Privacy czar’s Home Depot investigation exposes weaknesses in Ottawa’s new privacy bill

Canadian Privacy Commissioner Philippe Dufresne recently issued an important decision about the sharing of personal information between Home Depot and Meta (Facebook). The investigation exposes some troubling weaknesses in the government’s latest attempts to modernize Canada’s privacy law. The case involved sharing personal customer information through a business tool called “Offline Conversions.” Many of us have provided an email address to businesses to obtain an e-receipt. Home Depot was sending a “hashed” or encrypted version of the email address to Meta, along with the purchase details. Meta then matched the address to the customer’s Facebook account to evaluate the effectiveness of the platform's ads. For example, a customer buys a new washing machine at Home Depot, pays by credit card, and gets an e-receipt in their inbox. With this data, Facebook then determines whether the customer was ever served an ad for washing machines and passes that assessment back to Home Depot, which could then examine which Facebook ads were leading to offline purchases. Meta was also using this information to construct “look-alike” audiences to deliver ads across the Facebook platform to people with similar profiles to existing customers. Colin Bennett is a professor of Political Science at the University of Victoria. Photograph courtesy of Colin Bennett Dufresne found that these disclosures were not clearly explained. The company did not share the information with the customer’s “knowledge and consent,” in violation of the Personal Information Protection and Electronic Document Act (PIPEDA). There was complex legalese stated in the Facebook Business Tools terms of service, which few consumers would ever read. Even if they did, they would not “reasonably expect” that an email supplied solely for the convenient purpose of obtaining an e-receipt would then be used as an identifier to measure ad effectiveness. Home Depot argued that it had the “implied” consent of its customers for this disclosure because the information was inherently non-sensitive. But individuals might purchase a variety of sensitive products from Home Depot. A washing machine may not be a particularly sensitive purchase, but accessible bathroom products for people with disabilities are. Non-sensitive data can also become sensitive when processed in different contexts. The commissioner advised Home Depot to cease the practice, which, to their credit, they did. But we also know that many other businesses use this Offline Conversions service. The case is a typical contemporary privacy dispute involving layers of technical and legal complexity, opening a can of worms about possibly related technologies and business practices. The case also raises serious questions about the rules for obtaining consumer consent in the “modernized” version of PIPEDA that is now before Parliament: the Consumer Privacy Protection Act (CPPA), the first part of Bill C-27 (the Digital Charter Implementation Act). Section 15 of the CPPA states that consent must be “expressly obtained” unless it is “appropriate to rely on an individual’s implied consent.” Businesses should consider the “reasonable expectations” of the individual and the “sensitivity of the personal information that is collected, used, or disclosed” when determining which form of consent is appropriate. The bill enumerates those business activities to which consent is not required, including if the organization has a “legitimate interest that outweighs any potential adverse effect on the individual”—a standard that has been imported from the so-called “gold standard” of privacy protection, the European General Data Protection Regulation (GDPR). But in the GDPR, consent means express consent: freely given, specific, informed, and unambiguous. If it is impossible to obtain express consent, then businesses can rely on other legal grounds to process personal data. In the current version of the CPPA, businesses have both options. They can declare that they have “implied consent” because of some inaction that a consumer allegedly took at some point because of not reading the legalese in a complex terms-of-service agreement. And if that doesn’t fly, they can assert a legitimate interest in the personal data by claiming that there is no potential adverse effect on the individual. And that is a risk assessment performed by the business, rather than a judgment made about the human rights of individuals to control their personal information. There should be no room for “implied” consent in the CPPA. It is a dated idea that creates confusion for consumers, and, obviously—as in the case of Home Depot—for businesses. It is the worst of both possible worlds, and it needs to be fixed in the upcoming parliamentary consideration of Bill C-27. Colin Bennett is a professor of political science at the University of Victoria. For more than 30 years, his research has focused on the impact of surveillance technologies and the comparative analysis of privacy protection governance at domestic and international levels. He has published seven books on these subjects, including The Governance of Privacy (MIT Press, 2006), as well as policy reports for national and international organizations. The Hill Times

Privacy czar’s Home Depot investigation exposes weaknesses in Ottawa’s new privacy bill

There should be no room for ‘implied’ consent in Bill C-27. It is a dated idea that creates confusion for consumers, and for businesses, as in the case of Home Depot.

Amid TikTok ban, Canadians left ‘to their own devices’ as feds dither on updating privacy rules: Geist

It’s time to bring Canada’s privacy law into the digital age

Canadians’ privacy could take a serious hit this coming legislative session

Amid TikTok ban, Canadians left ‘to their own devices’ as feds dither on updating privacy rules: Geist

Canada needs a modern, national health data architecture

To address online harms, Canada must commit to digital media literacy

A cure for multiple sclerosis could be just around the corner

Renewable energy is the way to go, says letter writer

Supporting local broadcasters is critical for our democracy

How to dismantle a privacy bomb

Privacy bill achieves Canada’s priorities

‘Rights-based’ approach needed to modernize privacy laws, says next privacy commissioner Dufresne

Bill C-11 was the gift that needed returning

New privacy law gives Canadians more control and greater transparency

News

Get free news updates

Opinion

Submit a guest opinion article

resources

Advertise

subscribe

get help

Privacy czar’s Home Depot investigation exposes weaknesses in Ottawa’s new privacy bill

There should be no room for ‘implied’ consent in Bill C-27. It is a dated idea that creates confusion for consumers, and for businesses, as in the case of Home Depot.

Get The Weekend Point of View Newsletter