed at stopping privacy-intrusive ads.
Seeking consent online
In collaboration with provincial colleagues, the OPC developed guidance
to help organizations obtain meaningful consent for the online
collection, use and disclosure of personal information.
2013 Complaints to the OPC
The OPC accepted 426 formal complaints under PIPEDA in 2013, almost
double the number accepted the previous year.
Much of the increase was a result of 168 complaints related to a new
Bell Canada marketing initiative announced in October. The OPC grouped
those complaints together and pressed forward with a single
Commissioner-initiated complaint expected to be completed this year.
About the Office of the Privacy Commissioner of Canada
The Privacy Commissioner of Canada is mandated by Parliament to act as
an ombudsman and guardian of privacy in Canada. The Commissioner
enforces two laws for the protection of personal information: the Privacy Act, which applies to the federal public sector; and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal private sector privacy law.
SOURCE: Office of the Privacy Commissioner of Canada
For further information:
(media only), please contact:
Valerie Lawton, Office of the Privacy Commissioner of Canada
NOTE: Journalists are asked to please send requests for interviews or further information via e-mail.