Tim Hortons app violated privacy laws: privacy watchdogs

Canadian coffee chain Tim Hortons violated national privacy law because users of its app had “their movements tracked and recorded every few minutes of every day, even when their app was not open,” according to the Office of the Privacy Commissioner (OPC) and several provincial privacy authorities. The OPC, along with the Commission d’accès à l’information du Québec, Office of the Information and Privacy Commissioner for British Columbia, and Office of the Information and Privacy Commissioner of Alberta released the findings Wednesday, after the watchdogs launched a joint investigation into TDL Group Corp. – the operator and franchisor of Tim Hortons in Canada – and its parent company Restaurant Brands International Inc.’s compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA). “In our view, Tim Hortons did not collect and use the granular location data in question for an appropriate purpose in the circumstances. First, Tim Hortons did not have a legitimate need to collect vast amounts of sensitive location information where it never used that information for its stated purpose,” the offices wrote in its report. As of July 2020, when the investigation was launched, there were more than 1.6 million active users, defined as users that opened the app, according to the report. In a Wednesday morning press conference, federal Privacy Commissioner Daniel Therrien said the incident “once again makes plain the urgent need” to update Canada’s privacy laws. “As a society, we would not accept it if the government wanted to track our movements every few minutes of every day. It is equally unacceptable that private companies think so little of our privacy and freedom that they can initiate these activities without giving it more than a moment’s thought,” he stated. Last Thursday, Therrien called for new legislation that would cover consent issues in a speech to the International Association of Privacy Professionals. The Trudeau government introduced updated privacy laws last year but legislation died on the order paper when the election was called. The offices did determine that the matter at hand was “well-founded and conditionally resolved” because “within days” from when the investigation was publicly announced it disabled its location tracking functionality. In Aug. 2020, Tim Hortons permanently ceased the collection of its users’ granular location data. Tim Hortons also, upon recommendation of the offices, deleted all the data it, and its third-party service providers, collected. The company is also implementing a privacy management program going forward to ensure compliance with PIPEDA. The investigation was launched in June 2020 because a Financial Post story had raised concern about the app used by Restaurant Brands International. The journalist found that that app tracked his location more than 2,700 times in less than five months when the app was closed. The offices investigated whether the company collected and used granular GPS-based location information “for a purpose that a reasonable person would consider appropriate in the circumstances, and was reasonable and to fulfill a legitimate need,” and if it obtained adequate consent from users to collect and use the data. The offices found that in May 2019 Tim Hortons updated its app and used Radar, an American third-party service provider, which on behalf of Tim Hortons collected and processed the users’ device location as often as every few minutes, to infer users’ homes, places of work, travel status, and when they were visiting a competitor. From its launch in 2017 through to July 2020, the app was downloaded by Canadians more than 8.6 million times and more than one million times internationally (downloads are not the same as distinctive users since an individual can download the app multiple times). Tim Hortons collected the granular location data for the purposes of delivering targeted advertising, however, the investigation found that its “actual use of the data was very limited” because the company decided to focus on other commercial priorities. The report states that Tim Hortons used the data on an aggregated, de-identified basis to conduct limited analytics related to user trends. The offices determined Tim Hortons lacked accountability because it collected the data for more than a year without using the information for its stated purpose. Its consent requests were also different across mobile platforms, and “inconsistent” with the app’s actual operation. “The consequences associated with the app’s collection of that data, the vast majority of which was collected when the app was not in use, represented a loss of users’ privacy that was not proportional to the potential benefits Tim Hortons may have hoped to gain from improved targeted promotion of its coffee and associated products,” the report reads. The investigators found that the language of the contractual clauses between Tim Hortons and Rader “was vague and permissive” which would have allowed the service provider to use the information for its own purposes, or disclose the data in an aggregated or de-identified form “which could still represent personal information,.” According to the report, the terms of the agreement read that Radar “will be free (during and after the term hereof) to (i) use such information and data to improve and enhance the services and for other development, diagnostic and corrective purposes in connection with the services and other company offerings…” Radar did not use or disclose the collected data for its own purposes. However, it still demonstrated inadequate user protection on the part of Tim Hortons, the report states. “We would have expected to see more robust protections, particularly given the volume and potential sensitivity of the location information in question, and heightened risk in the broader context of the current location tracking ecosystem,” the report reads. The offices did not recommend further changes to the Tim Hortons app itself because the current version is no longer tracking user location and the remaining location functionality merely identifies nearby Tim Hortons restaurants, the report states. – Reporting by Jenna Cocullo at jcocullo@thewirereport.ca and editing by Michael Lee-Murphy at mleemurphy@thewirereport.ca

Tim Hortons app violated privacy laws: privacy watchdogs

Broadcast | June 1, 2022

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Tim Hortons app violated privacy laws: privacy watchdogs

Broadcast | June 1, 2022

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Four cyber bills dead on the order paper as Parliament prorogued

Telus purchases Alberta fibre network O-Net

CRTC announces changes to Broadband Fund

CRTC launches consult on providing more info to consumers shopping for internet services

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us