Statement: Remarks by Privacy Commissioner of Canada regarding investigation of Tim Hortons
June 1, 2022
Privacy Commissioner of Canada Daniel Therrien made the following statement during a press conference.
(Check against delivery)
Our joint investigation tells yet another troubling story of a company that failed to ensure proper design of an intrusive technology, resulting in a mass invasion of Canadians’ privacy. It also highlights the very real risks related to location data and the tracking of individuals.
Tim Hortons launched an app that tracked and recorded users’ movements every few minutes of every day, even when their app was not open. It says it never used this data for its intended purpose of marketing to individuals, only to analyze general consumer trends. Indeed, this is what the evidence demonstrates.
Yet the organization continually collected location data wherever its customers went. Tim Hortons failed to demonstrate it had adopted an appropriate privacy management program, and associated risk assessments. For instance, it did not adopt appropriate contractual measures to prevent its U.S. service provider from using this sensitive data for its own purposes.
Geolocation data is incredibly sensitive because it paints such a detailed and revealing picture of our lives.
Surveillance of our everyday movements reveals where we live and where we work. It can reveal information about our health (from visits to a medical clinic) and our religious beliefs (from the time we spend in places of worship). It can be used to make deductions about sexual preferences, social political affiliations and much more.
The risks related to the collection and use of location information remain high, even when “de-identified,” as it can often be re-identified with relative ease. At least one expert has suggested that only DNA is harder to anonymize.
The location tracking ecosystem – where intimate details of our daily lives are treated as a commodity to be exploited to sell us products and service … such as a cup of coffee – heightens the risk of mass surveillance.
We have seen here an absolute lack of proportion between the continual tracking of customers’ location, their habits and other sensitive information this reveals about them, and a company’s desire to sell more products.
As a society, we would not accept it if the government wanted to track our movements every few minutes of every day. It is equally unacceptable that private companies think so little of our privacy and freedom that they can initiate these activities without giving it more than a moment’s thought.
In my view, what happened here once again makes plain the urgent need for stronger privacy laws to protect the rights and values of Canadians.
Related content:
- Date modified: