Canadian privacy & access decisions

A joint investigation by the Office of the Privacy Commissioner of Canada (OPC) and provincial privacy regulators (CAI, OIPC BC, OIPC AB) examined TikTok Pte. Ltd.'s compliance with federal and provincial private sector privacy laws. The investigation focused on TikTok's collection, use, and disclosure of personal information for ad targeting and content personalization, with a particular emphasis on practices affecting children. The Offices found that TikTok's age assurance measures were inadequate, leading to the collection and use of sensitive personal information from a large number of underage users for purposes deemed inappropriate. Furthermore, TikTok failed to obtain valid and meaningful consent from both adult and youth users due to unclear, inaccessible, and incomplete privacy communications, including regarding biometric information and cross-border data transfers. The CAI specifically identified contraventions related to Quebec's transparency and privacy-by-default obligations. While TikTok disagreed with the findings, it committed to implementing enhanced age assurance mechanisms, improving privacy communications, and limiting ad targeting for under-18 users. The Offices concluded the matter as well-founded and conditionally resolved, contingent on TikTok's satisfactory implementation of these significant commitments.

• Whether TikTok was collecting, using, and disclosing personal information, particularly with respect to children, for an appropriate, reasonable, and legitimate purpose.
• Whether TikTok's age assurance mechanisms were effective in preventing underage users from accessing the platform.
• Whether TikTok obtained valid and meaningful consent from its users for tracking, profiling, targeting, and content personalization.
• Whether TikTok's privacy communications provided sufficient upfront, clear, and comprehensive information to adult users to ensure meaningful consent.
• Whether TikTok adequately explained its collection and use of users' biometric information to ensure meaningful consent.
• Whether TikTok's privacy communications were adequate to obtain meaningful consent from youth (13-17), considering their cognitive development and potential harms from targeted ads.
• Whether TikTok met its obligations under Quebec's Private Sector Act to inform persons concerned about the collection and use of personal information for user profiles, ad targeting, and content personalization.
• Whether TikTok ensured that privacy settings provided the highest level of privacy by default under Quebec's Private Sector Act.

The complainant alleged that the Royal Canadian Mounted Police (RCMP) failed to conduct a reasonable search for records related to allegations of political interference with the Attorney General's functions concerning the SNC-Lavalin prosecution. The request covered records from July 8, 2022, to July 5, 2023. The investigation found that while the RCMP tasked relevant offices, these offices failed to search for records within the full specified timeframe. Specifically, Federal Policing and National Division did not search for records created after certain dates within the request's scope, and the Commissioner's Office's search timeframe was unclear. Furthermore, a 4600-page Police Reporting and Occurrence System (PROS) file, which the RCMP deemed irrelevant due to its 'occurrence time' being outside the request's timeframe, was found by the Commissioner to be relevant and to contain actions reported within the requested period. The Commissioner concluded that the RCMP did not conduct a reasonable search and ordered a new search and response. The RCMP agreed to implement the order.

• Whether the Royal Canadian Mounted Police conducted a reasonable search for records
• Whether Federal Policing searched for records up to July 5, 2023
• Whether National Division searched for records created after May 29, 2023
• Whether the Commissioner's Office's search timeframe was adequate
• Whether the 4600-page PROS Occurrence Report was relevant to the request timeframe