PIPEDA Findings #2022-001: Joint investigation into location tracking by the Tim Hortons App
A joint investigation by federal and provincial privacy authorities found that the Tim Hortons App continuously tracked users' granular location data, often every few minutes, even when the app was closed. This data was used to infer home, work, travel status, and visits to competitors. The Offices concluded that Tim Hortons collected this sensitive information for an inappropriate purpose, as it never used the data for its stated goal of targeted advertising, and the privacy loss was disproportionate to any potential benefits. Furthermore, Tim Hortons failed to obtain valid consent, making misleading statements that the app only tracked location when open and not adequately informing users of the extensive nature and consequences of the tracking. Concerns were also raised about inadequate contractual protections with the third-party service provider, Radar, and a broader lack of accountability within Tim Hortons' privacy management. The matter was found well-founded and conditionally resolved, as Tim Hortons agreed to delete the collected data and establish a comprehensive privacy management program.
- 1Whether Tim Hortons collected or used personal information for an appropriate purpose under the Acts.
- 2Whether Tim Hortons obtained valid consent for the collection and use of granular location data.
- 3Adequacy of contractual protections for personal information transferred to third-party service providers.
- 4Tim Hortons' accountability and implementation of a privacy management program.
- Purpose of collection: Collection for inappropriate purpose
- Validity of consent: Consent found invalid
- Contractual protections: Inadequate third-party contracts
- Accountability: Lack of privacy management accountability
- Resolution: Complaint well-founded and conditionally resolved
- Remedy: Data deletion and privacy program ordered
Well-founded and conditionally resolved
The OPC found that Tim Hortons contravened privacy laws by collecting sensitive location data for an inappropriate purpose and without valid consent, but the company committed to deleting the data and implementing a privacy management program to address the issues.
Tim Hortons agreed to delete all granular location data and derived data (once litigation holds are lifted) and establish a comprehensive privacy management program for its apps within 12 months, including processes for necessity, proportionality, and consistent privacy communications.
- subsection 5(3) PIPEDA
- Principle 4.3 Schedule 1 PIPEDA
- section 6.1 PIPEDA
- Principle 4.1.3 Schedule 1 PIPEDA
- section 5 Quebec's Private Sector Act
- section 6 Quebec's Private Sector Act
- section 8 Quebec's Private Sector Act
- section 10 Quebec's Private Sector Act
- section 12 Quebec's Private Sector Act
- section 14 Quebec's Private Sector Act
- section 2 PIPA-AB
- section 5 PIPA-AB
- subsection 7(1) PIPA-AB
- section 8 PIPA-AB
- section 10 PIPA-AB
- section 11 PIPA-AB
- section 34 PIPA-AB
- section 4(2) PIPA-BC
- section 6 PIPA-BC
- subsection 7(1) PIPA-BC
- subsection 7(3) PIPA-BC
- section 8 PIPA-BC
- section 11 PIPA-BC
- section 34 PIPA-BC
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro