New privacy decision: Key takeaways for businesses using location tracking technologies

The Office of the Privacy Commissioner of Canada (the OPC), along with the Office of the Information and Privacy Commissioner for British Columbia, the Office of the Information and Privacy Commissioner of Alberta, and the Commission d’accès à l’information du Québec (collectively the Commissioners), published the results of their joint investigation concerning the Canadian fast food restaurant chain, Tim Hortons, and its handling of customers’ location data on June 1, 2022.

Background

First launched in 2020, the Commissioners’ investigation stemmed from an access request and a related news article that revealed how the company was collecting customers’ granular location data through its branded app, including precise longitude and latitude coordinates, even when the app was closed (despite statements to the contrary). According to the investigation report, the data was used to infer where a user’s home and place of work were located, and when the user was travelling or visiting a competitor’s establishment, in order to facilitate the delivery of targeted ads, although a shift in commercial priorities meant that the data was actually only used on an aggregated, de-identified basis to conduct analytics related to user trends.

In concluding that the company’s collection and use of customers’ granular location data was unlawful under the federal Personal Information Protection and Electronic Documents Act and applicable provincial privacy laws,1 the Commissioners held that such practice was not only unreasonable and disproportionate in light of the sensitivity of the information, but also lacked meaningful consent, in part due to the false and misleading representations made to customers about the scope and consequences of the collection. In addition, the Commissioners made a number of important recommendations in respect of the terms governing the outsourcing arrangement between the company and its service provider as well as the internal accountability and governance practices of the company.

Read our article which presents our analysis of the key lessons that businesses using location tracking technologies should learn from this decision.

This content has been updated on June 13, 2022 at 14 h 17 min.