In April 2015, a consortium of law firms commenced a national class action in the Ontario Superior Court of Justice against a national Canadian telecommunications company (the "Company"). The lawsuit claims C$750 million in damages for various causes of action, including breach of contract, contraventions of the Telecommunications Act, and the tort of intrusion upon seclusion, resulting from the defendants’ alleged unauthorized use and disclosure of their personal information. The firms have also commenced a similar class action in the Superior Court of Québec.
The lawsuit follows a recent investigation that the Privacy Commissioner of Canada (the “Commissioner”) launched in response to a large number of complaints made under Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”). The investigation focused on an ad program operated by the Company from the date it was launched in November 2013 to April 2015 when it was voluntarily suspended. According to a full report of the Commissioner’s findings, the Company created profiles under the ad program for each customer with detailed personal information including internet usage, gender, age, credit status, and payment habits. This information was then compiled and sold to third-party advertisers for use in marketing campaigns.
The Commissioner’s report concludes that the Company was collecting information for a legitimate business objective. However, the Commissioner found that the Company violated PIPEDA in the manner in which it solicited and collected the information, and in particular that:
(i) the Company was not, via its opt-out model, obtaining adequate consent for the program given the sensitivity of the information involved;
(ii) the Company failed to allow customers to fully withdraw their consent to the program, as its practice upon receiving a customer's opt-out request was to cease serving the customer but continue to track and compile information in case the customer returned to the program in the future; and
(iii) the Company did not fully and adequately disclose details on the type of information collected, and the intended use of the information.
In response to the Commissioner's findings, the Company voluntarily suspended the program and announced plans to re-launch the program in compliance with the Commissioner's suggested corrections. Specifically, the Company will increase the disclosure provided to customers prior to obtaining consent, and subsequently seek consent on an "opt-in" rather than an "opt-out" model.
The Commissioner previously published a general Policy Position on Online Behavioural Advertising ("OBA Policy Position") in June 2012 regarding the practice of collecting personal information, and then selling the information to facilitate the delivery of targeted ads. While the OBA Policy Position outlines specific and limited circumstances where opt-out consent for such practices may be appropriate, the essential considerations for determining the appropriate form of consent to use in the specific circumstances remain: the sensitivity of the information, and the reasonable expectations of the individual to whom the information relates. The OBA Policy Position is clear that opt-out consent will generally be the exception, rather than the default standard of consent where information is collected for the purpose of behavioural advertising. In addition, the OBA Policy Position urges companies to be clear, accurate, and complete in disclosing information to customers when seeking any type of consent to collect information for marketing purposes.
The Commissioner’s report and the related lawsuit reflect a renewed focus on the privacy implications of “online behavioural advertising”. In November 2014, privacy commissioners across the country at both the federal and provincial level came together to urge governments to better protect and promote the rights of Canadians in the digital era through a joint resolution. While it may be too soon to assess the full impact of the recent events on enforcement and litigation trends, the lesson for the reader is clear: it may be time to review and re-evaluate online marketing practices to ensure that appropriate consent and disclosures are in place.
For more information, please contact Theo Ling, Arlan Gates, Eva Warden, Jonathan Tam or Zia Hassan.