In a previous post on online behavioural advertising (OBA), we wrote about the Office of the Privacy Commissioner's "call to action" to stakeholders in the advertising industry on OBA, and we discussed the industry's response to that call: self-regulation.

2012 – Call to Action: the Privacy Commissioner's Expectations

In its 2012 Policy Position on Online Behavioural Advertising, the Office of the Privacy Commissioner (OPC) stated that it "may" be acceptable to rely on implied or opt-out consent when tracking and targeting individuals for OBA purposes, "provided that":

  • Individuals are made aware of the purposes for the practice in a manner that is clear and understandable – the purposes must be made obvious and cannot be buried in a privacy policy. Organizations should be transparent about their practices and consider how to effectively inform individuals of their OBA practices, by using a variety of communication methods, such as online banners, layered approaches, and interactive tools;
  • Individuals are informed of these purposes at or before the time of collection and provided with information about the various parties involved in OBA;
  • Individuals are able to easily opt-out of the practice – ideally at or before the time the information is collected;
  • The opt-out takes effect immediately and is persistent;
  • The information collected and used is limited, to the extent practicable, to non-sensitive information (avoiding sensitive information such as medical or health information); and
  • Information collected and used is destroyed as soon as possible or effectively de-identified.

2013 – Industry Response: Self-Regulation

In response, the industry developed and launched the Canadian Self-Regulatory Program for Online Behavioural Advertising (the "Ad Choices program"), an initiative tailored to meet the requirements of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), as well as the OPC guidelines. The initiative is led by the Digital Digital Advertising Alliance of Canada (DAAC), and is monitored and administered by the non-profit industry body Advertising Standards Canada (ASC). A growing number of brands and media companies have registered for the program.

We noted in our previous post that the OPC would no doubt be watching to see whether and how industry self-regulation meets its expectations under PIPEDA and its OBA guidelines. We also noted, however, that the self-regulatory solution was not designed to cover all OBA activities. For example, certain types of activities are expressly excluded from the Ad Choices program, such as "online advertising of entities within a web site they own or control" and "contextual advertising", including ads based on the content of a web page being visited, a consumer's current visit to a web page, and a search query.

Ongoing OPC Guidelines, Investigations and "Sweeps"

The OPC is not staying on the sidelines – it continues to take a keen interest in OBA and online consent more broadly. For example, in January 2014, the OPC found that Google ads triggered by web surfing on health sites violated privacy rights. As a result, Google committed to several measures, including closer monitoring of potential violations by advertisers. In May 2014, the federal, British Columbia and Alberta Privacy Commissioners issued new guidelines for online consent, calling for transparent and dynamic privacy notices, and greater protections for personal information belonging to children and youth.

In 2015, the OPC is investigating websites visited by Canadians for compliance with OBA requirements.

The OPC has in past years conducted investigation and enforcement "sweeps". In 2013, the OPC led and participated in the first annual Global Privacy Enforcement Network (GPEN) Internet Privacy Sweep. The sweep targeted privacy policies, and the OPC published the initial results of its investigations under the headings "The Good, the Bad, and the Ugly". In 2014, the OPC again participated in the GPEN Sweep, investigating the transparency of privacy practices for 151 mobile apps that were made in Canada or frequently downloaded by Canadians. The Results of the 2014 Global Privacy Enforcement Network Sweep are an overall, anonymous mobile app "report card", ranking transparency to users, ease of access/reading on the small screen, and whether privacy information is available before download.

An OPC "report card" on OBA is expected to be released sometime in the Spring.

In the news: see the recent Globe & Mail article "Watchdog to study 'privacy compliance' among Canadian advertisers"

For more information, visit our Privacy and Data Security blog at www.datagovernancelaw.com

About Dentons

Dentons is a global firm driven to provide you with the competitive edge in an increasingly complex and interconnected marketplace. We were formed by the March 2013 combination of international law firm Salans LLP, Canadian law firm Fraser Milner Casgrain LLP (FMC) and international law firm SNR Denton.

Dentons is built on the solid foundations of three highly regarded law firms. Each built its outstanding reputation and valued clientele by responding to the local, regional and national needs of a broad spectrum of clients of all sizes – individuals; entrepreneurs; small businesses and start-ups; local, regional and national governments and government agencies; and mid-sized and larger private and public corporations, including international and global entities.

Now clients benefit from more than 2,500 lawyers and professionals in 79 locations in 52 countries across Africa, Asia Pacific, Canada, Central Asia, Europe, the Middle East, Russia and the CIS, the UK and the US who are committed to challenging the status quo to offer creative, actionable business and legal solutions.

Learn more at www.dentons.com

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances. Specific Questions relating to this article should be addressed directly to the author.