MyDemocracy website not designed in a privacy sensitive way
The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint against the Privy Council Office (PCO) regarding its MyDemocracy.ca website. The complainant alleged that the website used "Facebook Connect" tracking, sharing user data with Facebook despite promises of anonymity. The OPC found that the website's design facilitated the disclosure of personal information, including IP addresses, browser characteristics, and for logged-in users, Facebook IDs, to Facebook upon loading the homepage and initiating share actions, without obtaining consent. PCO argued that the design was standard and that the shared data did not constitute identifiable personal information. However, the OPC concluded that this constituted a disclosure of personal information under section 3 of the Privacy Act and that PCO failed to meet its obligations under section 8. The complaint was found to be well-founded, and the OPC reiterated recommendations for PCO to ensure privacy-sensitive design, conduct PIAs, and obtain meaningful consent for future initiatives.
- 1Whether the MyDemocracy.ca website's design led to the disclosure of personal information to third parties (Facebook, Google Analytics) without consent.
- 2Whether IP addresses, browser characteristics, and unique URLs constitute "personal information" under section 3 of the Privacy Act.
- 3Whether the Privy Council Office (PCO) met its obligations under section 8 of the Privacy Act regarding the disclosure of personal information.
- 4Whether PCO's amendments to the website and privacy policy were sufficient to obtain meaningful consent for data disclosure.
- 5Whether PCO should have conducted a Privacy Impact Assessment (PIA) for the MyDemocracy.ca initiative.
- 6Whether the collection of demographic information was justified and compliant with relevant standards.
- 7Whether the use of Google Analytics complied with the Treasury Board of Canada Secretariat's (TBS) Standard on Privacy and Web Analytics.
- Disclosure of personal information: Disclosure of personal information found
- Compliance with Privacy Act s.8: PCO failed to meet obligations
- Complaint outcome: Complaint well-founded
- Recommendations: Recommendations issued to PCO
Complaint well-founded
The OPC found that PCO's website design facilitated the disclosure of personal information (IP addresses, browser characteristics, and Facebook IDs for logged-in users) to Facebook upon loading the homepage and initiating share actions, without obtaining consent, thus contravening section 8 of the Privacy Act.
The Commissioner recommended that PCO ensure necessary privacy assessments (PIAs) are conducted for future initiatives, take steps to prevent privacy risks from third-party components by obtaining consent for personal information sharing, inform individuals of all purposes for data collection and disclosure at key decision points, ensure privacy policies accurately reflect practices, and meet appropriate requirements for web analytics use.
- s.3 Privacy Act
- s.8 Privacy Act
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro