Where sharing is unexpected or unobvious, consent needs to be explicitly obtained
On January 26, 2023, the Office of the Privacy Commissioner of Canada (OPC) released a report of findings following its investigation into Home Depot of Canada Inc.’s compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA). The OPC concluded that organizations can’t rely on implied consent obtained via a privacy policy for certain unexpected uses and disclosures of customer personal information, even where that information isn’t sensitive in nature.
The OPC’s investigation followed a complaint from a customer surprised to discover, upon a review of his Facebook account information, that Facebook had a record of many of his in-store purchases from Home Depot. In the course of the investigation, the retailer confirmed that when in-store customers chose to receive their receipt by email instead of or in addition to a paper receipt, it forwarded to Meta the customer’s hashed email address and in-store purchase details (for example, date and dollar amount of purchase, and general type of purchase) for analysis using Meta’s “Offline Conversions” tool. Meta would then match the hashed email address to determine if it had a Facebook account that corresponded to that email address. If the customer had a Facebook account, Meta would compare the customer’s offline purchase information to the retailer’s ads delivered to the customer by Meta to measure the effectiveness of those ads. If, for example, the customer had purchased goods in-store that had been previously advertised to the customer via Meta’s advertising tools, that would indicate the effectiveness of that particular ad. Meta would provide the results of that analysis back to the retailer in the form of an aggregated report, giving insight into the impact of its advertising on its customers’ ‘offline’ purchasing behavior. This report that was provided back to Home Depot would not identify any particular customers, but give broader insights into the general effectiveness of its online ads.
For more details please click here
