The Office of the Privacy Commissioner and Behavioural Advertising

In December 2012, the Office of the Privacy Commissioner (OPC) announced a new guideline on behavioural advertising. The guideline provides that: (i) online tracking and behavioural advertising constitute the collection of personal information; and (ii) you need informed consent to make such collections. While neither of these positions is surprising under the Personal Information Protection and Electronic Documents Act (PIPEDA), the new guideline sets out the commissioner's application of the Act to behavioural advertising.

In a speech following the announcement of the guideline, the privacy commissioner confirmed that an "opt-out" consent model is permissible for behavioural advertising, provided:

  • The purpose of the collection is clearly stated, at or before the time of collection;
  • The opt-out is easy, immediate and persistent; and
  • Any collection and use of personal information is limited, and when the purpose is achieved, the data is destroyed or anonymized.

The commissioner stressed that device fingerprinting is not permissible for behavioural advertising, as it occurs without knowledge or consent, but it may be permissible in other contexts where this concern does not arise.

The privacy commissioner also addressed tracking and behavioural advertising directed at children, stating that this was generally not permissible. The OPC will not adopt a bright-line test as to who is and is not a child, but it will look at the overall context of the collection and use of personal information and the minor's ability to provide informed consent. The commissioner criticized the practice of obtaining parental consent for tracking children, as PIPEDA focuses on individual consent rather than consent on behalf of another person, even one's own child.

The Canadian Radio-television and Telecommunications Commission (CRTC) and Canada's Anti-Spam Legislation (CASL)

In late 2012, a chief compliance officer with the CRTC confirmed that it is possible to continue to use existing contact lists following the coming into force of CASL, although messages sent after the Act comes into force would need to comply with the specified disclosure requirements.

While revised or final regulations under CASL have not been published, the commissioner appeared to indicate that the CRTC would retain the requirement to identify both the sender of the message and the person on whose behalf it was sent in the message. This requirement appeared in the initial draft of the CRTC Regulations, as CASL itself requires identification of only one of these persons. In discussing this, the commissioner specifically referenced the outsourcing of commercial e-mail communications to third-party e-mail distributors. Furthermore, the commissioner reiterated that the CRTC will expect marketers to contact third-party list providers to inform them when they receive an unsubscribe request. However, pending the final regulations, it may be possible to achieve this by structuring the unsubscribe mechanism to notify list providers directly without additional action from the marketer.

As of the date of writing, the CRTC has not provided an estimate on the coming-into-force date for CASL; however, it is expected to be in 2012. To prepare for this, the CRTC is currently assembling a 25-person enforcement team.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.