The Office of the Privacy Commissioner of Canada (OPC) recently issued its Report of Findings regarding Home Depot’s handling of customer information. The OPC found that the retailer failed to obtain meaningful consent when it disclosed non-sensitive information of customers who selected to receive receipts by email during instore check-out to Meta (Facebook’s parent company) for online marketing purposes. While the information was non-sensitive, the OPC still concluded that opt-in consent was required because customers would not have expected information from their transaction to be shared with Meta under the circumstances.
Home Depot shared email addresses and in-store purchase details for customers who chose to receive an email receipt instore. Meta matched this information to the corresponding Facebook account and used the purchase information to measure the effectiveness of the ads it delivered to customers on Facebook. Meta then provided Home Depot with the results of its analysis.
The OPC found that customers’ email addresses and purchase information was “non-sensitive”, but concluded that opt-in consent was required because customers would not reasonably expect that by selecting to receive an emailed receipt for an instore purchase, their data would be sent to Meta for online marketing purposes.
In the unique circumstances of this case, the OPC concluded that opt-in consent was required because customers needed to be provided with the choice directly at the time the information as collected (i.e., at the check-out counter).
The OPC also found that Home Depot’s privacy statement (posted online and available in stores) was insufficient to obtain consent under PIPEDA because:
The OPC indicated that customers would not understand the nature of the information sharing with Meta or the consequences of this practice, contrary to PIPEDA section 6.1. The OPC also concluded that Home Depot failed to make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used, contrary to PIPEDA principle 4.3.2.
The OPC’s investigation provides two key practice points for businesses engaged in targeted online advertising.
The OPC’s decision is an important reminder that businesses should consider the reasonable expectations of individuals whose information is being collected for the purpose of targeted advertising. Where this practice is outside their reasonable expectations, businesses should consider whether a more express form of consent is appropriate.
The decision involved non-sensitive information, for which the OPC has typically been prepared to accept the use of opt-out consent. However, the OPC considers two other factors in determining the appropriate form of consent: whether the given action is within the reasonable expectations of the individual, and whether the action creates a meaningful residual risk of significant harm. In this case, the OPC concluded that opt-in consent was required because customers would not reasonably expect their data to be shared based on the context of its collection (an instore, offline purchase).
In light of the OPC’s decision, organizations that engage in online advertising should consider their data-sharing practices with a view to whether the reasonable expectations of the customer at the time of collection support the use of opt-out consent. In particular, a business should consider if its customers are being given timely notice of the company’s data sharing practices and a clear way to opt-out. In this case, Home Depot was required to switch to an opt-in form of consent, but that may not be required for all similar data sharing practices.
Where businesses determine that their data handling practices are outside the reasonable expectations of the individual, whether based on the circumstances of the collection of the information or another factor, businesses should consider whether clearer notice or an opt-in form of consent is appropriate.
Businesses should ensure that their privacy policies are sufficiently clear when describing how personal information will be used, and when and with whom it will be shared. Transparent messaging is important when relying on opt-out consent.
Where opt-out consent is relied on, businesses should:
To discuss these issues, please contact the author(s).
This publication is a general discussion of certain legal and related developments and should not be relied upon as legal advice. If you require legal advice, we would be pleased to discuss the issues in this publication with you, in the context of your particular circumstances.
For permission to republish this or any other publication, contact Janelle Weed.
© 2023 by Torys LLP.
All rights reserved.