BLOG

If your business collects personal information and shares it with your service providers, it’s time to re-evaluate your privacy practices. In light of recent findings by The Office of the Privacy Commissioner (the “OPC”), businesses that disclose personal information to their service providers for internal business purposes (such as marketing or analytics) may need to implement disclosures beyond those in a privacy policy and obtain express consent from individuals whose information they collect.

In January, the OPC found that Home Depot of Canada Inc. (“Home Depot”) shared the private information of its customers with Facebook (now Meta Platforms, Inc., “Meta”) in contravention of the Personal Information Protection and Electronic Documents Act (“PIPEDA”). The findings of this investigation suggest that the disclosures required to use customer information for marketing and analytics purposes go beyond the content of your privacy policy. The investigation also raises questions about how specific businesses need to be about the purposes for which they collect personal information.

Background

A Home Depot customer discovered on Facebook that Meta had records of his in-store Home Depot purchases and subsequently filed a complaint with the OPC. It turns out that since 2018, Home Depot had been sharing with Meta the purchases and email addresses of customers who requested e-receipts while checking out in-store via Meta’s Offline Conversions program. Although Home Depot hashed the email addresses before sharing them with Meta, if those email addresses were associated with a Facebook account, Meta would be able to match them with current Facebook user accounts and Home Depot’s ads delivered to that user on Facebook. Meta would then provide aggregated results of that analysis back to Home Depot, allowing Home Depot to measure the effectiveness of their marketing. Meta was also able to use Home Depot’s customer information for its own business purposes unrelated to Home Depot.

Findings

Home Depot argued that it had implied consent to use the emails collected for this purpose. The basis for this argument was language in its privacy policy that said the company used information collected for “internal business purposes, such as marketing, customer service, and business analytics” and that it “may share information for business purposes,” including “with third parties.” Home Depot also relied on Meta’s privacy statement which explains the Offline Conversions Program.

Despite the disclosures made in its privacy policy, the OPC rejected Home Depot’s assertions – and found that Home Depot “failed to ensure valid consent” at the time customer information was collected. In other words, the actual information about how their email would be used  “would have been material to a customer’s decision about whether or not to obtain an e-receipt.” The OPC also stated that customers’ expectations would have been limited to what they had been told would be the use for the email addresses they provided – receiving an e-receipt. The OPC therefore found that customers would have no reason to refer to Home Depot or Meta’s privacy documents to obtain further information.

Moreover, the OPC stated that even if Home Depot had linked to its own privacy policy during the checkout process, the policy’s “generic and vague” language does not adequately explain that customer information may be disclosed to its service providers for their own purposes, and does not clearly describe the purposes for collection, use and disclosure of personal information.

What does this mean for your business?

The OPC’s findings were largely based on Principle 4.3 of Schedule 1 of PIPEDA, which requires knowledge and consent for the collection, use and disclosure of personal information. At Inter Alia, we’ve long advised our clients to draft clearly worded privacy policies, and furthermore to err on the side of over-disclosing for years.

This case demonstrates the difficulties with relying on implied consent – for such consent to be valid, the use of personal information needs to fall within the individual’s reasonable expectations of how that information will be used.  Whatever the privacy policy may say, Home Depot’s question to the customer at checkout was deemed to be misleading in a way that the privacy policy could not protect them against. The fact is that a reasonable person who is asked if they want to provide their email “to get an e-receipt” is only consenting to that. If the question was “do you want to provide your email for an e-receipt along with all of Home Depot’s other uses of personal information as described in our privacy policy”, maybe it would have been upheld.

The lesson here seems to be: don’t ask a very specific question with an easy yes or no consent response, and expect to be protected from the argument that you misled your customer by generic language in your privacy policy.

Said another way, disclosures made in a privacy policy are not useful to those who have no reason to think they need to consult it – and this goes to the heart of what it means to obtain meaningful consent. In fact, the OPC has long advised that information buried in a privacy policy is not of any practical use, and may not act as the “silver bullet” businesses have been relying on. As we anticipate updates to Canada’s privacy laws, it’s wise to adhere to the spirit of PIPEDA’s Fair Information Principles and ensure that users know exactly what information is collected and how it’s used. At Inter Alia, we always recommend baking good privacy practices into the heart of our clients’ businesses, by design, rather than solely relying on the privacy policy. It builds good relationships with their customers, and keeps us ahead of the curve as the law inevitably evolves toward higher and higher levels of consumer protection in this space.

Especially after this investigation, businesses need to consider (i) regularly reviewing their privacy policies to ensure all purposes for disclosure are described in a way that is easy to navigate and understand, (ii) supplementing those policies with just-in-time disclosures (in this case for example, that would be Home Depot informing customers during the checkout that their information would be shared with Meta for analytics purposes); and (iii) not relying on implied consent unless a use truly falls within customers’ expectations.

If you have any questions about your privacy policy or disclosure practices, please feel free to reach out to our team to obtain advice based on your specific circumstances.

The content on this web site is provided for general information purposes only and does not constitute legal or other professional advice or an opinion of any kind. Users of this web site are advised to seek specific legal advice regarding any specific legal issues. Inter Alia does not warrant or guarantee the quality, accuracy or completeness of any information on this web site. The articles published on this web site are current as of their original date of publication, but should not be relied upon as accurate, timely or fit for any particular purpose.

On the occasion of International Women’s Day, we asked our team members to take a minute to consider the progress made by the women’s movement over the years and give some thought on how we can continue with that progress. Inter Alia Law was founded by a woman, and has a grown over the past decade into a gender-balanced team made up of 6 women and 5 men.

On Progress:

Rowan Alleyne

Thanks to the tireless efforts of women before me, the women who have passed way too soon, the women presently in my life and the generations of women who will come after me, I am now able to enjoy the same opportunities as not only a man but a non black woman.  As this generation continues to work together to ensure equality for all women, on this International Women’s Day I choose to celebrate the achievement of the women in my life today.  I am grateful to those who have shaped me and who continue to provide me with a safe space to grow and achieve my goals.  I am also hopeful that my daughter will know she has no limit to what she can achieve in life.

Dunia el-Jawhari

A determined woman with the will to succeed is formidable.  We consistently find a way to get it done. In our careers, for our dreams, and for our families and friends. My women colleagues consistently demonstrate what success and support of one another looks like in our profession.  The women my family and in my inner circle consistently show me what success and support of one another is in so many other parts of my life. They say consistency is key in any endeavour, and we have shown that slowly but surely, we have started to succeed, we are succeeding and we will continue to succeed.  Determinedly, formidably, and consistently.

Marina Faheim

As I take some time to reflect this Women’s History Month, I am so encouraged by the progress I’ve seen even in my own lifetime. As a new(ish) mom I can’t help but compare how the workforce and community spaces looked for my own mom as she entered this phase in her life. A little more hostile, and a lot more closed off. So I am so grateful to her and women like her who bravely opened up opportunities for their daughters when it came time to face those same changes. I hope to continue that forward movement to ensure future generations of women and moms feel empowered and supported by their communities to pursue whatever fulfilment looks like for them.

“Ally” (our ChatGPT associate)

Chat GPT’s response to Chris Sanz’s prompt: “Write a paragraph for int’l women’s day on how far women have come in my lifetime, and my gratitude for it.”

Women have shattered glass ceilings, broken down barriers, and taken on roles that were once thought to be exclusive to men. Women have become CEOs, politicians, athletes, and scientists, among other things. There are now more opportunities available for women in education and the workforce, and women are making strides in closing the gender pay gap. As we celebrate International Women’s Day, I am filled with gratitude for the women who came before us and paved the way for our progress. I am grateful for the women who fought for our right to vote, the women who led the feminist movement, and the women who continue to inspire and empower us today. We still have work to do, but I am hopeful for a future where gender equality is the norm.

Chris Sanz (the real one…)

It is remarkable to me how much progress our society has made in treating women as the equals that they are. It is also disheartening how much is left to do. On International Women’s day, we are afforded a chance to pause and consider this important topic. While progress may not always feel like a straight line, when I contemplate the opportunities my daughter will have as compared to my mother or even my partner, the progress is obvious. I am thankful for that.

Anna Pennino

As I reflect on how far we’ve come, it is truly amazing the strides women have taken to get to where we are. When one considers that only a few generations ago women had barely any education, while women today make up more than half of the students in the classroom, it is truly amazing. There is still lots more work to be done but we sometimes need to pause and be grateful for the achievements we have made to get to where we are. Here is to the 💪 women before us who pushed through and broke down many barriers, and to the future generation of women who will continue to persevere and overcome the obstacles that come their way.

On the Work Left to Be Done:

Darlene Tonelli

The very idea that a woman could go to law school, work at a big firm, be an executive in a corporation, and then found a law firm (back in 2013) is a result of the women’s movement. In Canada, women were declared to be “persons” only 84 years ago! Would my grandmothers have envisioned this was possible? In my case, one grandmother had 12 children, and the other had 7!

There is work left to be done, of course. To help others doing this work, we’ve listed some of the foundational ideas behind Inter Alia that helped us bake gender equity directly into our model from the start, mainly by looking at people as whole human beings, and considering the kind of world those people would want to help create:

1. High performing lawyers would also bring high standards to their lives outside the office.

• From the start, we rejected the notion that “work first, everything else second” was the only way to lawyer at a high level. This idea is not just about women – it is about parents, and people without children who chose to lead full lives in other ways outside the office. The idea is that people can contribute and be very successful without making work their be all and end all.

2. Technology could facilitate freedom and flexibility.

• Technology can tie people to the desk around the clock, OR it can facilitate being present for family while having a demanding career. The decision on which it would be is driven by the values of the organization. Inter Alia was virtual and remote long before anyone felt that was the way that law firms would practice in future. We set ourselves up this way because we suspected it was the best way to practice for lawyers with obligations outside the office. So far, we have been more present parents to 28 Inter Alia children with this model.

3. On the other side of a lawyer with a balanced life, is a client with a balanced life.

• In going about our own lives demonstrating a high commitment to our families as well as our work, we give permission to our clients to do the same. Shared values drive us, and we often attract and work with clients who feel the same way we do. We believed that clients and lawyers would be attracted to the vision behind the model (although that was a scary decision at the time, when most law firms operated on the presumption that it was 24/7 responsiveness that attracted and retained clients), and this has proved to be the case.

4. Equity can be baked into the Business Model.

• Inter Alia’s structure questions traditional ideas about profit and hierarchy. We have an egalitarian revenue model designed to compensate high performing lawyers based on their own income targets, not targets set for them. We have a flat structure in which each lawyer is supported in building their own business. Incentives support collaboration and largely remove discussions about money and “top billing” and other things that, in our view, operate at cross-purposes to offering excellent client service and building a great team.

5. If we’re focusing only on changing things for women, we’re missing 50% of the problem.

• The project is to re-envision work and roles for both men and women, something we have been engaging with actively from day one. The reason for this is that, for parents, if we only talk about allowing women to work more flexibly, women will continue to bear the full burden at home in addition to their work. We have worked actively to create a space for men to work flexibly as well, to support their partners’ career goals, and to make sure that no one of either gender who wants to work in a way that integrates work and family is viewed as less serious about their career as a result.

When these 5 ideas are added together, what we end up with is a business model that is aligned with, and supports, our belief in the value of gender equity. And rather than only focusing on the places where women are fighting for a seat at the existing table, we’re building a new table that makes more sense (to us anyway). We call this “equity-building”, rather than “equity-seeking”. Our goal is to use the power of balanced genders with shared values on our team to come up with new ideas on how we can build a world structured around stronger fundamentals. The interesting piece will be seeing all the various ways that other people take on this challenge in building their businesses! Our way is just one.