2 Personal Data Processed by Electronic Means
Canada has no separate data protection laws to cover the protection of personal data
in the online context, nor is there a discrete part of PIPEDA that applies to online
activities. Nevertheless, because online activities generally cross provincial or
national boundaries, PIPEDA would apply to internet-based commercial activity.
There is a growing body of Commissioner Findings that relate to online activities,
28
as well as some case law.
29 The Office of the Privacy Commissioner of Canada
(OPC) takes the view that many “free” internet services such as those provided by
social networking platforms are engaged in commercial activity.
30
When PIPEDA took effect in 2001 it did not specifically anticipate digital
developments beyond the very early days of electronic commerce. The OPC has
issued a considerable number of guidance documents aimed at assisting organizations in complying with their obligations in the digital and mobile contexts. For
example, it has provided guidance on good privacy practices for developing mobile
apps,
31 and on ways to communicate privacy practices to app users.
32 It has also
produced guidelines on online behavioural advertising.
33 More recently, the OPC
has been developing new approaches to consent. This process began with a discussion paper,
34 a public consultation, and the issuing of a report on consent.
35 The
report has led to the development of Guidelines for Obtaining Meaningful Consent.
36 The Guidelines, which are jointly developed with the Privacy Commissioners
of British Columbia and Alberta, took effect on January 1, 2019.
Although the Guidelines for Obtaining Meaningful Consent are meant to apply to
all contexts in which consent is required, they also address online consent. For
example, to avoid detail being buried in privacy policies that are never accessed by
users, the guidelines specify that for consent to be meaningful, an “organization must
28 See, e.g. PIPEDA Report of Findings #2018-002, “Company’s re-use of millions of Canadian
Facebook user profiles violated privacy law”, https://www.priv.gc.ca/en/opc-actions-and-decisions/
investigations/investigations-into-businesses/2018/pipeda-2018-002/; PIPEDA Report of Findings
#2012-001, “Social networking site for youth, Nexopia, breached Canadian privacy law”, https://
www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2012/
pipeda-2012-001/; PIPEDA Report of Findings #2018-002, “Company’s re-use of millions of
Canadian Facebook user profiles violated privacy law”, available at: https://www.priv.gc.ca/en/
opc-actions-and-decisions/investigations/investigations-into-businesses/2018/pipeda-2018-002/.
29 See, e.g. A.T. v. Globe24h.com, 2017 FC 114.
30 See, e.g. PIPEDA Report of Findings #2018-002, at para 12.
31 Privacy Commissioner of Canada (2012) Seizing Opportunity.
32 Privacy Commissioner of Canada (2014) Ten Tips for Communicating Privacy Practices to Your
App’s Users.
33 Privacy Commissioner of Canada (2011) Guidelines on Privacy and Online Behavioural
Advertising.
34 Privacy Commissioner of Canada (2016) Consent and Privacy.
35 Privacy Commissioner of Canada (2017) 2016-2017 Annual Report, Report on Consent.
36 Privacy Commissioner of Canada (2018c) Guidelines for obtaining meaningful consent.
60
T. Scassa
Canada has no separate data protection laws to cover the protection of personal data
in the online context, nor is there a discrete part of PIPEDA that applies to online
activities. Nevertheless, because online activities generally cross provincial or
national boundaries, PIPEDA would apply to internet-based commercial activity.
There is a growing body of Commissioner Findings that relate to online activities,
28
as well as some case law.
29 The Office of the Privacy Commissioner of Canada
(OPC) takes the view that many “free” internet services such as those provided by
social networking platforms are engaged in commercial activity.
30
When PIPEDA took effect in 2001 it did not specifically anticipate digital
developments beyond the very early days of electronic commerce. The OPC has
issued a considerable number of guidance documents aimed at assisting organizations in complying with their obligations in the digital and mobile contexts. For
example, it has provided guidance on good privacy practices for developing mobile
apps,
31 and on ways to communicate privacy practices to app users.
32 It has also
produced guidelines on online behavioural advertising.
33 More recently, the OPC
has been developing new approaches to consent. This process began with a discussion paper,
34 a public consultation, and the issuing of a report on consent.
35 The
report has led to the development of Guidelines for Obtaining Meaningful Consent.
36 The Guidelines, which are jointly developed with the Privacy Commissioners
of British Columbia and Alberta, took effect on January 1, 2019.
Although the Guidelines for Obtaining Meaningful Consent are meant to apply to
all contexts in which consent is required, they also address online consent. For
example, to avoid detail being buried in privacy policies that are never accessed by
users, the guidelines specify that for consent to be meaningful, an “organization must
28 See, e.g. PIPEDA Report of Findings #2018-002, “Company’s re-use of millions of Canadian
Facebook user profiles violated privacy law”, https://www.priv.gc.ca/en/opc-actions-and-decisions/
investigations/investigations-into-businesses/2018/pipeda-2018-002/; PIPEDA Report of Findings
#2012-001, “Social networking site for youth, Nexopia, breached Canadian privacy law”, https://
www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2012/
pipeda-2012-001/; PIPEDA Report of Findings #2018-002, “Company’s re-use of millions of
Canadian Facebook user profiles violated privacy law”, available at: https://www.priv.gc.ca/en/
opc-actions-and-decisions/investigations/investigations-into-businesses/2018/pipeda-2018-002/.
29 See, e.g. A.T. v. Globe24h.com, 2017 FC 114.
30 See, e.g. PIPEDA Report of Findings #2018-002, at para 12.
31 Privacy Commissioner of Canada (2012) Seizing Opportunity.
32 Privacy Commissioner of Canada (2014) Ten Tips for Communicating Privacy Practices to Your
App’s Users.
33 Privacy Commissioner of Canada (2011) Guidelines on Privacy and Online Behavioural
Advertising.
34 Privacy Commissioner of Canada (2016) Consent and Privacy.
35 Privacy Commissioner of Canada (2017) 2016-2017 Annual Report, Report on Consent.
36 Privacy Commissioner of Canada (2018c) Guidelines for obtaining meaningful consent.
60
T. Scassa