Condita Research
← Back to catalogue/Federal (Canada)PIPEDA Report of Findings #2017-002
Federal (Canada)Personal Information Protection and Electronic Documents ActWell-founded

PIPEDA Report of Findings #2017-002: Canadian adware developer Wajam Internet Technologies Inc. breaches multiple provisions of PIPEDA

Organization: Wajam Internet Technologies Inc.Complainant: Office of the Privacy Commissioner of Canada (OPC)
BookmarkView Governing Law
Plain-language brief

The Office of the Privacy Commissioner of Canada (OPC) initiated a complaint against Wajam Internet Technologies Inc., an adware developer, regarding its software's installation, consent, uninstallation, and data handling practices. The software, Wajam or Social2Search, tracked online search queries, overlaid social media results, and displayed contextual ads. The OPC investigated whether Wajam obtained meaningful consent for installation, allowed users to withdraw consent, and adequately safeguarded personal information. The investigation found that Wajam lacked a privacy accountability framework, failed to obtain meaningful consent due to problematic third-party distribution methods and misleading information, indefinitely retained unencrypted raw user data, and had insufficient safeguards. All examined matters related to accountability, consent, limiting retention, safeguards, and openness were found to be well-founded. Wajam, having sold its assets to a Hong Kong-based company, IMTL, claimed it was unable to implement the OPC's recommendations, though it agreed to securely destroy Canadian user data. The OPC requested Wajam provide the report to IMTL and stated it would monitor the situation and engage international counterparts.

Key issues
  1. 1Whether Wajam Internet Technologies Inc. had an adequate privacy accountability framework in place (Principle 4.1.4 PIPEDA)
  2. 2Whether Wajam obtained meaningful consent from individuals for the installation and operation of its software (Principle 4.3, 4.3.2, 4.3.5 PIPEDA, s.6.1 PIPEDA)
  3. 3Whether Wajam's third-party distribution model ensured meaningful consent for software installation
  4. 4Whether Wajam's multiple-offer consent screens provided sufficient information for meaningful consent
  5. 5Whether the information provided by Wajam about its software's functionality and privacy practices was accurate and complete (Principle 4.2, 4.3.2, 4.3.5 PIPEDA)
  6. 6Whether Wajam permitted users to withdraw consent by making it difficult to uninstall its software (Principle 4.3.8 PIPEDA)
  7. 7Whether Wajam was responsible for unsolicited ads and fake offers presented during the uninstallation process (Principle 4.3 PIPEDA)
  8. 8Whether Wajam limited the retention of personal information to only as long as necessary for identified purposes (Principle 4.5, 4.5.2 PIPEDA)
  9. 9Whether Wajam was open about its policies and practices relating to the management of personal information (Principle 4.8 PIPEDA)
  10. 10Whether Wajam adequately safeguarded users' personal information against loss, theft, or unauthorized access, including during transmission and storage (Principle 4.7.1, 4.7.2, 4.7.3 PIPEDA)
Outcome breakdownFavours: Applicant / complainant
  • Accountability framework: Found lacking
  • Meaningful consent: Found not obtained
  • Limiting retention: Found not adhered to
  • Safeguards: Found insufficient
  • Openness: Found lacking
  • Withdrawal of consent: Found not allowed
  • Data destruction: Agreed to destroy Canadian user data
Outcome

Complaint well-founded

Reasoning

The OPC found Wajam contravened multiple PIPEDA principles related to accountability, consent, limiting retention, safeguards, and openness, and Wajam was unable to implement corrective measures due to the sale of its assets.

AI-generated summary for reference only. Always verify against the official decision ↗
Decision notes
Recommended action / remedy

Wajam agreed to the secure destruction of its hard drives, including all personal information of users remaining in its possession. The OPC also requested Wajam provide a copy of the report of findings to IMTL.

Statutes considered
  • Principle 4.1.4 PIPEDA
  • Principle 4.1.4(a) PIPEDA
  • Principle 4.1.4(c) PIPEDA
  • Principle 4.2 PIPEDA
  • Principle 4.3 PIPEDA
  • Principle 4.3.2 PIPEDA
  • Principle 4.3.5 PIPEDA
  • Principle 4.3.8 PIPEDA
  • Principle 4.5 PIPEDA
  • Principle 4.5.2 PIPEDA
  • Principle 4.7.1 PIPEDA
  • Principle 4.7.2 PIPEDA
  • Principle 4.7.3 PIPEDA
  • Principle 4.8 PIPEDA
  • s.6.1 PIPEDA
  • s.11(2) PIPEDA
  • s.7.1(3) PIPEDA

This summary is informational only and not legal advice.

Pro · AI

Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.

Pro
Coverage — 13 of 14 jurisdictions searchable

Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.

Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).

Coming soon: Nunavut — being re-processed for AI search.

Find decisions like this one — by meaning, not keywords.

Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.

Upgrade to Pro