allow individuals to quickly review key elements impacting their privacy decisions
right up front as they are considering using the service or product on offer, making
the purchase, or downloading the app, etc.”
37 The Guidelines also state that information must be provided in “manageable and easily-accessible ways” that give users
some control over the flow of information to them. The Guidelines encourage
organizations to “be innovative and creative”
38 in providing notice of collection
and in obtaining consent, and suggest using just-in-time notification, interactive
tools, and customized mobile interfaces.
39 User-friendly interfaces must be designed
with the audience for the particular product or service in mind,
40 and consent should
also be part of a “dynamic and ongoing process”.
41 In particular, the Guidelines
suggest that organizations find ways to periodically remind users about key elements
of their privacy policy.
2.1 Children’s Privacy
Neither PIPEDA nor any of the three substantially similar provincial private sector
data protection laws specifically addresses the privacy rights of minors. The OPC has
provided specific guidance for businesses that collect information from children and
youth.
42 In its 2017 report on consent it expressed the view that: “in all but
exceptional cases, consent for the collection, use and disclosure of personal information of children under the age of 13, must be obtained from their parents or
guardians”.
43 For minors over the age of 13, the OPC requires organizations to take
level of maturity into account in developing consent processes. This position is
reflected in the new Guidelines on Consent. The issue of children and consent was
discussed in the 2018 report of a Parliamentary committee that studied PIPEDA
reform. The ETHI committee recommended that the government “consider
implementing specific rules of consent for minors, as well as regulations governing
the collection, use and disclosure of minors’ personal information”.
44
37 Privacy Commissioner of Canada (2018c) Guidelines for obtaining meaningful consent, Clause
1. Additional emphasis on four key elements is prescribed. These elements are: what personal
information is collected, with whom the information will be shared, for what purposes the
information is collected, used or disclosed, and the risks of harm or other consequences from
sharing personal information.
38 Privacy Commissioner of Canada (2018c) Guidelines for obtaining meaningful consent, Clause 4.
39 Privacy Commissioner of Canada (2018c) Guidelines for obtaining meaningful consent, Clause 4.
40 Privacy Commissioner of Canada (2018c) Guidelines for obtaining meaningful consent, Clause 5.
41 Privacy Commissioner of Canada (2018c) Guidelines for obtaining meaningful consent, Clause 6.
42 Privacy Commissioner of Canada (2015a) Collecting from kids. The topic of consent and children
is also addressed in Privacy Commissioner of Canada (2018c) Guidelines for obtaining meaningful
consent.
43 Privacy Commissioner of Canada (2017) 2016-2017 Annual Report, Report on Consent.
44 House of Commons (2018) Towards Privacy by Design, p. 2.
Data Protection and the Internet: Canada
61
right up front as they are considering using the service or product on offer, making
the purchase, or downloading the app, etc.”
37 The Guidelines also state that information must be provided in “manageable and easily-accessible ways” that give users
some control over the flow of information to them. The Guidelines encourage
organizations to “be innovative and creative”
38 in providing notice of collection
and in obtaining consent, and suggest using just-in-time notification, interactive
tools, and customized mobile interfaces.
39 User-friendly interfaces must be designed
with the audience for the particular product or service in mind,
40 and consent should
also be part of a “dynamic and ongoing process”.
41 In particular, the Guidelines
suggest that organizations find ways to periodically remind users about key elements
of their privacy policy.
2.1 Children’s Privacy
Neither PIPEDA nor any of the three substantially similar provincial private sector
data protection laws specifically addresses the privacy rights of minors. The OPC has
provided specific guidance for businesses that collect information from children and
youth.
42 In its 2017 report on consent it expressed the view that: “in all but
exceptional cases, consent for the collection, use and disclosure of personal information of children under the age of 13, must be obtained from their parents or
guardians”.
43 For minors over the age of 13, the OPC requires organizations to take
level of maturity into account in developing consent processes. This position is
reflected in the new Guidelines on Consent. The issue of children and consent was
discussed in the 2018 report of a Parliamentary committee that studied PIPEDA
reform. The ETHI committee recommended that the government “consider
implementing specific rules of consent for minors, as well as regulations governing
the collection, use and disclosure of minors’ personal information”.
44
37 Privacy Commissioner of Canada (2018c) Guidelines for obtaining meaningful consent, Clause
1. Additional emphasis on four key elements is prescribed. These elements are: what personal
information is collected, with whom the information will be shared, for what purposes the
information is collected, used or disclosed, and the risks of harm or other consequences from
sharing personal information.
38 Privacy Commissioner of Canada (2018c) Guidelines for obtaining meaningful consent, Clause 4.
39 Privacy Commissioner of Canada (2018c) Guidelines for obtaining meaningful consent, Clause 4.
40 Privacy Commissioner of Canada (2018c) Guidelines for obtaining meaningful consent, Clause 5.
41 Privacy Commissioner of Canada (2018c) Guidelines for obtaining meaningful consent, Clause 6.
42 Privacy Commissioner of Canada (2015a) Collecting from kids. The topic of consent and children
is also addressed in Privacy Commissioner of Canada (2018c) Guidelines for obtaining meaningful
consent.
43 Privacy Commissioner of Canada (2017) 2016-2017 Annual Report, Report on Consent.
44 House of Commons (2018) Towards Privacy by Design, p. 2.
Data Protection and the Internet: Canada
61