Blog
Canadian Privacy Commissioner Announces OBA Activities Covered by Privacy Law
Blog
July 3, 2012
The Office of the Privacy Commissioner of Canada recently issued guidelines that state online behavioral advertising (“OBA”) activities are covered by Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”), and thus these activities require user consent. Consent in Canada, however, can be of the opt-out variety if informed notice is provided (similar to the system in the US). The Commissioner developed a Framework for creating an acceptable opt-out process, which process must meet six basic conditions. These conditions are more stringent in some respects than the US’s self-regulatory approach. These conditions are: (1) individuals must be made aware of the purposes for the practice in a clear and understandable way; (2) individuals need to be informed of a company’s OBA practices at or before the time of collection, and provided with information about the various third parties that might be involved; (3) individuals must be able to easily opt-out of the practice – ideally at or before the time that information is collected; (4) the opt-out must be effective immediately and persistent; (5) only non-sensitive information can be collected and used, to the extent practicable; and (6) the information must be destroyed as soon as possible, or effectively de-identified. The Commissioner further stated that forms of tracking that cannot be blocked or prevented (such as “zombie cookies” or third-party cookies that appear to be first-party cookies) should not be used for OBA purposes, and that the industry should avoid knowingly tracking children, or websites aimed at children.
Tip: Companies that follow the US’s self-regulatory approach to OBA –notice and choice- should be most of the way towards compliance with Canadian requirements under PIPEDA. Companies that engage in OBA and are subject to Canadian regulation should, however, keep in mind that Canada has its own requirements for OBA. These include notifying individuals of third parties involved, and destroying or de-identifying information as soon as possible.
This entry has been created for information and planning purposes. It is not intended to be, nor should it be substituted for, legal advice, which turns on specific facts.