Connect with us
[bsa_pro_ad_space id=12]

Alberta

Tim Hortons app violated privacy laws in collection of ‘vast amounts’ of sensitive location data

Published

7 minute read

People who downloaded the Tim Hortons app had their movements tracked and recorded every few minutes of every day, even when their app was not open, in violation of Canadian privacy laws, a joint investigation by federal and provincial privacy authorities has found.

The investigation concluded that Tim Hortons’ continual and vast collection of location information was not proportional to the benefits Tim Hortons may have hoped to gain from better targeted promotion of its coffee and other products.

The Office of the Privacy Commissioner of Canada, Commission d’accès à l’information du Québec, Office of the Information and Privacy Commissioner for British Columbia, and Office of the Information and Privacy Commissioner of Alberta issued their Report of Findings today.

The Tim Hortons app asked for permission to access the mobile device’s geolocation functions, but misled many users to believe information would only be accessed when the app was in use. In reality, the app tracked users as long as the device was on, continually collecting their location data.

The app also used location data to infer where users lived, where they worked, and whether they were travelling. It generated an “event” every time users entered or left a Tim Hortons competitor, a major sports venue, or their home or workplace.

The investigation uncovered that Tim Hortons continued to collect vast amounts of location data for a year after shelving plans to use it for targeted advertising, even though it had no legitimate need to do so.

The company says it only used aggregated location data in a limited way, to analyze user trends – for example, whether users switched to other coffee chains, and how users’ movements changed as the pandemic took hold.

While Tim Hortons stopped continually tracking users’ location in 2020, after the investigation was launched, that decision did not eliminate the risk of surveillance. The investigation found that Tim Hortons’ contract with an American third-party location services supplier contained language so vague and permissive that it would have allowed the company to sell “de-identified” location data for its own purposes.

There is a real risk that de-identified geolocation data could be re-identified. A research report by the Office of the Privacy Commissioner of Canada underscored how easily people can be identified by their movements.

Location data is highly sensitive because it can be used to infer where people live and work, reveal trips to medical clinics. It can be used to make deductions about religious beliefs, sexual preferences, social political affiliations and more.

Organizations must implement robust contractual safeguards to limit service providers’ use and disclosure of their app users’ information, including in de-identified form. Failure to do so could put those users at risk of having their data used by data aggregators in ways they never envisioned, including for detailed profiling.

The investigation also revealed that Tim Hortons lacked a robust privacy management program for the app, which would have allowed the company to identify and address many of the privacy contraventions the investigation found.

The four privacy authorities recommended that Tim Hortons:

  • Delete any remaining location data and direct third-party service providers to do the same;
  • Establish and maintain a privacy management program that: includes privacy impact assessments for the app and any other apps it launches; creates a process to ensure information collection is necessary and proportional to the privacy impacts identified;  ensures that privacy communications are consistent with, and adequately explain app-related practices; and
  • Report back with the details of measures it has taken to comply with the recommendations.

Tim Hortons agreed to implement the recommendations.

QUOTES

“Tim Hortons clearly crossed the line by amassing a huge amount of highly sensitive information about its customers. Following people’s movements every few minutes of every day was clearly an inappropriate form of surveillance. This case once again highlights the harms that can result from poorly designed technologies as well as the need for strong privacy laws to protect the rights of Canadians.”

Daniel Therrien, Privacy Commissioner of Canada

“This report eloquently illustrates the risks inherent in the use of geolocation and the importance of transparent and accountable privacy practices. Without a suitable prior assessment, Tim Hortons collected sensitive information about its customers through its app, without their adequate knowledge or consent. It is to put an end to this kind of practice that Quebec has reviewed its legislation protecting personal information giving more powers to the Commission and making companies more accountable. ”

Me Diane Poitras, president, Commission d’accès à l’information du Québec

“This investigation sends a strong message to organizations that you can’t spy on your customers just because it fits in your marketing strategy. Not only is this kind of collection of information a violation of the law, it is a complete breach of customers’ trust. The good news in this case is that Tim Hortons has agreed to follow the recommendations we set out, and I hope other organizations can learn from the results of this investigation.”

Michael McEvoy, Information and Privacy Commissioner for British Columbia

“This investigation is yet another example where an organization has not effectively notified customers about its practices. Tim Hortons’ customers did not have adequate information to consent to the location tracking that was actually occurring. When people download and use these types of apps, it’s important that they know in advance what will happen to their personal information and that organizations follow through with their commitments.”

Information and Privacy Commissioner of Alberta Jill Clayton

This is a news release from the Government of Alberta.

Follow Author

Alberta

ASIRT investigations concluded on fatal officer-involved shooting involving the RCMP.

Published on

Incident investigation report from the Alberta Serious Incident Response Team (ASIRT)

Introduction

On December 22, 2022, the Alberta Serious Incident Response Team (ASIRT) was directed pursuant to s. 46.1 of the Police Act to investigate a then non-fatal Royal Canadian Mounted Police (RCMP) officer-involved shooting. The shooting of the affected person (AP) was reported to have happened during an interaction with him, as a result of him being a suspect in a complaint of a man with a gun.

While AP initially survived, he died of complications from the shooting the following day.

ASIRT’s Investigation

ASIRT’s investigation was comprehensive and thorough, conducted using current investigative protocols and principles relating to Major Case Management. Information from civilian witnesses, the subject and a witness officers, and importantly video recordings provided sufficient information to determine whether the force used by the subject officer during this incident was reasonable.

Circumstances Surrounding the Officer-Involved Shooting

On December 01, 2022, Maskwacis RCMP received a call reporting that a male [AP] had been drinking and left the caller’s house with a gun. AP was shooting the gun in the country (believed to be the area around the residence). Two RCMP officers responded.

Witness officer (WO) located AP walking on the road with a rifle. AP walked toward WO’s marked police vehicle with the rifle pointed at the vehicle/WO, while WO was seated in the driver’s seat. WO then exited his vehicle with his carbine rifle and moved to the rear of his vehicle while AP kept the rifle pointed at the police vehicle. The subject officer (SO) arrived on scene, but came from the opposite direction. AP turned around and walked toward SO with the barrel of the rifle pointed upwards. SO exited his police vehicle with his service pistol drawn and walked toward AP while he
repeatedly provided verbal direction to AP to drop the firearm. AP and SO were walking toward each other; at that time AP still had the barrel of the rifle pointed upward. As SO and AP got within approximately five meters of each other, AP lowered the barrel of the rifle and pointed it directly at SO. SO fired multiple rounds and struck AP with four rounds causing AP to stumble, drop the rifle and fall to the ground. AP initially survived the shooting and was transported to an Edmonton hospital, where he underwent emergency surgery. The following day, AP succumbed to his injuries.

Analysis

The subject officer was lawfully placed and acting in the execution of his duties in dealing with AP as a person who was the subject of a complaint about him being in possession of a firearm and shooting it off.

The Use of Force

Under s. 25 of the Criminal Code, police officers are permitted to use as much force as is necessary for the execution of their duties. Where this force is intended or is likely to cause death or grievous bodily harm, the officer must believe on reasonable grounds that the force is necessary for the self-preservation of the officer or preservation of anyone under that officer’s protection.

A police officer’s use of force is not to be assessed on a standard of perfection nor using the benefit of hindsight.

With the benefit of hindsight, time for detached reflection and knowledge of the ultimate outcome, it is easy to speculate about how things could have been done differently. That is not the standard, however, against which an officer’s conduct is measured. The question is, applying principles of proportionality, necessity, and reasonableness, whether the force used falls into a range of possible reasonable responses.

Proportionate Response

Proportionality requires balancing a use of force with the action to which it responds. Here, the subject officers were faced with an individual that was armed with a gun and pointing it in their direction. As such, the response by the subject officers in using their respective firearms to shoot AP was proportionate to the threat of death or grievous bodily harm that he reasonably posed to both of them.

Reasonably Necessary

As set out previously in this report, AP presented as a lethal threat to both SO and WO given his actions in pointing his rifle at them. While WO did not shoot during this incident that does not impact the analysis of SO’s actions. Under the circumstances as then faced by SO, no other use of force options were reasonably available for attempted use. The use by SO of his firearm to incapacitate this lethal threat was reasonably necessary. Given the above, the defence available to SO under s. 25 of the Criminal Code would apply.

Conclusion

Under s. 25 of the Criminal Code a police officer is justified in doing what he or she is authorized to do and to use as much force as is reasonably necessary where he or she has reasonable grounds to do so. Force intended to cause death or grievous bodily harm is justified if the officer believes, on reasonable grounds, that the force was necessary to prevent the death or grievous bodily harm of the officer and/or any other person. The analysis under s.34 of the Criminal Code leads to a similar finding that subject officer’s actions were lawfully permitted.

After a thorough, independent and objective investigation into the conduct of the subject officers, it is my opinion that they were lawfully placed and acting properly in the execution of their duties. There is no evidence to support any belief that any officer engaged in any unlawful or unreasonable conduct that would give rise to an offence. The force used was proportionate, necessary and reasonable in all the circumstances.

Continue Reading

Alberta

Alberta requests more control over provincial immigration system

Published on

Alberta is requesting more control over its provincial immigration to address its skilled workforce shortage, including increasing Ukrainian evacuee participation in the job market.

Premier Danielle Smith has written a letter to Prime Minister Justin Trudeau asking him to re-evaluate his government’s decision limiting the number of allocations for Alberta’s provincial nominee program in 2024. Last week, the federal government informed the province it would only receive 9,750 such allotments – which is the same number of allocations Alberta received in 2023 and is less than the 10,140 for 2024 the federal government had originally allocated.

As of February 2024, Alberta accounts for just under 12 per cent of Canada’s population, but it leads the nation in net employment growth, with 42.8 per cent of the country’s employment gains between January and February 2024. By not providing the requested increase to Alberta’s provincial nominee allocations, the federal government is restricting the province’s ability to keep up with its growing labour market demands, especially as it relates to integrating Ukrainian evacuees into Alberta’s job market.

“Alberta is growing and that is good news. Since January 2023, more than 100,000 new jobs have been created in our province and our employment rate has led the country even longer. At the same time, we continue to experience labour shortages that could be resolved by welcoming skilled workers from around the world, including evacuees from Ukraine, many of whom have the exact skills that our job market most needs. Alberta has long been the economic engine of Canada and we are once again requesting Ottawa respect section 95 of the Constitution and let us welcome the skilled individuals we need into our province on our terms.”

Danielle Smith, Premier

With Alberta’s population growth at levels not seen in four decades, Alberta’s Provincial Nominee Program is best placed to address the province’s unique immigration and economic goals.

Part of Alberta’s population growth has resulted from Russia’s invasion in Ukraine on February 24, 2022. Since that time, Alberta has welcomed a significant number of Ukrainian evacuees to the province. While it is anticipated that many will return to Ukraine following the war, Alberta is also expecting a number of families to apply for permanent residency via the Alberta Advantage Immigration Program. An increase in the number of allocations from the federal government would assist these new Albertans to fill positions in the province’s workforce.

“Immigration is key to Alberta’s ability to address labour shortages and to grow our economy. This limitation imposed by the federal government on our provincial nominee program will be a very difficult pill to swallow, not only for businesses that need this skilled labour but also to the many Ukrainian evacuees who have the skills we need and wish to stay permanently in Alberta.”

Muhammad Yaseen, Minister of Immigration and Multiculturalism

Quick facts

  • The federal government through Immigration, Refugees and Citizenship Canada sets provincial immigration nomination limits. It also approves all permanent resident applications.
  • Alberta maximized its 9,750 nomination allocations in 2023, with a total of 10,029 nominations issued within the federal government administrative buffer.

Related information

Continue Reading

Trending

X