Nikita Munjal is a 3L JD/MBA Candidate at Osgoode Hall Law School. This article was written as a requirement for Prof. Pina D’Agostino’s IP Intensive Program.

Using the Internet inevitably requires consenting to have your personal information used, collected, and disclosed by the websites you visit. A common reason for individuals, corporations, and non-profit organizations to collect your personal information is to influence your behaviour online, from your to your . One of the most effective ways to influence consumer behaviour online is through targeted advertising.

Value for Advertisers

Access to personal information has become necessary for advertisers to convert potential leads into customers. Think back to 2012, for example, when a suggested that a statistician working at Target predicted a teenage girl’s pregnancy based on her shopping habits. What did Target do with this information? It mailed her coupons for baby clothes and cribs.

that the value of your personal information to advertisers depends on various factors. Factors influencing value include your gender, race, and sensitivity of the information (that is, cost more than ). If, for example, the target audience for a new sneaker launch is young males of middle eastern origin, the spent to acquire your personal information is a minor investment to incur to influence you to purchase $180 sneakers.

Value for Users

Traditionally, users have valued the ability to share their personal information while using online services, like search engines or social media platforms, citing their .

However, increasingly, . This trend has mobilized startups in Silicon Valley to appeal to privacy-conscious users by providing them an incentive to share their personal information. Known as paid-to-surf models, companies in this space require their users to install browser extensions to track their browsing.

What monetary value do some privacy-conscious users demand to share their personal information? $20 a month for users of . Others are . While these paid-to-surf models have the potential to be disruptive, they are not yet a viable alternative, as users must surf a certain amount before they can cash out. ��

Value Going Forward

The tech industry has built empires based on collecting, using, and selling its users’ personal information to third-party advertisers. Surprisingly, some factions of the tech industry are modifying their business models to limit the tracking of personal information. Apple, for example, introduced a new iOS in 2021, s. Similarly, on its Chrome browser is estimated to impact millions of advertisers.

Apple and Google argue that these changes are necessary to respond to increasing and customer sensitivity to sharing personal information (the IPilogue has documented increased regulation in the and ). However, , including , lament that the changes are veiled anti-competitive practices.

Interestingly, increasing barriers to the online advertising ecosystem may benefit users. If access to personal information becomes impeded, interested parties may need to incentivize users to share their personal information, increasing users’ bargaining power. Although it is unclear what effect Apple and Google’s changes will have on the ecosystem, I am hopeful that users can leverage more control over their personal information for fair compensation by technology companies or advertisers for their valuable commodity.

The post How Much is Your Personal Information Worth? And What Will It Be Worth in the Future? appeared first on IPOsgoode.

CONSENT LAWS

Consent is an integral part of the EU’s approach to data privacy. The concept was codified in the GDPR to mean “”(art 4(11)).

The application of GDPR consent requirements to online cookie notices has been nebulous since the law came into force. A found that the overwhelming majority of cookie notices in the EU are not GDPR-compliant. As enforcement ramps up, companies risk steep fines for non-compliance: is the imposition of a fine of “1% of annual turnover” for a company that failed to satisfy the Belgian Data Protection Authority’s cookie rules.

Guidance on the interpretation of cookie consent rules was provided by the Court of Justice of the European Union (CJEU) in the case, which involved the collection of personal information, through cookies, by an online lottery provider. The CJEU answered several questions (covered in Section III) while among member states (this was so advocated due to the issues created by divergent transposition and implementation of pre-GDPR Directives across the EU).

The European Data Protection Board (EDPB) recently incorporated the Planet49 ruling into a . The key requirements for valid consent, as they relate to cookie notices, are the subject of the next section.

PRACTICAL RECOMMENDATIONS

In light of the GDPR, the Planet49 decision, and the recent guideline, the following consent acquisition practices should be adopted for data controllers employing cookie notices. Consent should be:

a) Freely given

A user’s access to services and functionalities on the user’s consent to information storage or access on their terminal equipment (at para 39). In other words, “cookie walls” are an invalid form of consent. While it is acceptable to restrict certain functionalities if the user does not consent, to the site must not be made conditional on cookie acceptance.

b) Specific

Data controllers should provide information about each cookie type (e.g., “marketing” or “statistics”) and allow subjects to choose which cookies to accept. Apart from essential cookies, without which provision of “general access” to the site is impossible, subjects should be allowed to reject other categories of cookies (arts 5(1)(b), 6(1)(a).

c) Informed

The data subject should be given, at a minimum, the : the controller’s identity; the purposes of each of the processing operations for which consent is being sought; the type of data that will be collected; and the existence of the right to withdraw consent (arts 5, 7(2)). This information should be provided in to facilitate comprehension by laypeople (at para 67). It is insufficient to embed a consent request within a paragraph of the website’s terms of service (i.e., the consent request must be clearly distinguishable from other matters) (at para 71).

d) Unambiguous

are insufficient for showing consent, as are the mere acts of scrolling or swiping on a webpage (at paras 79, 81). to cookie use can only be shown through the provision of an unticked box that the user must actively select (art 4(11)).

e) Revocable

must be as easy to withdraw as it is to give. Data controllers could include a withdrawal option, either on a separate webpage or embedded within the site’s privacy policy. This function could also display the user’s current status (e.g., “allow only essential cookies” or “block all cookies”) (art 7(3).

f) Demonstrable

The burden of proof is on the data controller to show that valid consent was obtained. It is recommended that data controllers store and log all consents in the form of information on the browsing session in which consent was obtained along with a copy of the information presented to the data subject at the time of consent (art 7(1)).

g) Obtained prior to data processing

The words “has given” in of the GDPR imply that prior consent is a prerequisite to the lawful processing of personal data. Therefore, all non-essential cookies should be blocked until the user consents to their deployment.

Written by Daniel Joseph, Osgoode JD Candidate, enrolled in Professors D’Agostino and Vaver 2020/2021 IP & Technology Law Intensive Program at Osgoode Hall Law School. As part of the course requirements, students were asked to write a blog on a topic of their choice.

��

The post Guidelines for the Implementation of GDPR-Compliant Cookie Notices appeared first on IPOsgoode.

In April 2019 , the OPC’s conclusion following an investigation into Equifax Canada’s transfer of consumer financial information to Equifax Inc. (an entity in the United States) for processing.[7] In their report, the OPC found that Equifax Canada should have sought express consent from customers when transferring personal information to a third party in a foreign jurisdiction for processing, as this constituted a “disclosure” within the meaning of Principle 4.1.3 of PIPEDA. This finding directly contradicted the (the “Guidelines”), which distinguished a “transfer” or “use” from a “disclosure” and only required appropriate notice to consumers informing them that their personal information was being processed in a foreign jurisdiction (provided that the transferring organization took reasonable steps to provide a comparable level of data protection while in the hands of foreign entities through contractual terms and the transfer was for the purpose for which the information was initially collected).[8] Given the departure from the OPC’s previous findings on similar matters and its commitment in writing to such an interpretation in their Guidelines, the OPC launched a consultation soliciting stakeholder feedback on the change in their position.

Based on the responses received in the course of the consultation, the OPC concluded that their Guidelines and interpretation of Principle 4.1.3 will remain unchanged under PIPEDA as it currently stands. In coming to their conclusion, the OPC recognized the business challenges that a consent requirement would impose and conceded that they would “”.[9] In their conclusion, the OPC also recognized the reality that implementation of their new position likely would not be applied in practice for many years, at which point amended legislation on the matter may already be in place.

Throughout the consultation process, the to the impending statutory reform of PIPEDA,[10] which serves as a reminder that OPC decisions and are, in fact, not binding at law.[11] While businesses, the legal community and industry groups may have been pleased with the OPC’s immediate conclusion following the consultation, the relief could be short lived depending on what statutory amendments will be made to PIPEDA in the coming years. ��Innovation, Science and Economic Development Canada’s recently published , Strengthening Privacy in the Digital Age, which outlines four areas of reform and includes enhancing individuals’ control, making specific reference to accountability as it relates to trans-border data flows for processing.[12] Thus, the real value of the OPC’s consultation may be realized in how they will use the information and insight obtained to advise Parliament on how legislative amendments to PIPEDA should deal with the issue of data transfers for processing purposes. The OPC stated it will now focus its efforts on “”.[13] The OPC’s ;[14] it remains to be seen whether the OPC will take into consideration the business and practical implications raised by stakeholders throughout the consultation process when determining what constitutes “best” protection for Canadians and making recommendations to Parliament. To require consent or to not require consent? That is still the question, but now it’s Parliament’s turn to answer.

Written by Madison Black, Osgoode JD Candidate, enrolled in Professors D’Agostino and Vaver 2019/2020 IP & Technology Law Intensive Program at Osgoode Hall Law School. As part of the course requirements, students were asked to write a blog on a topic of their choice.

��

[1] Office of the Privacy Commissioner of Canada, Announcement, “Commissioner Concludes Consultation on Transfers for Processing” (23 September 2019), online: <https://www.priv.gc.ca/en/opc-news/news-and-announcements/2019/an_190923/>.

[2] Canada, Office of the Privacy Commissioner of Canada, “Consultation on Transfers for Processing – Reframed Discussion Document”, Consultation (Ottawa: Office of the Privacy Commissioner of Canada, 2019), online: <https://www.priv.gc.ca/en/about-the-opc/what-we-do/consultations/consultation-on-transfers-for-processing/>

[3] Osler, Hoskin & Harcourt LLP, “OPC Consultations on Transborder Dataflows”, Submission to the OPC, (6 August 2019), online: < https://www.accessprivacy.com/AccessPrivacy/media/AccessPrivacy/Content/news/AccessPrivacy-Submission-to-OPC-re-Transfers-for-Processing.pdf>.

[4] Canada, Office of the Privacy Commissioner of Canada, “Processing Personal Data Across Borders Guidelines” (Ottawa: Office of the Privacy Commissioner of Canada, January 2019) online: < https://www.priv.gc.ca/en/privacy-topics/airports-and-borders/gl_dab_090127/>.

[5] Canada, Office of the Privacy Commissioner of Canada, Investigation into Equifax Inc. and Equifax Canada Co.’s Compliance with PIPEDA in Light of the 2019 Breach of Personal Information (9 April 2019), PIPEDA Report of Findings #2019-001, online: <https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2019/pipeda-2019-001/>.

[6] Molly Reynolds and Shalom Cumbo-Steinmetsz, “What the OPC’s Decision in Equifax Means for Cross-border Data Transfers and Outsourcing” (11 April 2019), Torys LLP, online <https://www.torys.com/insights/publications/2019/04/what-the-opcs-decision-in-equifax-means-for-cross-border-data-transfers-and-outsourcing>; Lisa R. Lifshits, “The Many Lessons of the Equifax Data Breach” (15 April 2019), Torkin Manes, online: <https://www.torkinmanes.com/our-resources/publications-presentations/publication/the-many-lessons-of-the-equifax-data-breach>; Bernice Karm, “Privacy Commissioner Reverses Course – Consent Required for Personal Information Processing” (16 April 2019), Bassels Brock and Blackwell LLP, online: <https://mobile.casselsbrock.com/Issue/Privacy_Commissioner_Reverses_Course___Consent_Required_for_Personal_Information_Processing>; Monique McAlister, Peter Rudy and Niki Kermani, “Privacy Commissioner Reverses Its Position on Cross-Border Transfers of Personal Information” (15 April 2019), Goodmans LLP Update, online: < http://www.goodmans.ca/files/file/docs/04.15.2019%20-%20Privacy%20and%20Litigation%20Update.pdf>; Barry Sookman, “OPC Consultation on Trans-border Data Flows: My Submission to the Consultation” (6 August 2019), Barry Sookman, online: <https://www.barrysookman.com/2019/08/06/opc-consultation-on-trans-border-data-flows-my-submission/>.

[7] Supra note 5. ��

[8] Supra note 4.

[9] Supra note 1.

[10] Canada, Innovation Science and Economic Development Canada, Strengthening Privacy for the Digital Age (May 2019), online: <https://www.ic.gc.ca/eic/site/062.nsf/eng/h_00107.html>.

[11] Canada, Office of the Privacy Commissioner of Canada, PIPEDA Interpretation Bulletins (30 January 2017), online: <https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda-compliance-help/pipeda-interpretation-bulletins/>.

[12] Supra note 10. ��

[13] Supra note 1.

[14] Canada, Office of the Privacy Commissioner of Canada, How the OPC Protects and Promotes Privacy (10 November 2016), online: <https://www.priv.gc.ca/en/about-the-opc/what-we-do/mm/>.

The post TO REQUIRE CONSENT OR TO NOT REQUIRE CONSENT? THAT WAS (AND COULD STILL BE) THE QUESTION appeared first on IPOsgoode.

On May 11, 2016, Privacy Commissioner Daniel Therrien announced the Office of the Privacy Commissioner of Canada (“OPC”) would seek public input on the issue of how Canadians can give meaningful consent to the collection, use and disclosure of their personal information in an increasingly digital age. The OPC has released a (“Report”) on considerations related to “enhancing” the consent model under the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and a inviting all interested parties to answer specific questions related to the Report and also to provide any thoughts on issues raised. The deadline for submissions is July 13, 2016.[1]

The Report – An Overview

The Report considers the approaches taken by other jurisdictions to the issue of consent, including the , and the US approach, as governed by the Federal Trade Commission.

The Report also focuses on challenges that both businesses and individuals face when it comes to providing meaningful consent in an era of Big Data and the Internet of Things (“IoT”):

The consent model of personal information protection was conceived at a time when transactions had clearly defined moments at which information was exchanged. Whether an individual was interacting with a bank or making an insurance claim, transactions were often binary and for a discrete, or limited, purpose. They were often routine, predictable and transparent. Individuals generally knew the identity of the organizations they were dealing with, the information being collected, and how the information would be used…[N]ew technologies and business models have resulted in a fast-paced, dynamic environment where unprecedented amounts of personal information are collected by, and shared among, a myriad of often invisible players who use it for a host of purposes, both existing and not yet conceived of. Binary one-time consent is being increasingly challenged because it reflects a decision at a moment in time, under specific circumstances, and is tied to the original context for the decision, whereas that is not how many business models and technologies work anymore.

The Report goes on to offer several possible solutions to the problems in the current consent model and poses questions for reflection for the public consultation process.

The Suggested Changes

While noting that “[c]onsent should not be a burden for either individuals or organizations, nor should it pose a barrier to innovation and to the benefits of technological developments to individuals, organizations and society”, the OPC’s proposed “enhancements” to consent will likely cause concerns for business.

A great deal of the focus in the proposed reform revolves around creating processes that simplify complicated concepts such that individuals will be able to readily comprehend and appreciate the purposes to which their personal information may be put.

The proposed solutions are intended to address several specific challenges, including making informed consent and information related to privacy preferences more readily comprehensible individuals, creating “no-go zones” or “proceed with caution zones” to protect particularly vulnerable groups in high risk sectors, devising accountability processes that include independent third parties, placing a greater emphasis on fairness and ethical balance with regards to the use of personal information, and stronger regulatory oversight of privacy protection that includes enforcement mechanisms that can be implemented for deterrence purposes.

Proposed Enhancements to Consent

The Report advocates for privacy policies that lack opacity and privacy preferences that can be managed with greater ease through the following mechanisms and considerations:

• Greater transparency in privacy policies – through communicating privacy information at integral points in time to increase the ease with which a consumer can understand the flow of information and utilizing layered privacy policies that are simultaneously inclusive and intelligible.
• Managing privacy preferences across services – through the use of an independent third party that screens and controls preferences and the related release of personal information.
• Technology specific safeguards – through built in compliance mechanisms and broadly constructed recommendations for best practices, including comprehensive disclosure requirements to consumers both pre- and post-purchase.
• Privacy as a default setting – whereby privacy is an inherently integrated component by default.

What this means to business remains to be seen. “Layered” privacy policies will, at a minimum, require most organizations to rewrite their current their policies and add an additional layer of technological administration. The call for “dynamic, interactive data maps and infographics, or short videos” is unlikely to be met with enthusiasm by business, either. While the goal of transparency and readability is laudable, it is doubtful that consumers will spend any more time on these items than they do on existing text-based policies.

The use of an independent third party to manage privacy preferences across devices places the burden for doing so squarely on business. In this proposal, users would associate themselves with a standard set of privacy preference profiles offered by third parties and these third party websites would then vet apps and services based on the user’s privacy profile. It seems unlikely that these proposed third parties would offer this service for free.

Proposed Alternatives to Consent

The Report contemplates practicable alternatives to the traditional approach to consent, such as the de-identification of data and types of information that may not necessarily require consent, as well as the necessary changes to the applicable legislative framework that may be required for implementation.

• De-identification – While the anonymization of information necessarily strips it of the contextual factors related to personal information that necessitate consent, the increasing sophistication of both data sets and the methods for analysis leave concerns about the value of this approach as a privacy protection mechanism.
• “No-Go Zones” – Areas or zones of personal information of vulnerable groups whose data would be subject to a limited level of processing or potentially a complete prohibition.
• Legitimate Business Interests – Situations in which personal data could be processed for a legitimate purpose that would no longer require consent unless another fundamental right necessarily required it.

Proposed Governance Considerations

The Report advocates for a greater level of accountability associated with ensuring the adequacy of privacy protections, encouraging transparency and assuring that best practices are being implemented consistently. This would include codes of practice that function to create transparent obligations and suggestions for best practices by using privacy trustmarks to create accountability mechanisms by which regulators can evaluate and designate organizations as compliant, as well as ethical assessments and autonomous organizations with specifically delineated goals focused on protecting the privacy of individuals.

Proposed Enforcement Models

While the Report considers situations in which self-regulation at both the industry and organization level may be appropriate, it also strongly suggests that there is a need for independent oversight, with accountability facilitated through fines and the ability to create orders, as opposed to recommendations, in order to maximize effectiveness. While independence is seen as the cornerstone of any regulatory body in the future for ensuring privacy and meaningful consent, the Report focuses on a proactive compliance model that would serve a stronger deterrent purpose than that of the OPC as it exists today.

What Does this Mean for Businesses?

In the era of the IoT and Big Data, traditional conceptualizations of consent processes no longer necessarily apply. The OPC has expressed concerns about opaque consent processes that individuals don’t actually read or comprehend, and has indicated that the solution to this may include sector specific regulation on the collection and use of data as well as the associated consent processes utilized in obtaining personal information. Many businesses may need to both re-visit and re-word existing privacy policies and consent protocols in order to increase transparency, as well as the accessibility and intelligibility of the policies surrounding data and the purposes to which personal information will potentially be put.

© McCarthy Tétrault LLP

is Counsel in McCarthy Tétrault’s National Technology Group. is an Associate at McCarthy Tétrault Toronto.

[1] Editor's note:�� The deadline has been extended to July 31, 2016.

The post Privacy Commissioner Seeks Public Input on Consent Model appeared first on IPOsgoode.