PIPEDA findings #2018-007: Online marketplace needs consent from members before contacting them to join advocacy network
An anonymous complainant challenged an online marketplace's privacy practices after receiving an advocacy email without explicit consent. The complaint alleged unauthorized use of personal information for lobbying, inadequate handling of her privacy complaint, and unnecessary retention of data. The OPC found that the retention allegation was not well-founded. However, the OPC determined that the online marketplace failed to obtain adequate consent for sending advocacy emails and mishandled the complainant's privacy concerns, contravening PIPEDA Principles 4.3 and 4.10 respectively. The organization initially committed to corrective measures, including updating its privacy policy, providing an opt-out for advocacy messages, and improving its complaint handling process. Following the successful implementation of these recommendations, the OPC deemed the consent and challenging compliance matters well-founded and resolved.
- 1Whether the online marketplace obtained valid consent under PIPEDA Principle 4.3 for using email addresses to send advocacy emails.
- 2Whether the online marketplace adequately explained the purposes for using personal information such that the individual could reasonably understand how it would be used (PIPEDA Principle 4.3.2).
- 3Whether the form of consent obtained was appropriate given the reasonable expectations of the individual and the sensitivity of the information (PIPEDA Principles 4.3.4, 4.3.5, 4.3.6).
- 4Whether the online marketplace enabled the complainant to address concerns to the designated individual accountable for PIPEDA compliance (PIPEDA Principle 4.10).
- 5Whether the online marketplace implemented policies and practices to receive and respond to complaints and trained staff (PIPEDA Principles 4.1.4(b), 4.1.4(c)).
- 6Whether the online marketplace retained personal information longer than necessary for the identified purpose (PIPEDA Principle 4.5).
- Use of personal information: Inadequate consent for advocacy emails
- Handling of privacy complaint: Mishandled complainant's concerns
- Retention of data: Allegation not well-founded
Complaint well-founded and resolved (conditionally resolved initially)
The online marketplace failed to obtain adequate consent for using personal information to send advocacy emails and mishandled the complainant's privacy concerns, but later implemented the OPC's recommendations to resolve these issues. The allegation regarding personal information retention was not substantiated.
The Commissioner recommended the online marketplace update its privacy policy to clearly state its use of personal information for public policy communications, provide an easily accessible opt-out for such messages, and implement measures to ensure privacy complaints are appropriately recognized and escalated within the organization.
- Principle 4.1.4(b) PIPEDA
- Principle 4.1.4(c) PIPEDA
- Principle 4.3 PIPEDA
- Principle 4.3.2 PIPEDA
- Principle 4.3.4 PIPEDA
- Principle 4.3.5 PIPEDA
- Principle 4.3.6 PIPEDA
- Principle 4.5 PIPEDA
- Principle 4.10 PIPEDA
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro