ARCHIVED - News Release
Tell consumers about online tracking practices, privacy report urges
Report of Privacy Commissioner's consultations highlights challenges posed by cloud computing and the online tracking, profiling and targeting of consumers by marketers and other businesses
TORONTO, May 6, 2011 – Organizations that track the online activities of Canadians must be more upfront about their practices, Privacy Commissioner Jennifer Stoddart concluded in the wake of a groundbreaking series of public consultations on the privacy impacts of new technologies and business practices.
“It comes down to meaningful consent, which entails informed consent,” Commissioner Stoddart noted today in releasing the final report of her Office’s consultations on the online tracking, profiling and targeting of consumers by marketers and other businesses. “Most people have no idea about the rich trail of data they leave behind when they browse the Internet, use social networking sites, or engage the geo-location functions of their mobile devices,” the Commissioner observed.
This information, however, is a gold mine for advertisers and other businesses. They can use it to build detailed profiles of their customers, infer their tastes and preferences, and then attempt to entice them with tailored online ads.
“Some consumer profiling and targeting may be done for perfectly legitimate reasons, but organizations must be clear and forthright about what they’re doing,” Commissioner Stoddart said.
The consultations explored technologies and business practices that could significantly challenge the privacy of consumers. Academics, advocates, industry associations, public-sector representatives and individuals were invited to address the privacy issues surrounding the online tracking, profiling and targeting of individuals, as well the widespread move toward cloud computing, especially among small and medium-sized enterprises.
“People and businesses are increasingly moving online,” Commissioner Stoddart noted. “They want and deserve to experience the many benefits of the digital age. But this should not come at the expense of privacy rights, including the appropriate collection, use, disclosure and retention of personal information.”
In addition to accepting written submissions for the consultations, the Office of the Privacy Commissioner (OPC) hosted public forums in Toronto, Montreal and Calgary in the spring of 2010. An interim report last October generated further input over the winter.
Stronger safeguards needed
Today’s final report on the consultations, launched at the IAPP Canada Privacy Symposium 2011, encourages industry to strengthen privacy protections. The online world is awash in data and there is a temptation to use that information for multiple purposes. Even so, organizations are urged to collect personal information only for reasonable and appropriate purposes, and with the consent of the affected individuals, and to restrict the use of the information to the stated purposes. Businesses are also urged to develop technical measures to prevent the indefinite storage of personal information.
During the consultations, concern was also expressed about the vulnerability of children online. Traditionally, the focus has been on protecting children from predators as they navigate the web. However, many experts now agree that safeguarding children’s personal information must be another priority.
The consultations also underscored the importance of improved digital literacy for business leaders, technology developers and users of all ages.
“When most adults don’t understand how technologies are eroding their privacy, we should be very concerned about how children are navigating this environment,” Commissioner Stoddart noted. “Children are going online at ever younger ages, and we must focus on teaching them the skills they need to make the right decisions.”
The consultations explored the privacy issues raised by the growing popularity of cloud computing, particularly among small and medium-sized enterprises. Cloud computing allows businesses to outsource certain computerized activities to third parties. These are often large companies with operations in multiple jurisdictions, and may have varying levels of technological security.
Based on issues raised during the consultations, the OPC’s consultations report called for the development of strong standards to ensure the security of personal information stored or processed on cloud servers.
The OPC plans to apply the knowledge developed through the consultations process to future research, outreach, public awareness activities, and policy development work, and to inform the next Parliamentary review of the Personal Information Protection and Electronic Documents Act, Canada's federal private-sector privacy law.
The Privacy Commissioner of Canada is mandated by Parliament to act as an ombudsman and guardian of privacy in Canada.
- 30 -
For more information, contact:
Office of the Privacy Commissioner of Canada
Tel: (613) 995-0103