Menu
Log in
Log in


Privacy Commissioner finds Home Depot’s sharing of customer information with Meta violates PIPEDA

10 Mar 2023 12:53 PM | CAN-TECH Law (Administrator)

Where sharing is unexpected or unobvious, consent needs to be explicitly obtained

On January 26, 2023, the Office of the Privacy Commissioner of Canada (OPC) released a report of findings following its investigation into Home Depot of Canada Inc.’s compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA). The OPC concluded that organizations can’t rely on implied consent obtained via a privacy policy for certain unexpected uses and disclosures of customer personal information, even where that information isn’t sensitive in nature.

The OPC’s investigation followed a complaint from a customer surprised to discover, upon a review of his Facebook account information, that Facebook had a record of many of his in-store purchases from Home Depot. In the course of the investigation, the retailer confirmed that when in-store customers chose to receive their receipt by email instead of or in addition to a paper receipt, it forwarded to Meta the customer’s hashed email address and in-store purchase details (for example, date and dollar amount of purchase, and general type of purchase) for analysis using Meta’s “Offline Conversions” tool. Meta would then match the hashed email address to determine if it had a Facebook account that corresponded to that email address. If the customer had a Facebook account, Meta would compare the customer’s offline purchase information to the retailer’s ads delivered to the customer by Meta to measure the effectiveness of those ads. If, for example, the customer had purchased goods in-store that had been previously advertised to the customer via Meta’s advertising tools, that would indicate the effectiveness of that particular ad. Meta would provide the results of that analysis back to the retailer in the form of an aggregated report, giving insight into the impact of its advertising on its customers’ ‘offline’ purchasing behavior. This report that was provided back to Home Depot would not identify any particular customers, but give broader insights into the general effectiveness of its online ads.

For more details please click here

Author
Comment
 

  

Canadian Technology Law Association

1-189 Queen Street East

Toronto, ON M5A 1S2

contact@cantechlaw.ca

Copyright © 2024 The Canadian Technology Law Association, All rights reserved.