Announcement

COVID-19 testing company stops sending marketing email to travellers arriving in Canada

August 4, 2022

A company that administered mandatory COVID-19 tests to travellers passing through the Montreal-Trudeau airport as part of a federal government program has stopped using the email addresses it collected to send unsolicited marketing material.

Biron Groupe Santé (Biron) became the subject of a complaint to the Office of the Privacy Commissioner of Canada (OPC) after a traveller forced to submit to testing received an email promoting the company’s other services that he did not consent to.

The OPC launched an investigation, during which Biron indicated that it stopped sending marketing email after receiving a number of direct complaints from travellers. The company explained that it initially felt it had established a business relationship with arriving passengers and thus relied on implied consent to send email ads. The company also confirmed it deleted the email addresses of more than 147,000 arriving travellers who were not already clients from its marketing database.

The OPC and the Commission d’accès à l’information du Québec (CAI) collaborated by sharing information over the course of the investigation.

As the company ceased the practice in question and took corrective measures to the satisfaction of all parties, including the complainant and both regulators, the matter was deemed settled during the course of investigation.

The case is an important reminder for all organizations that when seeking consent from individuals to use their personal information for secondary purposes, they must not only consider the sensitivity of the information collected and the reasonable expectations of the individual in the particular context, but also the specific circumstances surrounding the collection of personal information. Among other things, the Quebec law requires organizations wishing to use personal information for marketing purposes to give individuals a meaningful opportunity to opt out of having their personal information used in this way. In this case, the individuals obligated to submit to COVID-19 testing at the border did not expect the email addresses collected for that purpose to be subsequently used for marketing purposes.

The OPC has called for amendments to the federal private sector privacy law that would allow the imposition of financial penalties on companies in contravention of the Act – a provision that will be included under the Quebec law beginning in 2023. In June, the federal government tabled Bill C-27, which, if passed, would include such penalties.

See the case summary for more information.