This month, the Online Interest-Based Advertising Accountability Program (Accountability Program) issued a Compliance Warning to website publishers that permit third parties to collect information for interest-based advertising on their websites, but are not yet providing consumers with notice of this practice on every webpage where data is being collected. This notice must link to an explanation of their practises and provide an easy-to-use choice mechanism.
The Compliance Warning, which can be viewed in full here, explains what website owners must do to come into compliance with this requirement of the Self-Regulatory Principles for Online Behavioural Advertising. It warns that strict enforcement will begin on January 1, 2014. Businesses which do not comply with this standard will not be eligible for BBB Accreditation.
Businesses must consult with their information technology services, website designers, and/or development team to discover whether third parties are collecting information on their websites. Businesses should also ensure that their contracts do not permit the collection of data for interest based ads, or for selling to other businesses for such use.
Canada has two federal privacy laws: the Privacy Act and the Personal Information Protection and Electronic Documents Act (PIPEDA). The Privacy Act gives individuals the right to access and request correction of personal information about themselves held by these federal government organizations, while PIPEDA sets out ground rules for how private sector organizations may collect, use or disclose personal information in the course of commercial activities. PIPEDA also gives individuals the right to access and request correction of the personal information these organizations may have collected about them.
Oversight of both federal Acts rests with the Privacy Commissioner of Canada, who is authorized to receive and investigate complaints. In addition, the BBB Code of Advertising and Code of Business Practices promotes the enforcement of Canada’s privacy laws by outlining that all BBB Accredited Businesses must safeguard the information they collect from consumers and be transparent about how the collected information is used.
Be specific and provide meaningful information. Avoid talking in generalities. This is your opportunity to avoid any potential confusion. Make clear what personal information is collected (such as identification documents/numbers, date of birth, video surveillance images or cookies) for what purpose (such as identity verification, security or marketing). If you disclose personal information to “third parties”, explain who those parties are, or what services they provide.
Privacy Choices. Tell customers about any choices you offer regarding the collection, use or disclosure of their information (such as opting out of the use of personal information for marketing purposes). Clearly explain how they can exercise those choices.
Provide a clear explanation of how people can obtain access to their personal information held by your organization. Also include how they can request correction or deletion of this information.
Keep it simple. Explain your practises in ways that are easy to understand. Consider providing plain language summaries of complex subjects. Also consider removing any unnecessarily lengthy content.
For more information about PIPEDA and the Privacy Act, please contact the Office of the Privacy Commissioner of Ontario at http://www.priv.gc.ca/. There you will find a useful selection of guidance documents further outlining the privacy responsibilities of businesses and organizations.
The BBB Serving Mid-Western and Central Ontario offers information services at 1-800-459-8875 or http://mwco.bbb.org. Public phone line hours are Monday to Friday, 9:00 AM to 2:00 PM.