This item was written by my colleague Anita Banicevic
While most consumers know that their clicks and “likes” leave a digital trail, the rise of the digital economy has led to a spike in the volume and types of data being created and collected. If data is “the new oil,” it’s no surprise that regulators around the globe are wrestling with tough questions regarding appropriate limits on the collection and use of data and “big data.” One of the most pressing questions is how to encourage innovation in the digital sector while adequately protecting consumers’ privacy rights.
In Canada, the Office of the Privacy Commissioner (OPC) is designated to deal with privacy-related issues; however, the Competition Bureau, which oversees competition concerns, including misleading advertising, now appears to have its sights set on privacy-related enforcement. While the prospect of additional privacy-related enforcement may sound appealing to some, having yet another regulator wade into an evolving area could cause significant uncertainty for companies doing business in Canada.
The Bureau’s Big Data Paper
In September, the Competition Bureau released a draft discussion paper titled “Big Data and Innovation: Implications for Competition Policy in Canada.” The paper provides the Bureau’s initial views on how it will approach data-related considerations in a number of areas. From a privacy perspective, it appears the Bureau may be seeking to apply the misleading advertising provisions of the Competition Act to privacy-related statements. The Bureau notes that while it has historically tackled misleading advertising where “consumers were misled into purchasing a product or service,” the “era of big data may warrant devoting greater attention to representations that mislead consumers into giving away their information.”
The Bureau provides two examples of instances in which it could view privacy-related statements as “misleading advertising”: the first focuses on misleading statements regarding the collection or use of data; the second on inadequate disclosure regarding the use or collection of data.
In the first category, the Bureau uses the example of the enforcement taken by the U.S. Federal Trade Commission (FTC) against Snapchat for assuring customers that “snaps” would disappear forever when, in fact, recipients could take steps to save snaps indefinitely. In the second category, the Bureau refers to an FTC enforcement action against the makers of a free flashlight app that transmitted consumers’ location data to third-party advertising networks without adequate disclosure.
The Bureau states that “companies are putting themselves at risk when they collect information that consumers would not expect to be collected in the normal course of business and only disclose this material information in terms and conditions that are likely to be overlooked by consumers.”
Potential for Overlap
The suggestion that the Bureau could undertake enforcement in this area is somewhat surprising for a few reasons. First, and as noted by the OPC in its comments on the Bureau’s paper, the collection of personal information without consent is already within the OPC’s mandate under Canada’s federal privacy sector legislation (Personal Information Protection and Electronic Documents Act). That is, there is already a specialized regulator in place – namely, the OPC – with this same mandate. Furthermore, the OPC has been engaged in an extensive consultation and review of Canada’s privacy legislation and has already undertaken to update its compliance-related guidance to Canadian businesses. Additionally, the long-standing approach of the Bureau in areas of potential overlap has been that if another regulator has either a specific mandate or area of expertise and is active in the space, the Bureau will defer to this specific expertise.
What This Might Mean for Canadian Companies
From a business perspective, the Bureau’s statements raise a number of questions. For instance, will companies face investigations and possible enforcement from both the OPC and the Bureau? Will the Bureau take the same view as the OPC on what constitutes sufficient disclosure or consent? Perhaps more fundamentally, is the additional threat of significant penalties and possible class actions really necessary?
If the Bureau has concerns about the nature of statements being made regarding data collection and use, perhaps a broader consultation among stakeholders (including businesses and the OPC) might be informative and reduce uncertainty for businesses.
The Bureau has said it plans to release an updated summary of its position once it has had the opportunity to consider stakeholder feedback. However, whether the Bureau will change its course on privacy-related enforcement remains an open area of concern. In the meantime, the potential for the Bureau to demand significant penalties for inadequate or misleading data-related disclosures means that companies should carefully evaluate any public statements regarding the collection or use of data.
An earlier version of this item appeared in the Globe & Mail newspaper
________________________
To make sure you do not miss out on regular updates from the Kluwer Competition Law Blog, please subscribe here.
