Whether it’s an unpopular political view, a particular sexual appetite or an unflattering medical condition, there is some sensitive information that Canadians would rather be kept just between them and their Web browser.
But a new ruling from the Office of Canada’s Privacy Commissioner against Web search giant Google Inc. is shining a light on a somewhat vague area of Canadian legislation around what constitutes “sensitive” information online.
In this particular case, a Canadian man found that after he scoured the Web for information related to sleep apnea — a health condition which significantly hampers breathing during sleep — Google began targeting the man with ads related to medical devices used to treat that condition.
According to the privacy commissioner’s office, because the information used to target the ads was health-related, it should have been considered sensitive, and therefore should have been exempt from Google’s main business model: selling and delivering ads based on online activity.
Yet, exactly what constitutes “sensitive” information under the Personal Information Protection and Electronic Documents Act (PIPEDA) isn’t always clear, not just for tech companies like Google, but also for millions of consumers who never really know when Google, Microsoft and Yahoo’s all-seeing ad servers are and are not watching them.
According to Interim Privacy Commissioner Chantal Bernier, PIPEDA does not make a black-and-white distinction between what information is considered sensitive and what is non-sensitive.
Under the statutes of PIPEDA, it is up to the organization collecting the data (in this case, Google) to identify what is sensitive information and ensure it is not used improperly, she said.
“There are other pieces of legislation in other countries that actually make that distinction. Canada does not,” she said in an email statement to the National Post.
“The premise of the act [PIPEDA], is that the organization can not collect more information than it needs. We interpret that to exclude any information, that could be harmful to the individual, being collected beyond the needs of the company … for example, medical information or financial information.”
In its ruling, the Privacy Commissioner stated that the man who registered the complaint visited sites that offered information about sleep apnea treatment machines, which resulted in a cookie — a small piece of data — being placed in his Internet browser. That cookie then triggered ads for sleep apnea devices, which appeared on his screen when he visited other Websites that use Google’s advertising services.
Google’s own policies state that advertisers are not allowed to target ads based on areas of “sensitive information,” including data related to a user’s gender, race, health or financial information.
However, according to the Commissioner’s office, Google officials acknowledged that some of its clients fail to comply with the company’s advertising policies, which are designed to prevent targeting ads relating to sensitive information.
While there are variations between different markets about what does and does not meet the sensitivity test for an entire population, experienced companies like Google tend to have a great deal of expertise assessing whether a particular type of information is sensitive or not, said Tamir Israel, staff lawyer at the Canadian Internet Policy & Public Interest Clinic (CIPPIC).
“It is a complex area in the sense that it’s a very contextual analysis, so what is not objectively sensitive in one context may be in a different context,” he said.
“But where there is a lot of guidance for companies is there are some categories of information that are generally considered sensitive, like medical information and financial information.”
As a result of the investigation, Google has agreed to make a number of changes to improve staff oversight and its monitoring practices. Google expects the recommendations to be fully implemented by June 2014.
“We’ve worked closely with the Office of the Privacy Commissioner throughout this process and are pleased to be resolving this issue,” Leslie Church, Google Canada’s head of communications and public affairs, said in an email to the Financial Post.
Still, Ms. Bernier said the ruling shows the need for greater oversight.
“We need stronger laws,” Ms. Bernier said.
“The fact is the users are really, almost defenseless — we find that the balance between these tech giants and the users is becoming more and more uneven, and to restore that balance between the users and the companies, we need to have regulators with stronger enforcement powers.”
With files from Armina Ligaya