–

In a recent decision released by the Canadian Privacy Commissioner (PIPEDA Report of Findings #2014-001), the commissioner investigated a complaint that Google pitched ads to an individual based on medical information that he disclosed while surfing various health-related websites. The commissioner’s office took the position that “meaningful consent” is required for the delivery of this kind of targeted advertising. Implied consent might be acceptable in certain circumstances, where the information is limited to “non-sensitive“ information (which would avoid medical, financial or health information).

In this case, the individual who initiated the complaint was using Google to search for information related to a medical device used to treat a specific medical condition. Google used this sensitive personal health information (as the commissioner described it, the “online activities and viewing history of health related websites”) to target ads to that individual. When Google relied on implied consent for the use of this sensitive personal health information, it contravened Principles 4.3 and 4.3.6 of the Act. Express consent is required for use of this kind of sensitive personal information.

Calgary – 07:00 MST