Submission to the OPC’s Consultation on Consent under PIPEDA (ACA and CMDC)

Association of Canadian Advertisers (ACA) and the Canadian Media Directors’ Council (CMDC)

October 2016

Note: This submission was contributed by the author to the Office of the Privacy Commissioner of Canada’s Consultation on Consent under PIPEDA.

Disclaimer: The opinions expressed in this document are those of the author(s) and do not necessarily reflect those of the Office of the Privacy Commissioner of Canada.

---

Summary

Thank you to the Policy and Research Group of the Office of the Privacy Commissioner of Canada for opening a dialogue on the current consent model and allowing submissions for input. The Association of Canadian Advertisers (ACA) and the Canadian Media Directors’ Council (CMDC) has read and understood the Office of the Privacy Commissioner’s Consultation Procedures and should be considered under category of advocacy group.^{Footnote 1}

The ACA and CMDC do not consider statutory changes to be necessary, and note that PIPEDA was amended in June 2015 to clarify the requirement for individual consent to the collection, use and disclosure of their personal information. Further, we submit that the inherent balancing between the right of privacy of individuals and the needs of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances is best served through a combination of the potential solutions put forth in the Consent Discussion Paper.

Approaches to consent that emphasize increased transparency, de-identification of personal information should be viewed as furthering the purposes of PIPEDA. This includes a realistic approach to identifying whether there is a serious possibility that de-identified data could be used to identify an individual, rather than an approach based on speculation or conjecture, and regulatory guidance on ‘no-go’ and ‘proceed with caution’ zones

Conversely, overly broad interpretations of what constitutes personal information or an overly expansive application of the requirement for consent have the potential to undermine the ability for individuals to protect their privacy and for organizations to collect information. These circumstances may lead to adverse outcomes where individuals are overwhelmed by, and as a result disregard, privacy notices. Further, such approaches also have the potential to undermine the efforts of marketers to combat advertising fraud, particularly when applied to de-identified or non-identifiable information. Our concern is that this situation could lead to greater incentives on the part of entities committing fraud to violate individual privacy in an effort to evade detection by marketers.

Lastly, the ACA and CMDC believe that the goals of PIPEDA are complemented by a strong self-governance model in which industry groups and individual organizations disclose their practices to individuals in a clear and understandable manner. In particular, industry groups and third parties that establish codes of practice for organizations that choose to participate in them play a particularly valuable role in establishing and popularizing recognized industry practices. This contributes to the ability of individuals to understand the manner in which their information may be collected, used and disclosed, as it helps to align the practices of the organizations participating in the code, and thus reduces the need for individuals to try to understand numerous variously drafted privacy policies – thus contributing to the transparency and understandability of privacy practices.

Thank you again for the opportunity to submit to this important policy exploration. We are available to clarify or discuss our submission with you and look forward to participating in any consultation process. We wish you well in your deliberations.

The full submission is available in the following language(s):

English (PDF document)

Note: As this submission was provided by an entity not subject to the Official Languages Act, the full document is only available in the language provided.