Streamline Drug Testing Consent Agreements in Canada with Online Signature Licitness

How to eSign a document: online signature licitness for Drug Testing Consent Agreement in Canada

hi my name is David Fraser I'm a privacy internet and Technology lawyer with the Canadian law firm McGinnis Cooper I also teach internet and media law at the Sherlock School of Law at Dalhousie University earlier this year the office of the Privacy Commissioner of Canada released a report of findings requiring companies using targeted advertising and offline conversion tracking to revisit and re-examine their privacy practices but I think the lessons to be learned go beyond the realm of advertising in what's called offline conversion tracking but I think the lessons to be learned go beyond the realm of advertising in what's called offline conversion tracking really what is consent under Canada's Federal Privacy Law does it have anything to do with what's in your privacy policy so the office of the Privacy Commissioner of Canada launched its investigation of a major retailer after receiving a complaint from a customer surprised to discover upon a review of his meta platforms Inc formerly Facebook account information that meta had a record of many of his in-store purchases from a well-known retailer the retailer confirmed that when in-store customers chose to receive an emailed receipt instead of a paper receipt it forwarded to meta the customer's hashed email address and in-store purchase information for example date and dollar amount to purchase and general type of purchase such as Lumber or hardware and it did that using meta's offline conversions tool meta on its end would then match the hashed email to the customer's Facebook account if it existed so if they had a Facebook account meta would compare the customer's offline purchase information to the Retailer's ads delivered to the customer by meta to measure the effectiveness of those ads now the email address was hashed so that only when a match was made the data could be analyzed if you'd used an email address that was not associated with the Facebook account nothing happened to the data it was just deleted essentially the ad platform would know what ads it had shown to logged in users with that email address and purchase information the company could correlate whether the person with that email address had been shown any ads by that Advertiser meta would provide the results of that analysis back to the retailer in the form of an aggregated report giving insight into the impact of its advertising on its customers offline purchasing Behavior meta would also use the customer's information for its own business purposes including further targeted advertising this last point is important because if the recipient of the information is going to use it for their own purposes it's no longer a transfer for processing but a full disclosure of personal information under the legislation so following its investigation into Home Depot of Canada inc's compliance with the personal information protection and electronic documents act also known as pipita the OPC decided that organizations can't rely on implied consent obtained via privacy policy for uses and disclosures of customer personal information like this now that finding is even where the information isn't that sensitive in nature so what does this tell us about consent under pipita more generally well so let's look at what the statute says the main points of consent are in principle 3 taken from the Canadian standards Association model code for the protection of personal information it says the knowledge and consent of the individual are required for the collection use or disclosure of personal information except we're inappropriate now the except we're inappropriate part can be completely ignored because the only exceptions to the consent principle are set out in section 7 of pipita and aren't applicable here this General principle is elaborated upon in some of the sub principles for example 4.3.2 says knowledge and consent organizations shall make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used to make consent meaningful the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed some principal 4.3.5 then says in obtaining consent the reasonable expectations of the individual are also relevant section 6.1 of pipita which was added in 2015 elaborates Upon This by creating additional requirements for what is called valid consent it says for the purposes of clause 4.3 of schedule 1 the consent of an individual is only valid if it is reasonable to expect that an individual to whom the organization's activities are directed would understand the nature purpose and consequences of the collection user disclosure of the personal information to which they are consenting let's take a step back and think about this you need consent and you need it to be valid is it reasonable to expect that an individual particularly at the physical point of sale in a retail establishment has read the company's privacy policy yeah no it really isn't and that's not even taking into account whether the privacy policy or privacy statement clearly explains the nature purposes and consequences of the collection use and disclosure personal information in this case the commissioner found that any references to this sort of use were really unclear in the Privacy policies or privacy statements so put yourself in the shoes of someone at the checkout having just paid for their Hardware I've been in that exact position would you like your receipt emailed to you why that's great I lose my paper receipts within minutes so what a convenience if you were to ask the typical customer about what is going to happen to their email address they would say it's going to be used to send them the receipt just like it says just like they were asked at that moment would the person expect that their email address is also going to be used to track advertising effectiveness they would say probably not and the point of sale interface didn't say anything about this practice all the customer would expect is that the email address would be used to send them a receipt that's the reasonable expectation of the customer and by entering their email address they've consented implicitly to the collection and use of their personal information namely their email address for that single purpose namely to send them the receipt at this particular retailer they seem to save the email address likely associated with the hashed version of the payment card information to associate a customer with an email address this is at least in my experience since I didn't have to re-enter my email address at checkout when I've opted for a receipt on later purchases now that didn't seem weird to me as a customer but that may seem unexpected to some and I would note I've never gotten unsolicited emails from the company so I don't think they're using the email addresses to send commercial electronic messages but setting the X expectation of the customer's key along with clearly communicating in the moment how that information is to be used at least for pipita that's the requirement you can't look to your privacy policy to set those expectations unless the customer has just been presented with the policy and has understood it so that's a pretty clear takeaway from this privacy Commission report of findings unfortunately this is going to get a little bit more confusing under the proposed consumer privacy protection act bill c27 is currently sitting before the Parliament and it sets out additional requirements for valid consent and you'll note that many of these things can't really be done at a physical point of sale or at least would be difficult some of these things are really best left to a privacy policy it does say you have to advise the individuals the purposes as does pipita you have to tell them the manner in which personal information is collected user disclosed now that's probably pretty obvious at a store checkout the same as paragraph D since you will be providing the specific type of information at that exact moment and I'm not sure exactly what they're getting at when they say the consequences in paragraph C but we'll see how that plays out and then you have to provide the names of third parties to whom the information may be disclosed pursuant to paragraph d it may be that this framework relies on the fact that the new bill permits a lot of collection use and disclosure without consent for reasonable business purposes so a lot of day-to-day personal information handling will be covered under that provision so section 15 sub 3 is left to those circumstances that doesn't fit within a consent waiver we'll see so what's the main takeaway from this finding at least of General application first an organization simply cannot rely on their privacy policy as the foundation for consent in Canada the purposes have to be communicated to the individual at the time the information is collected second you really have to put yourself in the shoes of the typical customer and think about what would be their reasonable expectation as to how their information is proposed to be used if it's outside their expectations you really have to make sure they're aware of it for consent to be valid and once the cppa is passed that will get harder there's a reason why Home Depot just put an end to the practice during the course of the investigation since trying to explain offline conversion tracking on a little screen is likely not feasible I hope this has been interesting and useful if you've hung around to the end of this you're clearly interested in this sort of stuff and you should subscribe I try to put out a new video every few weeks so the algorithm will hopefully keep them coming for you and give it a like so that more privacy nerds will see it also leave a comment if you have any questions or if you have any suggestions for other topics to cover and of course feel free to share this with anyone who you think may be interested in hearing about Canadian Tech and Privacy Law thanks for tuning in