Alleged disclosure of personal information without consent for secondary marketing by a retail company
PIPEDA Case Summary #2002-81
[Principle 4.3, Schedule 1]
An individual complained that a retail company with a division that operates in the Yukon and the Northwest Territories fails to obtain consent for the collection, use, or disclosure of personal information for secondary marketing purposes.
Specifically, the complainant alleged that the company does not bring to the attention of its customers its practice of using and sharing customer data for secondary marketing purposes; it fails to provide clear information as to potential secondary uses and sharing of customer data; and it does not provide them with the opportunity to opt-out of such uses and disclosures. The complaint focussed on the credit card and rewards program offered by the company.
This is one of several similar complaints filed by the individual against a number of organizations. In brief, the complainant's position may be summarized as follows:
- With respect to secondary marketing purposes, it is always appropriate to ensure customers' knowledge and consent.
- Marketers and the marketed differ on the issue of what form of consent is appropriate.
- Companies should not only state purposes in a policy document, but also "bring to the attention" of the individual customer the practices in question and the option of withdrawing consent.
- Companies fall short of meeting this obligation in several ways:
- reliance on a document that has not been provided to the customer, but rather left up to the customer to find on his or her own initiative;
- reliance on fine print that has been buried in a long document;
- failure to use clear, plain language that is understandable to the ordinary customer;
- failure to provide customers with adequately detailed information about the extent and purpose of contemplated uses and sharing of their personal information; and
- failure to provide an easily executable opting-out procedure.
Summary of Investigation
The company has several divisions that operate across Canada. The company does not disclose personal information across borders for consideration. One of the company's divisions operates stores in the Yukon and Northwest Territories, and the investigation of the complaint concentrated on their activities.
The investigation revealed that the stores in question do not participate in the company's rewards program. Their involvement in the company's credit card program was in theory only and limited to forwarding applications to a central credit office. The stores would not have retained a copy of the applications and would not have performed any administrative function in regard to credit cards. The stores no longer offer this service.
Issued October 16, 2002
Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking, or business. The Act also applies to any federal work undertaking, or business that operates in the Yukon, Nunavut, or Northwest Territories. The Commissioner has jurisdiction over the stores that the company operates in the Yukon and Northwest Territories.
Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.
In the absence of evidence to the contrary the Commissioner concluded that the company's stores in northern Canada do not collect, use, or disclose customers' personal information in connection with the company's credit card or rewards program and there is no basis for finding that the company is not in compliance with Principle 4.3.
The Commissioner therefore concluded that the complaint was not well-founded.
Nevertheless, the Commissioner reminded the company that its operations in the rest of Canada will become subject to the Act, or to substantially similar provincial legislation as of January 1, 2004. He reminded the company that he found the complainant's expectations as outlined in the complaint to be reasonable and in keeping with the Act. He strongly recommended that the company take due account of the substance of the complaint and his related findings, when preparing to undertake its more extensive obligations.
- Date modified: