Privacy Commissioner
Commissaire a la protection of Canada de la vie privee du Canada
112, rue Kent
Ottawa (Ontario)
K1A1H3
Tel.: (613) 995-8210
Telec: (613) 947-6850
1-800-282-1376
www.privcom.gc.ca
File: 6100-0218
Ms Philippa Lawson
Public Interest Advocacy Centre
One Nicholas Street, Suite 1204
Ottawa, ON K1N7B7
Dear Ms Lawson:
This letter constitutes my report of findings with regard to the complaint you filed against Bell Nexxia under the Personal Information Protection and Electronic Documents Act (the Act). In your complaint, you made reference to Principle 4.3 (Consent) of Schedule 1 to the Act and alleged that Bell Nexxia was not obtaining informed consent from individuals for the collection, use or disclosure of personal information for secondary marketing purposes. Specifically, you complained that Bell Nexxia was not bringing to the attention of its customers (a) its policy of sharing customer information with Bell Canada affiliates for secondary marketing purposes and (b) the corresponding opportunity for customers to opt-out of such sharing.
I have determined, first of all, that the subject matter of your complaint does fall within my jurisdiction under the Act. As of January 1, 2001, the Act applies to any federal work, undertaking or business. By operation of constitutional law, any telecommunications company, such as Bell Nexxia, is a federal work, undertaking or business. On this basis, therefore, I was required under Section 12 of the Act to accept and investigate your complaint.
Before I provide you with my other findings, let me first outline the facts obtained in the course of my Office’s investigation.
You have filed similar complaints against several organizations, one of which is Bell Nexxia. For all these complaints, you have formulated a general position, in support of which you have submitted a market research survey conducted by EKOS Research Associates Inc. I summarize your position as follows:
- It is always appropriate to ensure the individual’s knowledge and consent in respect of secondary marketing purposes.
- There is a clear difference, however, between marketers and the marketed on the issue of what form of consent is appropriate – that is, express consent versus implied consent.
- Companies often appear to take the view that a customer’s consent to secondary marketing can be taken as implied provided that the policy in question is stated in some document that is accessible to the customer. However, companies have an obligation not merely to state purposes in a policy document, but also to bring to the attention of the individual customer the practices in question and the negative option attached.
- Companies commonly fall short of meeting this obligation in several ways:
- reliance on a document not provided to the individual customer, but rather left up to the customer to find on his or her own initiative;
- reliance on fine print buried in a long document;
- failure to use clear, plain language understandable to the ordinary consumer;
- failure to provide customers with adequately detailed information about the extent and purpose of contemplated uses and sharing of their personal information; and
- failure to provide an easily executable opting-out procedure.
- The EKOS marketing survey shows a preference for opt-in versus opt-out consent among a clear majority of respondents. Opt-out consent is considered acceptable only under conditions where the opting-out provision is brought to the customer’s attention, is clearly worded and sufficiently detailed, and is easy to execute.
Bell Nexxia’s customer base comprises the largest 300 private and public sector customers served by Bell Canada and its affiliates. It assists these businesses to develop their communications infrastructure, including information technology functions and provides them with e-business computerized solutions. Bell Nexxia does not provide services to individual consumers.
On the basis of these facts, I am required to determine firstly whether the information at issue is personal information for the purposes of the Act, and if so, whether Bell Nexxia is in compliance with Principle 4.3 of Schedule 1 to the Act.
Section 2 of the Act defines personal information to be ”…information about an identifiable individual…”. Principle 4.3 of Schedule 1 to the Act states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.
The information that Bell Nexxia deals with, pertains to corporations – not “identifiable individuals”. I am satisfied that Bell Nexxia does not collect, use or disclose the personal information of individuals. I therefore have no basis for making a determination in respect of Principle 4.3 of Schedule 1 of the Act.
Accordingly, I conclude that your complaint against Bell Nexxia is not well-founded.
Now that you have my report, I must inform you that, pursuant to Section 14 of the 4 Act, you have the legal right to apply to the Federal Court, Trial Division, for a hearing in ‘espect of any matter that you complained about or that I have dealt with in my report, and ihat is referred to in clause 4.1.3, 4.2, 4.3.3, 4.4, 4.7 or 4.8 of Schedule 1, in clause 4.3, k5 or 4.9 of the Schedule as modified or clarified by the Act, in subsection 5(3), or 8(6) or 7) or in section 10.
Should you wish to proceed to the Court, we suggest you contact the Trial Division 3f the Court office nearest you. It is located at the Supreme Court Building, Kent & Wellington, Ottawa, ON K1A OH9, telephone (613) 992-4238. Normally, an application •nust be made within 45 days of the date of this letter.
You should also be aware that the Court has discretion to order that the costs of he other party be paid by you where the Court is of the view that this is appropriate. A/hile this does not happen often, it is a possibility of which you should be aware. conversely, the Court may order that your costs be paid where the Court finds that your application raises an important new principle.
This concludes the investigation of your complaint. If you have any questions or comments about the disposition of the complaint, I would invite you to contact Mr. Gerald Meary, Director General of Investigations, at 1-800-282-1376.
George Radwanski Privacy Commissioner of Canada