ASET Technology Alberta Spring 2023 - 14

CONSUMER DATA PRIVACY CONCERNS
Cybercriminals aren't the only ones with designs on our
digital data; it's the companies themselves that give us a
content platform in the first place.
" It's not about who you think your
audience is; it's about who controls that
data. And not only what's in their [terms
and conditions] today, but who they can
sell that data to. And the things they
don't say are all the other things they
can do with your data that they haven't
come up with yet, " Lynch said.
" They can use your likeness, they can use it in their marketing
campaigns, they can sell all the data that they collect from
their app being on your phone, which is the locations you've
been to, where you check in, who you talk to, who your contacts
are, and build this whole ecosystem of your life in digital
format. And who knows what they can do with that? "
The situation Lynch outlined above happened almost beat
for beat with the Tim Hortons app. A report out of the federal
Office of the Privacy Commissioner, based on a joint investigation
with its provincial partners, revealed hidden aspects
of the app's user data collection.
Among other things the investigation revealed that the app
was tracking and recording users' movements every few
minutes of every day. The tracking continued even when the
app was closed, despite the app telling users that wouldn't
be the case. The app used that data to infer where users
lived, work and when they travelled. An 'event' was also
generated when users entered or left a competitor, a major
sports venue, or their home or work.
Home Depot was the subject of a joint investigation too,
for failing to obtain customer consent before it shared their
email addresses and purchase information with Meta. Home
Depot collected customer emails at checkouts, ostensibly
to provide e-receipts. Those emails and purchase details
were then sent to Meta, to see how effective Home Depot's
ads on Facebook were for conversions.
" Meta's Offline Conversions contractual terms also allowed
it to use the customer information for its own business purposes,
including user profiling and targeted advertising, unrelated
to Home Depot, " a release based on the investigation
wrote.
Adding to the bad publicity, both companies were handed by
the OPC a list of recommendations to follow. While they each
agreed to follow the recommendations, the OPC wouldn't
have had any legal power with which to go on the attack had
they resisted.
" Under [the Personal Information Protection and Electronic
Documents Act (PIPEDA)], our Office does not currently
have the power to make orders or issue fines, " OPC Senior
Communications Advisor Vito Pilieci wrote in an email, in
response to questions about the OPC's enforcement powers.
While the office doesn't have that power, it has other
avenues available.
" The Commissioner may seek resolution of a complaint
through negotiation, persuasion and mediation and may
make recommendations to help prevent issues from recurring.
Where an organization does not comply with our
recommendations, our Office can seek an order, and other
remedies, via application to the Federal Court, " Pilieci wrote.
Even though the federal OPC doesn't have the definitive
power to enact more serious consequences, Pilieci did note
that their provincial partners in the joint investigation of Tim
Hortons do have such powers under their respective privacy
laws.
Stories like these raise questions about how widespread
such discrepancies are, for instance among other apps.
As an investigation from Mozilla Foundation revealed, what
certain companies share about their data collection in one
area doesn't align with their official rules in another. The report
compared what the top 40 most downloaded apps reported
on the Google Play Store's Data Safety Form against
the apps' actual privacy policies and found discrepancies for
80 per cent of the apps reviewed. The data safety form's purpose
is to provide a transparent way for companies to report
how they collect and share user data before you download an
app on the store. The form is completed by the app developer.
Of those apps, the report stated that TikTok was the biggest
offender.
" In Google's app store, the popular video app claims it does
not share your data with third parties. In fact, TikTok's own
privacy policy states that it shares data with other companies
- including Facebook, " Mozilla's coverage of the findings
read.
TikTok wasn't the only app in which inconsistencies were
found. Facebook, Twitter and Snapchat all fared worse in
the report, scoring a " poor " rating in the grading table for
the top 20 free apps.
14 | SPRING 2023 | TECHNOLOGY ALBERTA

https://priv.gc.ca/en/opc-news/news-and-announcements/2022/nr-c_220601/ https://foundation.mozilla.org/en/campaigns/googles-data-safety-labels/#research-findings https://priv.gc.ca/en/opc-news/news-and-announcements/2023/nr-c_230126/ https://foundation.mozilla.org/en/privacynotincluded/articles/tell-tiktok-stop-misleading-android-users-and-provide-full-transparency-about-your-privacy-practices/?utm_source=twitter&utm_campaign=23-TikTok&utm_medium=social&utm_term=en https://foundation.mozilla.org/en/privacynotincluded/articles/tell-tiktok-stop-misleading-android-users-and-provide-full-transparency-about-your-privacy-practices/?utm_source=twitter&utm_campaign=23-TikTok&utm_medium=social&utm_term=en

ASET Technology Alberta Spring 2023

Table of Contents for the Digital Edition of ASET Technology Alberta Spring 2023