![]() ![]() “As businesses increasingly look to deliver services electronically, they must carefully consider any consequential uses of personal information, which may require additional consent,” Dufresne said. It could also become sensitive if Meta combined it with other data it has about a user. ![]() One reason Home Depot believed it could rely on implied consent was that the information being shared with Meta was not “sensitive.” While the commission accepted that to be true in the specific context of measuring ad effectiveness, it said that the data could become sensitive if used to create a pattern of purchase behaviour and locations customers shopped at. ![]() Regardless, the commission said the activity was of the sort that Home Depot should have obtained opt-in consent and provided a clear explanation, based on provisions within PIPEDA and compliance guidelines it has previously issued. Second, those privacy policies did not provide a clear explanation of the practice. First, those privacy policies would not have been readily available to customers at the point they provide their email address. The retailer cited “consent fatigue” as a reason for not notifying customers of its information sharing with Meta.īut the commission rejected that argument on multiple grounds. Home Depot’s assertion was that by having customers agree to provide an email, it had received implied consent for the practice through both its own and Meta’s privacy policy, the latter of which explained the Offline Conversions program. “This information would have been material to a customer’s decision about whether or not to obtain an e-receipt.” “When customers were prompted to provide their email address, they were never informed that their information would be shared with Meta by Home Depot, or how it could be used by either company,” Privacy Commissioner Philippe Dufresne said in a statement. While participating in this kind of platform does not contravene privacy regulations, the commission’s investigation found that Home Depot had not properly obtained consent for collecting the data it used for these activities, nor did it inform customers that their data would be used this way. This was all part of Home Depot Canada using Facebook’s Offline Conversions platform, which allows advertisers to connect CRM and point-of-sale data to measure the impact of ads on offline events – such as in-store sales – as well as create custom audiences and target future ad campaigns. The commission also said that Home Depot authorized Meta to use that data for its own business activities, such as for targeting ads unrelated to Home Depot. Meta would match the email to an existing Facebook account and compare purchase info to ads a user may have seen as a way to measure effectiveness, providing the results in a report to the retailer. The data included a hashed version of the customer’s email, time of their purchase, the products purchased, which departments they were purchased from and which store the purchase was made at. However, the commission found that Home Depot also provided those emails and related in-store purchase data to Meta. Since 2018, Home Depot Canada has collected customer emails at checkout, with the stated purpose being for sending electronic purchase receipts. An investigation conducted by the Privacy Commissioner of Canada has determined that Home Depot Canada had provided Meta with customer email addresses and purchase data as part of an ad measurement program, without informing customers about how this data would be used. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |