The Competition Bureau of Canada has taken its first enforcement action against an organization for allegedly violating Canadian truth in advertising laws by making false and misleading representations about its privacy practices. The enforcement action demonstrates the Bureau’s willingness to use its enforcement powers, including imposing significant administrative monetary penalties, to protect Canadian consumers against false or misleading privacy policies.
Privacy laws
Under Canadian privacy laws, private sector organizations are generally required to obtain individuals’ meaningful consent to the collection, use and disclosure of their personal information. Organizations commonly rely on their published privacy policy to obtain meaningful consent from their customers and other individuals with whom they interact. To be effective, a privacy policy must be accessible and provide a clear, comprehensive and understandable description of the organization’s personal information policies and practices. Canadian privacy commissioners have issued guidance regarding the form and content of privacy policies, including Guidelines for obtaining meaningful consent, Ten tips for a better online privacy policy and improved privacy practice transparency, and Guidelines for Online Consent.
Unlike privacy regulators in other jurisdictions, Canadian privacy commissioners have limited enforcement powers and practically no ability to impose fines on organizations that publish false or misleading privacy policies or fail to comply with their published privacy policies. The federal government’s May 2019 Digital Charter and related report titled Strengthening Privacy for the Digital Age contemplate modernizing Canadian privacy laws, including giving the Privacy Commissioner of Canada more robust enforcement powers. Similarly, provincial governments are considering giving their privacy commissioners enhanced enforcement powers. See BLG bulletin Proposed amendments to Québec privacy law: Impact for businesses. The proposed legislative changes have not yet been made.
Truth in advertising laws
The Competition Act prohibits making a materially false or misleading representation to the public to promote the supply or use of a product or service or a business interest. A representation is “material” if it could influence a consumer to buy or use the promoted product or service. The general impression conveyed by a representation, as well as its literal meaning, must be considered when determining whether the representation is false or misleading in a material respect, and it is not necessary to establish that any person was deceived or misled by the representation.
The Competition Bureau is the independent law enforcement agency responsible for the administration and enforcement of the Competition Act. The Competition Act establishes two regimes – a criminal regime and a civil regime – to address false or misleading representations. Under the criminal regime, a conviction is punishable by a fine (up to $200,000 on summary conviction and in the court’s discretion for conviction on indictment) and imprisonment (up to one year on summary conviction and up to 14 years on conviction on indictment). Under the civil regime, proceedings before the Competition Tribunal or a court can result in cease and desist orders and potentially significant administrative monetary penalties (i.e., fines) against corporations (up to $10 million for a first occurrence and up to $15 million for subsequent occurrences) and individuals (up to $750,000 for a first occurrence and up to $1,000,000 for subsequent occurrences).
Competition Bureau and consumer privacy
In January 2020, the Competition Bureau’s Deputy Commissioner Palumbo reiterated the Bureau’s previously stated intention to “ensure truth in advertising by addressing misleading claims about consumer privacy” by taking enforcement action against firms that “make false or misleading statements about the type of data they collect, why they collect it, and how they will use, maintain and erase it”. The Deputy Commissioner explained that the Bureau’s approach is complementary to the Privacy Commissioner of Canada’s mandate to protect the privacy rights of Canadians.
The Competition Bureau’s March 2020 Deceptive Marketing Practices Digest also explained that the Bureau will invoke the truth in advertising provisions of the Competition Act when businesses make false or misleading representations to consumers about the collection and use of consumers’ data, including in connection with “non-monetary” transactions for free services. The Digest explains the Bureau’s view that the representations most likely to raise legal compliance issues are those that create a false or misleading general impression about the following key issues: (1) whether consumer data will be collected; (2) what consumer data will be collected; (3) how often consumer data will be collected; (4) why consumer data will be collected and what it will be used for; (5) whether consumer data will be sold to, or otherwise shared with, third-parties; (6) whether consumer data will be retained, and how it will be maintained and deleted; and (7) the level of control that consumers have regarding those issues.
On May 19, 2020, the Competition Bureau announced a settlement with Facebook Inc. for alleged false or misleading representations (including in privacy settings, privacy controls and about pages) by Facebook about the privacy and sharing of its users’ personal information. The settlement agreement states that Facebook disputes the Bureau’s allegations but voluntarily cooperated to resolve the issues identified by the Bureau. As part of the settlement, Facebook agreed to pay a $9 million administrative monetary penalty and $500,000 in costs, and further agreed to not make any materially false or misleading representation about its disclosure of its users’ personal information or how its users can control who can access their personal information. The settlement agreement, which lasts for ten years, also requires Facebook to maintain a corporate compliance program and gives the Bureau monitoring rights.
Key takeaways
Organizations operating in Canada now face the prospect of scrutiny of their privacy practices and related representations by both the Competition Bureau and Canadian privacy commissioners, and potentially significant financial penalties (resulting from enforcement action by the Bureau) for false or misleading representations about their privacy practices.
To avoid inadvertent violation of Canadian truth in advertising laws, organizations should periodically take steps (including conducting comprehensive privacy audits) to ensure that their privacy policies, marketing materials and other statements accurately describe their collection, use, disclosure (including sharing with third parties), retention (including security safeguards) and deletion of consumers’ personal information, and the control that consumers have over those activities.
Organizations should also be mindful of privacy commissioner guidance, including the 2018 Guidelines for obtaining meaningful consent, for legally compliant privacy policies. See BLG bulletins Preparing for Compliance with New Privacy Consent Guidelines and Five Steps to Compliance with Privacy Consent Guidelines.
