Decisions/Federal (Canada)/Personal Information Protection and Electronic Documents Act/Commissioner’s Findings - PIPEDA Report of Findings #2014-001: Use of sensitive health information for targeting of Google ads raises privacy concerns

Federal (Canada)Office of the Privacy Commissioner of CanadaPersonal Information Protection and Electronic Documents ActCommissioner’s Findings - PIPEDA Report of Findings #2014-001Well-founded & conditionally resolved

Commissioner’s Findings - PIPEDA Report of Findings #2014-001: Use of sensitive health information for targeting of Google ads raises privacy concerns

Organization: Google Inc.

Decision: Jan 14, 2014Published: Jan 14, 2014

Official Decision ↗Bookmark View Governing Law

Plain-Language Summary

An investigation was launched after a complaint that Google's AdSense service delivered targeted advertisements for CPAP devices based on the complainant's online search for medical devices. The OPC found that Google used online behavioural advertising (OBA) to deliver these ads, which involved sensitive health information, without express consent. Google argued the ads were contextual, but the OPC determined they constituted OBA and contravened PIPEDA Principles 4.3 and 4.3.6 regarding consent for the use of sensitive information. Following recommendations, Google implemented remedial measures, leading to the complaint being conditionally resolved.

Key Issues

Was sensitive health information used for online behavioural advertising without express consent?
Did Google's practices comply with PIPEDA Principles 4.3 and 4.3.6 regarding knowledge and consent for the use of personal information?
Did Google's privacy policy accurately reflect its practices regarding the use of sensitive health information for targeted advertising?
Were Google's monitoring and compliance mechanisms adequate to prevent policy violations?

Outcome

Complaint well-founded and conditionally resolved

Reasoning

Google's practice of delivering targeted advertisements based on a user's online search for sensitive health information, without obtaining express consent, was found to be a contravention of PIPEDA Principles 4.3 and 4.3.6. Google's subsequent implementation of corrective actions led to the conditional resolution of the complaint.

AI-generated summary for reference only. Always verify against the official decision ↗

Decision Notes

Recommended action / remedy

Google was recommended to ensure that no sensitive interests would be used to deliver advertisements without express consent and to develop a more formalized and rigorous system for reviewing advertisements and addressing non-compliance.

Statutory provisions cited

Principle 4.3 PIPEDA
Principle 4.3.6 PIPEDA

This summary is informational only and not legal advice.