Privacy Commissioner of Canada
112 Kent Street
Ottawa, Ontario
K1A1H3
Tel.: (613) 995-8210
Fax:(613)947-6850
1-800-282-1376
www.privcom.gc.ca
File: 6100-0082
Ms Philippa Lawson
Public Interest Advocacy Centre
1 Nicholas Street, Suite 1204
Ottawa, ON K1 N 7B7
Dear Ms Lawson:
This letter constitutes my report of findings with regard to the complaint you filed against the Hudson’s Bay Company (HBC) under the Personal Information Protection and Electronic Documents Act (the Act). In your complaint received in my Office on October 18, 2001, you made reference to Principle 4.3 (Consent) of Schedule 1 to the Act and alleged that HBC was not obtaining informed consent from individuals for the collection, use, or disclosure of personal information for secondary marketing purposes.
Specifically, you made three allegations of failure on HBC’s part with respect to its credit card and rewards program: (1) failure to adequately bring to the attention of its customers its practices of using and sharing customer data for secondary marketing purposes and the opportunity for customers to opt out of such practices; (2) failure to provide adequate information as to potential secondary uses and sharing of customer data; and (3) failure to provide customers with an opting-out method that can be executed immediately, easily, and at minimal effort and cost.
‘ I have determined, first of all, that the subject matter of your complaint does fall within my current jurisdiction under the Act, but only as far as HBC’s operations in northern Canada are concerned.
As of January 1, 2001, the Act applies to any federal work, undertaking, or business or to any organization that discloses personal information across borders for consideration. I have determined that HBC does not disclose personal information across borders for consideration. However, by operation of constitutional law, any business venture in the Yukon, Nunavut, or the Northwest Territories is a federal work, undertaking, or business. HBC has five divisions, one of which, its Fields Stores Division, operates one store in the Yukon and two in the Northwest Territories. On this limited basis, therefore, I was required under section 12 of the Act to accept and investigate your complaint.
I have also determined from the facts of the case that the information at issue is personal information for purposes of the Act. Section 2 of the Act defines personal information to be ”…information about an identifiable individual…”. It is clear from the wording of your complaint that your concern is information about HBC’s customers as identifiable individuals.
Before I provide you with my other findings, let me first outline the facts obtained in the course of my Office’s investigation.
You have filed similar complaints against several organizations, one of which is HBC. For all of these complaints, you have formulated a general position, in support of which you have submitted a market research survey conducted by EKOS Research Associates Inc. I summarize your position as follows:
- It is always appropriate to ensure the individual’s knowledge and consent in respect of secondary marketing purposes.
- There is a clear difference, however, between marketers and the marketed on the issue of what form of consent is appropriate – that is, express consent versus implied consent.*Companies often appear to take the view that a customer’s consent to secondary marketing can be taken as implied provided that the policy in question is stated in some document that is accessible to the customer. However, companies have an obligation not merely to state purposes in a policy document, but also to bring to the attention of the individual customer the practices in question and the negative option attached.
*Companies commonly fall short of meeting this obligation in several ways:- reliance on a document not provided to the individual customer, but rather left up to the customer to find on his or her own initiative;
- reliance on fine print buried in a long document;
- failure to use clear, plain language understandable to the ordinary consumer;
- failure to provide customers with adequately detailed information about the extent and purpose of contemplated uses and sharing of their personal information; and
- failure to provide an easily executable opting-out procedure
- The EKOS marketing survey shows a preference for opt-in versus opt-out consent among a clear majority of respondents. Opt-out consent is considered acceptable only under conditions where the opting-out provision is brought to the customer’s attention, is clearly worded and sufficiently detailed, and is easy to execute.
In your complaint against HBC, you identified that company’s credit card agreement as being particularly inadequate for purposes of the Act.
My Office’s investigation has revealed that HBC’s three Fields stores that fall under my jurisdiction do not participate in the HBC Rewards Program and do not themselves currently collect, use, or disclose personal information in connection with the HBC credit card. Formerly, these stores did in theory take credit card applications, but their involvement in the credit card program would have been limited to forwarding the applications to HBC’s head office in Toronto. The stores in question would not have retained copies and would not themselves otherwise perform any administrative function in respect of credit cards. Moreover, the three stores no longer participate in HBC’s credit card program in any way.
On the basis of these facts, I am required to determine whether HBC is in compliance with Principle 4.3 of Schedule 1 to the Act as far as its operations under my current jurisdiction are concerned. Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.
In the absence of evidence to the contrary I must conclude that HBC’s three Fields stores in northern Canada do not collect, use, or disclose their customer’s personal information in connection with HBC’s credit card or rewards program. Having no jurisdiction at present for further investigation, I therefore have no basis for finding that HBC is not in compliance with Principle 4.3.
Accordingly, I conclude that your complaint against HBC is not well-founded.
Nevertheless, I would be remiss if I did not take this opportunity to remind HBC that its operations in the rest of Canada will become subject either to the Act or to substantially similar provincial legislation as of January 1, 2004. I also wish to notify HBC that, in your similar complaints against other organizations, I have found your expectations regarding consent, as you expressed them in your general submission, to be reasonable and in keeping with the Act. I would strongly recommend that, in preparing to undertake its more extensive obligations, HBC take due account of the substance of your complaints and of my related findings.
Now that you have my report, I must inform you that, pursuant to section 14 of the Act, you have the legal right to apply to the Federal Court, Trial Division, for a hearing in respect of any matter that you complained about or that I have dealt with in my report, and that is referred to in clause 4.1.3, 4.2, 4.3.3, 4.4, 4.6, 4.7 or 4.8 of Schedule 1, in clause 4.3, 4.5 or 4.9 of the Schedule as modified or clarified by the Act, in subsection 5(3), or 8(6) or (7) or in section 10.
Should you wish to proceed to the Court, we suggest you contact the Trial Division of the Court office nearest you. It is located at the Supreme Court Building, Kent & Wellington, Ottawa, ON K1A OH9, telephone (613) 992-4238. Normally, an application must be made within 45 days of the date of this letter.
You should also be aware that the Court has discretion to order that the costs of the other party be paid by you where the Court is of the view that this is appropriate. While this does not happen often, it is a possibility of which you should be aware. Conversely, the Court may order that your costs be paid where the Court finds that your application raises an important new principle.
This concludes the investigation of your complaint. If you have any questions or comments about the disposition of the complaint, I would invite you to contact Mr. Gerald Neary, Director General of Investigations, at 1-800-282-1376.
Yours sincerely,
George Radwanski Privacy Commissioner of Canada