Privacy Commissioner Releases New Online Behavioural Advertising Guidelines
The Privacy Commissioner of Canada recently released new guidelines to assist organizations involved in online behavioural advertising (OBA) ensure that their practices are transparent and comply with the federal private sector privacy legislation. The guidelines are attention-span friendly, weighing in at three pages, with few surprises and largely high-level takeaways.
The guidelines accept that OBA may be "considered a reasonable purpose under the Personal Information Protection and Electronic Documents Act (PIPEDA)," provided it is done within certain "parameters", namely:
- Information collected for OBA is likely personal information: as a default position, the Privacy Commissioner takes the view that information collected for OBA will "generally constitute personal information" under PIPEDA - i.e., advertisers using OBA must be compliant with PIPEDA's knowledge and consent requirements.
- To meet PIPEDA's knowledge requirements: advertisers using OBA, should (1) have an OBA policy, and (2) make it "accessible, easy-to-read, and accurate."
- To be compliant with PIPEDA's consent requirements: it is possible for advertisers to use "opt-out" consent, but individuals must be made aware that information is being collected for OBA before it is collected, and it must be easy to opt-out.
In addition, the guidelines specifically set out that children should not be subject to OBA (as they do not have the capacity to consent), and websites targeting children should accordingly avoid tracking.
Following the release of the OBA guidelines, the Privacy Commissioner, Jennifer Stoddart, brought her message and the guidelines to the Huffington Post. With the holiday season headed into full swing, the Commissioner took the opportunity to alert Canadians to the existence of OBA. The article explains the nature of OBA and provides a summary of the guidelines. More interestingly, to close the article on a fitting note for the holiday season, the Commissioner assures readers that the Office of the Privacy Commissioner will be watching online advertisers in the months to come with enforcement at the ready (i.e., the Commissioner is saying, in effect, the Office will know if advertisers have been bad or good, so they better follow the guidance for goodness sake).
For more information on OBA, including examples and links to detailed best practices, see our previous posts:
advertisers guidelines online behavioural advertising organizations personal information Personal Information Protection and Electronic Documents Act privacy Privacy Commissioner