Archive for the ‘Privacy Online’ Category

20 Sep 2013

An update on our Internet privacy sweep

Last month, we released the initial results of our Internet privacy sweep. You can read the original blog post to see what we observed. (We should note here that the screenshots and references in that blog post reflect what we saw online during the sweep and were still in place when we originally blogged about the sweep results on August 13.)

As part of our efforts on the sweep, our Office advised the companies that were mentioned in the blog, inviting them to contact the OPC if they wished to discuss the Sweep and our observations.

Since that original post, we are very pleased to see that some of the organizations we highlighted have made changes to enhance their online privacy policies.

A&W changed its privacy policy shortly after we issued the results of our Privacy Sweep. Their original 110-word privacy policy has now been expanded to just under 1600 words and covers the collection, use, disclosure and retention of customers’ personal information collected through customer feedback, events, gift card purchases and contests.

Bell Media also updated their privacy policy shortly thereafter, fixing the broken link to their Privacy Officer’s email address:

 New Bell Media privacy policy

We think customers will be pleased as well to see that the companies they choose to do business with are more open and straightforward about how they use customer information.

Hopefully other companies we looked at, as well as those that didn’t, will take note.

10 Jun 2013

Fixing leaky faucets: Raising the bar of privacy protection

“Web leakage” research and follow-up work by the Office of the Privacy Commissioner of Canada has resulted in improvements to the privacy practices of some popular Canadian websites.

You may recall that our Office’s technologists tested 25 sites last year and found a significant number were “leaking” registered users’ personal information – including names and email addresses– to third-party sites such as advertising companies.

The research project prompted extensive discussions with the operators of 11 sites where concerns or questions were identified.

Positive changes

In the end, we’re happy to say that the initiative has resulted in a number of positive changes for Canadians:

  • Several organizations have taken measures to stop unintentional or unnecessary disclosures of personal information.
  • Many also agreed to take steps to ensure they provide consumers with clear, accessible information about their privacy practices.

All of the organizations cooperated with our Office and we were able to resolve our concerns in each and every case.  Here is a summary of the results of our work with the 11 sites:

  • In three cases, the site operators had been previously unaware that personal information was being disclosed to third parties, but took steps to ensure the disclosures stopped.
  •  In a further three cases, websites that had been intentionally sharing information such as email addresses to third parties, but agreed to stop after we questioned the practice.  Another organization was looking at whether its site could be re-designed to prevent sharing with two of its online service providers.
  • One organization acknowledged that personal information was being shared with  third-party service providers in order to manage its website – even though its privacy policy states personal information is not made available to third parties.  The organization is in the midst of making changes to its privacy policy to provide greater clarity.
  •  In other cases, our discussions with organizations confirmed that no information was being disclosed to third parties beyond that found in our research – for instance, postal codes.  As a result, we determined the disclosed information was not personal information.

Of course, our initiative involved a very small sample of sites and “web leakage” concerns are not confined to the organizations identified in our research.  All web site operators and third parties should review the personal information they share and test own sites to check whether data is unintentionally leaking.

Issues beyond “web leakage”

During our work, it became apparent that organizations’ privacy practices, such as the legitimate sharing of information with third parties, were not always disclosed in a meaningful way to consumers.

Commissioner Stoddart has expressed concern about privacy policies that are too long, too convoluted, and, as a result, tend to be largely ignored by users.

Organizations should have clear, descriptive privacy policies.  Our Office has also started looking at other practices that could also be adopted to help inform people about how their personal information will be handled.  For example, we like just-in-time notifications – providing explanations of privacy practices when data is collected.

To that end, we were pleased that several organizations committed to improve the way in which they tell consumers about their personal information handling practices.  For example, some are reviewing their privacy policies and exploring more innovative ways – such as just-in-time notices – to provide privacy information.

All of these steps will go a long ways to help ensure these organizations have obtained informed consent for the collection, use and disclosure of personal information online – as required under Canadian privacy law.

And since the issues we identified have been addressed, the Privacy Commissioner has decided not to exercise her power to name these organizations.

Given our study has revealed systemic issues in this area, our Office is developing a guidance document on best practices with respect to how organizations obtain informed consent from Canadians for the collection, use and disclosure of personal information in the online world. We expect to publish the guidance document later this year.

29 Apr 2013

Grappling with the impact technology is having on privacy

This week is Privacy Awareness Week (PAW) – a global effort, coordinated by members of the Asia Pacific Privacy Authorities (APPA), to raise awareness about the value of privacy and the importance of protecting it.

For PAW 2013, APPA created an infographic that illustrates how technology has changed the way we communicate, do business and store information, and how this has introduced new privacy risks as a result.

It is an issue that many are thinking about. According to OPC’s recent survey, Canadians are increasingly anxious about their privacy in the face of new technology, and 70 per cent of them feel they have less protection of their personal information than they did 10 years ago. The research also indicates that Canadians avoid downloading apps or using certain websites and services due to privacy concerns.

What can we do?

It is true that consumers expect protections when they use products and services, but it is important to also realize that consumers have an important role to play and need to take an active approach when it comes to protecting their personal information. The best thing anyone can do, when using technology to collect or store personal information, is to understand the privacy risks that come with that technology. And here are some resources to help with that task:

Mobile App: We use our mobile devices to store a goldmine of personal information. To learn more about how to protect the personal information on your mobile device, download the OPC’s free myPRIVACYapp.

Video: Privacy and Social Networks: Do you know what happens to your personal information once you post it on to social networking sites? Watch this video that OPC created to understand how social networking sites make money off of your personal information. It may cause you to ask yourself some tough questions the next time you update your information online.

Infographic: 10 tips for preventing identity theft: Anyone who has personal information is at risk of identity theft, and the risks are higher now that we use technology for so many purposes. And while it’s impossible to entirely eliminate the risk of becoming a victim, it is possible to reduce it. The OPC’s infographic details 10 things you can do to prevent yourself from becoming a target.

Introduction to Cloud Computing: When you store your photos online instead of on your home computer, or use webmail or a social networking site, you are using a “cloud computing” service. The OPC’s fact sheet explains the privacy implications of this.

For more information on the privacy risks that come with technology, and on how to protect yourself, visit the OPC’s page of fact sheets covering a range of issues and topics.

26 Sep 2012

New presentation helps kids in grades 4 to 6 understand their online footprint

Canadian kids are communicating online more than ever before, and are using tools like Skype sometimes even before they learn to walk. Many of us are astonished at how easily they adapt to new devices that connect to the Internet and at how these devices can quickly become part of their lives, as they use them to chat, surf, post, play and learn.

Many kids, however, don’t fully understand the impact that some online activities have on their privacy. They don’t understand the digital footprint they are leaving behind.

For this reason, the Office of the Privacy Commissioner of Canada has added a new component to its Protecting Your Online Rep presentation series. Today, we are launching Understanding Your Online Footprint: How to protect your personal information on the Internet, a presentation for young people in grades 4 to 6. The package includes slides, speaking notes and discussion topics for educators, community leaders and parents to speak with young people about online privacy.

The new presentation is packed with practical advice and features graphics and speaking notes that are tailored to the social realities and online activities of kids in grades 4 to 6. The goal of this tool is to help demonstrate how kids in this age group can use the Internet and have fun, without giving away too much of their personal information.

If you haven’t already checked them out, make sure to look at the presentation package for students in grades 7 and 8 (Secondary I to II in Quebec) and the presentation package for students in grades 9 to 12 (Secondary III to V in Quebec).

And if you have any questions or comments about our latest presentation, please let us know in the comments section below. Your feedback helps us improve the resources we develop.

6 Jun 2012

Graphic Novel: A New Tool to Help Younger Canadians Understand and Navigate Online Privacy


Graphic novel Cover: Social Smarts: Privacy, the Internet and You

The Privacy Commissioner has launched a new tool to help young Canadians understand and navigate privacy issues in the online world: a graphic novel entitled Social Smarts: Privacy, the Internet, and You.

The story follows Dave and Amy, a brother and sister who walk into their new school only to find that students they’ve never met before know all about them from their social network pages.

Guided by a talking smart phone, Dave, Amy and their classmates learn how their choices affect their reputations. In the end, they gain a better understanding of both what’s happening ‘behind the scenes’ and how to reduce the privacy risks associated with social networking, mobile devices, and online gaming.

Copies of the 12-page graphic novel – a first for our Office – can be downloaded from our website and printed.

The graphic novel complements a youth video, parent tips and a presentation package for educators released earlier this year.

To download a copy of the graphic novel, visit:

5 Jun 2012

Evolving technologies creating new privacy risks for youth

Image of children speaking on cell phones

Young people are embracing new digital communication technologies at earlier and earlier ages.  While they recognize the importance of protecting their privacy, they’re often not aware of the potential privacy risks that can accompany these novel technologies.

A recent study found that a third of North American Gen-Y moms (aged 18 to 27) let their children use a laptop by age two. According to the Joan Ganz Center in New York, by age three, those laptops and tablets are connected to the Internet daily for about a quarter of U.S. kids. By age five, the proportion online soars to half.

But what is being done to educate these children to the privacy risks they face when they use online games, applications, social networks, mobile devices and geo-location?  

It’s critically important to empower our children to make well-informed decisions in this increasingly complex online environment.

In our 2011 Personal Information Protection and Electronic Documents Act Annual Report, tabled today, the Office of the Privacy Commissioner of Canada focuses on children and youth privacy.

The report outlines our recent work on the issue, including our first investigation of a youth-oriented social networking site; investigations of three complaints against Facebook; as well as an investigation into a complaint about a daycare’s use of webcam monitoring.

3 May 2012

Accountability and the Importance of Effective Privacy Management Programs for Businesses

Accountability matters when it comes to privacy. As a business, though, you may not always find it clear what accountability really means when it comes to personal information protection.  

Accountability is the first fair information principle in the federal Personal Information Protection and Electronic Documents Act (PIPEDA). This reflects its importance—it is the bedrock of the Act. It’s also implicit in Alberta and British Columbia’s respective privacy laws, the Personal Information Protection Act (PIPA).  The principle outlines the things organizations need to do to have a compliant and accountable privacy program in place.  But what does that mean in practice?

To help businesses “get accountability right”, Alberta, BC and our Office have released new guidelines —Getting Accountability Right with a Privacy Management Program. These new guidelines outline the elements of an effective privacy management program and offer scalable strategies that can be implemented by any size business.

Why should you care? 

These new guidelines outline how our offices view effective privacy management.  Big or small, an accountable business should be able to demonstrate to Privacy Commissioners that they have an effective, up-to-date privacy management program in place in the event of a complaint investigation or audit.  

Compliance, of course, is essential.  But we think there are a number of other benefits to having a privacy management program in place:

  • An organization that has a strong privacy management program may enjoy an enhanced reputation that gives it a competitive edge.
  • A privacy management program helps foster a culture of privacy throughout an organization and offers reassurance to customers and clients
  • Proper use of risk assessment tools can help prevent problems. Fixing a privacy problem after the fact can be costly so careful consideration of the purposes for a particular initiative, product or service, and an assessment that minimizes any privacy impacts beforehand is vital.
  • With a privacy management program, organizations will be able to demonstrate to customers, employees, partners, shareholders, and privacy commissioners that they have in place a robust privacy program that shows only compliance with privacy laws in Canada, but also that they are taking protection of personal information seriously.

Related Documents:

Guidelines: Getting Accountability Right with a Privacy Management Program

Interpretations: “Accountability”

Announcement: Commissioners Outline Building Blocks for Effective Privacy Management

30 Apr 2012

Privacy Awareness Week 2012: Privacy Resources for Young People

Young people today are sophisticated users of the Internet, using this medium with ease and enthusiasm. It is important that they understand the impact that these technologies can have on their privacy, and that they have the tools and information they need to make smart decisions.

That’s why the Asia Pacific Privacy Authorities (APPA) forum, which includes the Office of the Privacy Commissioner of Canada, has made Privacy Resources for Young People the theme of Privacy Awareness Week 2012, April 29 – May 5.

Since 2008 our Office has been developing a variety of tools designed to teach young people about the relevance and importance of privacy when using modern technologies. The OPC has a Privacy Awareness Week 2012 web page with links to all of our privacy resources for youth, parents and educators, as well as links to privacy resources for youth developed by members of the APPA forum, at:

If you would like more information on youth privacy, or to stay informed regarding our tips and tools for parents, educators and youth, visit the Office’s youth website at:

You can also visit for links to a wide variety of international privacy guidance including tips, animations, brochures, discussion topics and interactive website materials.

We also encourage you to follow us on twitter: @privacyprivee, Privacy Awareness Week: #2012PAW.

29 Mar 2012

2011-2012 Youth Video Contest: The Results Are In!

The Office of the Privacy Commissioner of Canada would like to extend tremendous thanks to all of the students, teachers and schools who participated in our myprivacy & me national video contest this year.

We would also like to express sincere thanks to Encounters with Canada, and the teens participating in its Politics in Canada week, who selected our winners.

Winning Videos:

The top video artists in the Privacy Issues Related to Cybersecurity category were:

1st place: Brooke Davis and Alyssa Lynn of Hillcrest High School, Ottawa, ON, with a video titled “Your Online Life.”

The top video artists in the Privacy Issues Related to Mobile Devices category were:

1st place: Matt Paddison and Julian Figueroa of Chatelech Secondary School, Sechelt, BC, with a video titled “Your Phone is Your Everything.”

2nd place: Fumina Takara and Maryam Hashim of Hillcrest High School, Ottawa, ON, with a video titled “Mobile Information.”

The top video artists in the Privacy Issues Related to Online Gaming category were:

1st place: Benjamin Reyes and Zachary Spence of Canterbury High School, Ottawa, ON, with a video titled “Credit and Safety.”

2nd place: Mason Wik and Pierce Thomson of F.R. Haythorne Junior High, Sherwood Park, AB, with a video titled “Game Over.”

The top video artists in the Privacy Issues Related to Social Networking category were:

1st place: Pamela Khouri and Hannah Chan of Collège Jean de la Mennais, La Prairie, QC, with a video titled “Unknown Exposure.”

2nd place: Wajid Jawid Ahmad and Dawut Esse of Centre d’action bénévole Bordeaux-Cartierville, Montreal, QC, with a video titled “Spoken Words Are Fleeting… Written, They Remain.”

3rd place: Katie Fitzgerald of Lorne Akins Junior High School, St. Albert, AB, with a video titled “Words Have Life.”

Congratulations to all of our winners!

27 Mar 2012

Privacy: Not just good business, but good for business

A recently released study has given further evidence to the link between privacy and personal information protection and consumer confidence.

The Edelman study  released in February 2012 shows that consumer concerns about data privacy and security are actively diminishing their trust in organizations.  For instance, 92% listed data security and privacy as important considerations for financial institutions, but only 69% actually trusted financial institutions to adequately protect their personal information.  An even sharper disconnect can be seen with online retailers, with 84% naming security of personal information as a priority but only 33% trusting online retailers to protect it.

It’s hardly surprising that consumers are nervous.  Stories about privacy and security flaws and breaches abound in the media these days.  From flaws in mobile applications, retroactive release of archives for marketing, service amalgamation and data breaches, users are constantly confronted with evidence that their personal information is at risk.  Lack of transparency on the part of organizations and consumer discomfort with cross-border data traffic, outsourcing and cloud storage only further exacerbate the issue.

This challenge to trust appears to correlate to an increased willingness on the part of consumers to invest in their privacy.  Where a 2009 study concluded that consumers were unwilling to pay extra for privacy, recent research from the European Network and Information Security Agency (ENISA) finds that individuals weigh security and privacy considerations as heavily as those relating to a product’s design, style, and physical dimensions. All other things being equal, the study discovered that consumers were willing to pay a higher price in order to protect their privacy. 

Investing in privacy is not the only way that consumer concerns are indicated – the Edelman data also shows nearly 50% of participants either leaving or avoiding companies that have suffered a security breach.  Following a data breach suffered by an organization with whom they’re already involved, up to 70% of those surveyed expressed willingness to terminate a relationship or switch providers. 

Findings like this should be a wake-up call for organizations, an indicator that it is no longer enough to “manage” security and privacy concerns. Instead, privacy and security need to be prioritized and strengthened to the point where they can be made key parts of branding and corporate identity.   Consumer confidence is key, and reliant upon trust. And new evidence increasingly shows that privacy is not only good business – it’s good for business.