Those fed up with personalized junk mail and telemarketing, but unable to control it, have an ally in the federal Privacy Commissioner. George Radwanski, the Privacy Commissioner of Canada, today released his findings on a complaint lodged last summer about the customer information practices of Air Canada’s Aeroplan Frequent Flier program. In a strongly worded report, the Commissioner lambasts Air Canada for failing to obtain the informed consent of Aeroplan members to the sharing of their personal information with external sources, as well as with other Aeroplan members.
The Commissioner found that Air Canada’s information practices violate the federal data protection legislation in a number of respects. Perhaps most significantly for other businesses, the Commissioner found that commonly-used “opt-out” (also referred to as “negative option”) approaches are inadequate when it comes to getting consumer consent to the sharing of detailed personal data for marketing purposes. He recommended instead that Air Canada “seek positive (i.e., opt-in) consent from all Aeroplan members regarding all information-sharing situations outlined in [its] brochure”. These situations included the provision of mailing lists to Aeroplan partners as well as other companies.
“This is an important win for consumer privacy”, said Philippa Lawson, counsel for the Public Interest Advocacy Centre. “It’s time that companies begin to respect consumer privacy, instead of just treating consumer information as a commodity that they can freely collect, use, and trade without the individual’s knowledge, let alone consent.”
“The Privacy Commissioner’s report is consistent with public opinion on this issue: negative option consent is not good enough, especially where it is not brought to the attention of the individual, is not clearly worded, or is not sufficiently detailed,” said Ms. Lawson. “What use is consent if the individual doesn’t even know what he or she is consenting to?”
Last summer, PIAC commissioned a nation-wide survey of public opinion on this issue. 82% said that businesses should obtain their permission before using their information for further marketing purposes. A clear majority (69%) did not consider opt-out approaches to be acceptable for such purposes. Almost all respondents (94%) considered it important that negative option approaches to consent be brought to their attention, and that companies make it easy for them to opt-out. (See for a copy of the survey report.)
PIAC subsequently filed a complaint with the Privacy Commissioner about allegedly inadequate opt-out practices on the part of several large businesses, noting that such practices were widespread and not limited to the named companies. The Commissioner has yet to release his findings on that complaint. (See for a copy of that complaint.)
“The Aeroplan case sets an important precedent for businesses generally”, said Ms. Lawson. “Where consent is required, it must be obtained in a meaningful way. The best way to do that is through positive, opt-in consent. Negative option consent is dangerous, because it is so easy for people to miss or to misunderstand.”
According to the Commissioner’s report in the Aeroplan case, only about one percent of Aeroplan members were informed, via a brochure mail-out, of the company’s sharing of their personal information with other companies. Even then, the brochure was so vague and confusing in some respects that “not even Air Canada knew precisely what it meant”, according to the Commissioner’s report. Moreover, Aeroplan was collecting information about plan members’ personal and professional interests, demographics, financial status, and use of, or preference for, certain products and services, from unnamed external sources. For this type of information, the Commissioner found that opt-in, or positive, consent, is required.
Philippa Lawson, PIAC
tel: 613-562-4002 x.24
Commissioner’s report