MyDemocracy website not designed in a privacy sensitive way
The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint regarding the MyDemocracy.ca website, operated by the Privy Council Office (PCO). The complainant alleged that despite promises of anonymity, the website used Facebook Connect tracking, potentially disclosing personal information to Facebook. The OPC found that the website's design led to the automatic disclosure of IP addresses and browser information to Facebook upon visiting the site, even before users chose to share content. While PCO made some changes and no evidence suggested PCO used the data to identify individuals, the OPC concluded that the initial disclosure was not consensual and violated section 8 of the Privacy Act. Consequently, the complaint was found well-founded.
- Disclosure of personal information to third parties (Facebook) without consent.
- Whether IP addresses and browser characteristics constitute 'personal information' under the Privacy Act.
- Adequacy of privacy notices and consent mechanisms for third-party data sharing.
- Failure to conduct a Privacy Impact Assessment (PIA).
Complaint well-founded
The OPC determined that the website's design facilitated the automatic disclosure of IP addresses and browser characteristics to Facebook, which constituted personal information that was disclosed without valid consent, contrary to section 8 of the Privacy Act.
AI-generated summary for reference only. Always verify against the official decision ↗
The OPC reiterated recommendations to PCO, including conducting privacy assessments (PIAs), ensuring consent for sharing personal information with third parties, providing clear notice at the point of collection, and meeting requirements for web analytics.
- section 8 of the Act
- section 3 of the Act
This is a summary of a decision for informational purposes only and does not constitute legal advice.