Canadian Marketing Association

Your comments:
November 17, 2017

Competition Promotion Branch
Competition Bureau
50 Victoria Street
Gatineau QC K1A 0C9

Via online feedback form

The Canadian Marketing Assoication (CMA) is pleased to offer some comments on the discussion paper recently published by the Competition Bureau (the Bureau) with regard to big data and its potential impact on competition law.

While the paper addresses several areas of concern to the marketing community, our remarks focus on the points raised in Section V of the paper, entitled "Big data and deceptive marketing practices".

We should note that our Association’s Code of Ethics and Standards of Practice requires strict adherence to the rules against deceptive marketing practices and misleading advertising. It also requires member organizations to abide by Canada’s privacy laws which require organizations to be transparent and accountable when it comes to data collection and use. These requirements are clearly set out and explained in the Code.

In addition to our self-regulatory code which helps to guide the activities of member organizations, CMA would like to highlight the fact that some of the issues considered by the Bureau have been traditionally handled by the Office of the Privacy Commissioner (OPC). The subject matter in section V of the paper such as online data collection or interest-based advertising (sometimes referred to as online behavioural advertising) intersects with privacy issues. Our concern is that there is no suggestion by the Bureau that regulation or enforcement should be coordinated with the OPC.

As such, we would like to provide comments on some of the issues raised in the paper, and highlight how several of them have traditionally been handled by the OPC, including the collection of personal information without knowledge and consent, indiscriminate collection, inadequate disclosure, and interest-based advertising.

Data collection without knowledge or consent Consent is a key element of the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private sector privacy law. Under PIPEDA, organizations are required to obtain meaningful consent for the collection, use and disclosure of personal information.

Principle 4.3 – Consent: The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.

Consent is considered meaningful when individuals are provided with clear information explaining what organizations are doing with their information. The OPC has already done a lot of work in this area. It has, for example, launched a consultation on the issue of consent under PIPEDA and produced a follow-up report in September 2017. The report outlines recommendations to address consent challenges posed by the digital age and indicates actions we will take.

Monetization vs. functionality

PIPEDA requires businesses to clearly identify the reasons for collecting personal information before or at the time of collection, and how it will be used. PIPEDA also specifies that businesses must limit their collection to what is necessary for the identified purposes.

Principle 4.4 – Limiting Collection: The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means. So before collecting any personal information, businesses are required under PIPEDA to carefully consider what they are collecting, why, how and what they will use it for, in order to ensure they have the right privacy practices in place.

Misleading consumers/ inadequate disclosure The Bureau’s discussion paper highlights the fact that if organizations make false or misleading representations about their collection of data, consumers may be led to provide information that they would not otherwise have provided. In considering the ‘false and misleading’ aspects of data collection one could assume that this would naturally fall under the purview of the Bureau, however apart from that these issues are already covered under PIPEDA. Several principles within the Act address this issue.

Principle 4.2 – Identifying Purposes: The purposes for which personal information is collected shall be identified by the organization at or before the time the information is collected.

Principle 4.3.2: The principle 4.3 requires “knowledge and consent”. Organizations shall make a reasonable effort to ensure that an individual is advised of the purposes for which the information will be used. To make consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed.

Another important mention is principle 4.3.5 which states in part that, in obtaining consent, the reasonable expectations of the individual are also relevant. It also requires that consent is not obtained through deception.

Interest-based Advertising

Interest-based advertising (IBA) is defined as tracking and targeting of individuals’ web activities, across sites and over time to serve advertisements that are tailored to those individuals’ inferred interests. Again, this is an issue which has been addressed by the OPC. For example, in 2015, the Office published a policy position with respect to IBA aimed at all parties involved in online tracking, profiling and targeting, including the advertising industry, browser developers, and web site operators.

This issue has also been recognized by industry through self-regulation. The Digital Advertising Alliance of Canada (DAAC) is a not-for-profit consortium of the leading national advertising, media agency, and marketing associations, whose members share a commitment to delivering a robust and credible self-regulatory program for responsible online interest-based advertising, known as AdChoices. The program is designed to provide transparency and choice to consumers as to whether they wish to have their browsing data used for serving interest-based ads. The program has a strong enforcement arm as well with Advertising Standards Canada being responsible for the accountability component of the AdChoices program for Canada. ASC monitors for program compliance and it accepts and investigates complaints about online interest-based advertising practices that may violate the Canadian self-regulatory principles for online behavioural advertising. The AdChoices program has been specifically designed to build upon PIPEDA’s principles for fair information practices, in particular PIPEDA’s accountability, transparency, and consent principles.

In conclusion, it is also worth noting that a certain degree of caution needs to be applied when citing to the enforcement activities of the U.S.Federal Trade Commission (FTC). While both the Competition Bureau and the FTC have as their mandate to regulate and enforce against anti-competitive behavior, deceptive marketing practices and misleading advertising, they differ in that the FTC also oversees issues relating to privacy practices of organizations through its deceptive marketing jurisdiction In Canada it is the OPC that has jurisdiction over such privacy practices. As such, we would like to highlight the fact that issues relating to data collection, use and disclosure are already being addressed under Canada’s privacy laws. The Competition Bureau needs to ensure that it does not overlap with the authority of another regulator. Such a situation could make it tougher and more confusing for organizations to comply with the requirements of two separate regulators. And where enforcement responsibilities and activities of the Bureau and OPC do necessarily intersect, we would highlight the importance of efforts to ensure businesses understand the compliance expectations of each agency and that efforts are made to coordinate both education and enforcement activities.

For questions or comments regarding this submission, please contact:

Cristina Onosé
Sr. Manager, Public Affairs
conose@theCMA.ca
416-644-3748

Wally Hill
VP, Government and Consumer Affairs
whill@theCMA.ca
416-644-3757

About the CMA: The Canadian Marketing Association embraces Canada’s major business sectors and all marketing disciplines, channels and technologies.The Association’s members make a significant contribution to the economy through the sale of goods and services, investments in media and new marketing technologies and employment for Canadians. Against this backdrop, the Canadian Marketing Association is the national voice for the Canadian marketing community, with CMA’s advocacy efforts designed to create an environment in which responsible marketing can succeed.