On January 22, 2020, Josephine Palumbo, the Deputy Commissioner of the Deceptive Marketing Practices Directorate at the Canadian Competition Bureau (the “Bureau”), spoke at the Canadian Institute’s 26th Annual Advertising and Marketing Law Conference. During her remarks, titled Honest Advertising in the Digital Age, Ms. Palumbo identified the Bureau’s current enforcement priorities as they relate to advertising and marketing in the digital economy. Among other things, these priorities include (a) influencer marketing; (b) fake online reviews; (c) dishonest information about data privacy; and (d) dishonest price claims.
To help businesses better understand how the Competition Act (the “Act”) applies to their online advertising and marketing practices, we are publishing a series of four blogs discussing the enforcement priorities identified above. In particular, each of the blogs will describe the conduct in question, identify the provisions of the Act applicable to the conduct in question and provide some general guidance on what businesses can do to help ensure that their advertising and marketing practices comply with the Act. This is the third blog, which deals with dishonest information about data privacy.
Data Privacy and the Role of the Bureau
Data privacy is concerned with the collection, use, disclosure and maintenance of personal data. Specifically, it is concerned with ensuring that (a) individuals have control over their own personal data and (b) informed consent is obtained before businesses collect and use that personal data.
As identified by the Bureau in its 2018 report, Big data and innovation: key themes for competition policy in Canada, there is a danger that false or misleading privacy policies may lead consumers to consent to the collection and use of their data in ways that they would not have otherwise consented to if properly informed. These types of concerns fall squarely within Bureau’s mandate to ensure truth in advertising and protect consumers.
Josephine Palumbo affirmed the Bureau’s commitment to data privacy in her recent remarks, stating (a) that “[t]he collection of data is an area where the principles of deceptive marketing are especially relevant”; (b) that “the era of Big Data means [the Bureau] will need to devote more attention to false claims that mislead consumers into giving away their personal data”; and (c) that “when firms make false or misleading statements about the type of data they collect, why they collect it, and how they will use, maintain and erase it, [the Bureau] will take action”. In fact, the Bureau is already taking action in the area. For example, earlier this year it was reported that the Bureau was investigating an allegation that the federal Liberal, Conservative and New Democrat parties had made deceptive statements to the public through their respective privacy policies.
Both privacy and competition laws have a role to play when it comes to data privacy and the use of privacy policies.
Federal and provincial privacy laws, including PIPEDA, set out the privacy obligations that businesses must adhere to when they collect, use or disclose personal information in the course of their commercial activities. Businesses that collect personal information must be aware of and comply with their obligations under this legislation. Failure to do so could result in significant fines.
Privacy policies may also raise concerns under the false or misleading representations provisions of the Act. In summary, these provisions prohibit a business from making a representation to the public, in any form whatever, that is false or misleading in a material respect. Representations regarding how a business will treat an individual’s personal data will almost certainly be considered material.
Fundamentally, companies are putting themselves at risk when they collect information that consumers would not expect to be collected in the normal course of business and only disclose this material information in terms and conditions that are likely to be overlooked by consumers. Consumers form a general impression about the type of data being collected and how their data will be used; companies should ensure that such general impression corresponds with the data being collected and how the data are, in fact, used. The collection and use of data that go beyond what consumers would reasonably expect increases the likelihood of deception.
The 2017 Big Data Paper also includes the following examples of situations that could lead to privacy policies being considered false or misleading:
- Collecting data that is not linked to the functionality of the good or service being used
For example, as considered in a recent complaint investigated by the U.S. Federal Trade Commission (the “FTC”), a simple flashlight app may be collecting personal location data in order to sell it to third-party organizations. As the collection of location data has no connection to the operation of the mobile app, consumers may not be aware that they need to take steps to protect their personal information.
- Misleading public representations that do not accord with the actual functionality of the product or service
For example, the FTC has recently taken action against Snapchat regarding numerous inconsistencies between the company’s representations regarding data privacy and the actual functionality of the Snapchat app. These inconsistencies include the app’s marketing, which highlights the idea that “snaps” would disappear forever after expiring, despite the fact that there were many ways in which third-parties could save or access these snaps after expiry.
Best Practices for Business
While by no means exhaustive, the following guidelines will help businesses avoid making false or misleading representations regarding their data practices:
- Ensure privacy policies comply with all applicable requirements under PIPEDA and other privacy legislation.
- Ensure privacy policies are accessible and use clear language (consider the Ontario Privacy Commissioner’s tips for better online privacy policies).
- Ensure that any marketing or public representations regarding the use or functionality of a product or service do not misrepresent the actual functionality of the product or service, or the company’s data privacy practices.
The information and guidance provided in this blog post does not constitute legal advice and should not be relied on as such. If legal advice is required, please contact a member Fasken’s Antitrust/Competition Marketing group.