Connect with us

Alberta

Tim Hortons app violated privacy laws in collection of ‘vast amounts’ of sensitive location data

Published

7 minute read

People who downloaded the Tim Hortons app had their movements tracked and recorded every few minutes of every day, even when their app was not open, in violation of Canadian privacy laws, a joint investigation by federal and provincial privacy authorities has found.

The investigation concluded that Tim Hortons’ continual and vast collection of location information was not proportional to the benefits Tim Hortons may have hoped to gain from better targeted promotion of its coffee and other products.

The Office of the Privacy Commissioner of Canada, Commission d’accès à l’information du Québec, Office of the Information and Privacy Commissioner for British Columbia, and Office of the Information and Privacy Commissioner of Alberta issued their Report of Findings today.

The Tim Hortons app asked for permission to access the mobile device’s geolocation functions, but misled many users to believe information would only be accessed when the app was in use. In reality, the app tracked users as long as the device was on, continually collecting their location data.

The app also used location data to infer where users lived, where they worked, and whether they were travelling. It generated an “event” every time users entered or left a Tim Hortons competitor, a major sports venue, or their home or workplace.

The investigation uncovered that Tim Hortons continued to collect vast amounts of location data for a year after shelving plans to use it for targeted advertising, even though it had no legitimate need to do so.

The company says it only used aggregated location data in a limited way, to analyze user trends – for example, whether users switched to other coffee chains, and how users’ movements changed as the pandemic took hold.

While Tim Hortons stopped continually tracking users’ location in 2020, after the investigation was launched, that decision did not eliminate the risk of surveillance. The investigation found that Tim Hortons’ contract with an American third-party location services supplier contained language so vague and permissive that it would have allowed the company to sell “de-identified” location data for its own purposes.

There is a real risk that de-identified geolocation data could be re-identified. A research report by the Office of the Privacy Commissioner of Canada underscored how easily people can be identified by their movements.

Location data is highly sensitive because it can be used to infer where people live and work, reveal trips to medical clinics. It can be used to make deductions about religious beliefs, sexual preferences, social political affiliations and more.

Organizations must implement robust contractual safeguards to limit service providers’ use and disclosure of their app users’ information, including in de-identified form. Failure to do so could put those users at risk of having their data used by data aggregators in ways they never envisioned, including for detailed profiling.

The investigation also revealed that Tim Hortons lacked a robust privacy management program for the app, which would have allowed the company to identify and address many of the privacy contraventions the investigation found.

The four privacy authorities recommended that Tim Hortons:

  • Delete any remaining location data and direct third-party service providers to do the same;
  • Establish and maintain a privacy management program that: includes privacy impact assessments for the app and any other apps it launches; creates a process to ensure information collection is necessary and proportional to the privacy impacts identified;  ensures that privacy communications are consistent with, and adequately explain app-related practices; and
  • Report back with the details of measures it has taken to comply with the recommendations.

Tim Hortons agreed to implement the recommendations.

QUOTES

“Tim Hortons clearly crossed the line by amassing a huge amount of highly sensitive information about its customers. Following people’s movements every few minutes of every day was clearly an inappropriate form of surveillance. This case once again highlights the harms that can result from poorly designed technologies as well as the need for strong privacy laws to protect the rights of Canadians.”

Daniel Therrien, Privacy Commissioner of Canada

“This report eloquently illustrates the risks inherent in the use of geolocation and the importance of transparent and accountable privacy practices. Without a suitable prior assessment, Tim Hortons collected sensitive information about its customers through its app, without their adequate knowledge or consent. It is to put an end to this kind of practice that Quebec has reviewed its legislation protecting personal information giving more powers to the Commission and making companies more accountable. ”

Me Diane Poitras, president, Commission d’accès à l’information du Québec

“This investigation sends a strong message to organizations that you can’t spy on your customers just because it fits in your marketing strategy. Not only is this kind of collection of information a violation of the law, it is a complete breach of customers’ trust. The good news in this case is that Tim Hortons has agreed to follow the recommendations we set out, and I hope other organizations can learn from the results of this investigation.”

Michael McEvoy, Information and Privacy Commissioner for British Columbia

“This investigation is yet another example where an organization has not effectively notified customers about its practices. Tim Hortons’ customers did not have adequate information to consent to the location tracking that was actually occurring. When people download and use these types of apps, it’s important that they know in advance what will happen to their personal information and that organizations follow through with their commitments.”

Information and Privacy Commissioner of Alberta Jill Clayton

This is a news release from the Government of Alberta.

Follow Author

Alberta

Alberta premier defends new rules on in-person learning, no mask mandates in schools

Published on

By Dean Bennett and Colette Derworiz

Alberta Premier Danielle Smith is defending new rules ordering schools to provide in-person learning during the current wave of viral illnesses, saying a clear, measured response is crucial for students and parents.

“We need a normal school environment for our children, and we need to make sure that the classrooms stay open to be able to support our parents,” Smith said at a news conference in Medicine Hat on Friday.

“That’s why we made the decision that we did — to give that clear direction.”

Her comments came a day after she announced regulatory changes saying school boards must provide in-person learning. Schools also can’t require students to wear masks in school or be forced to take classes online.

The changes take effect immediately.

“Anyone is welcome to wear a mask if they feel that that is the right choice for them, but we should not be forcing parents to mask their kids, and we shouldn’t be denying education to kids who turn up without a mask,” Smith said.

She has said mask rules and toggling from online to in-person learning adversely affected the mental health, development and education of students during the COVID-19 pandemic and strained parents scrambling to make child-care arrangements when schools shut down.

That’s over, Smith said.

“We’re just not going to normalize these kind of extreme measures every single respiratory virus season,” she said.

School boards have been asking for more direction as a slew of seasonal respiratory and gastrointestinal illnesses, along with some COVID-19 cases, have led to high classroom absentee rates and have jammed children’s hospitals.

In Edmonton, Trisha Estabrooks, board chair for Edmonton Public Schools, said the decision provided the clarity that the board was seeking.

“All Albertans now understand that it’s not within the jurisdiction, and nor should it ever have been within the jurisdiction of individual school boards, to make decisions that belong to health officials,” said Estabrooks.

She said the province has made it clear that any future public health order would supersede the new rules.

The in-person learning change applies to grades 1-12 in all school settings, including public, separate, francophone, public charter and independent schools.

The masking change applies to those same grades and schools, but also to early childhood services.

The Opposition NDP criticized the new rules, saying it’s unrealistic to force schools to be all things to all students while also handling a wave of viral illnesses and not providing additional supports to do it.

Jason Schilling, head of the Alberta Teachers’ Association, said the government needs to work with school boards to figure out how to make this work.

“You have schools that are struggling to staff the building, (they) can’t get substitute teachers, teachers are sick, they’re covering each other’s classes, principals are covering the classes,” Schilling said in an interview.

“And then to say if you go online, you are to still offer the same programming in person — we just don’t have the people to do that.”

Wing Li, communications director for public education advocacy organization, Support our Students, said it will be difficult for schools to offer hybrid learning without any additional resources.

“There are no teachers,” Li said in an interview. “Pivoting online was mostly due to staffing shortages, which is worse now three years in.”

Li said online learning is challenging for students but, when temporary and supported, can keep schools and communities safe from spreading illness.

“This is a quite aggressive use of the Education Act to enshrine an ideology,” she said.

This report by The Canadian Press was first published Nov. 25, 2022

Continue Reading

Alberta

Don’t have a cow: Senator’s legen-dairy speech draws metaphor from bovine caper

Published on

OTTAWA — Haven’t you herd? A dramatic tale of 20 escaped cows, nine cowboys and a drone recently unfolded in St-Sévère, Que., and it behooved a Canadian senator to milk it for all it was worth.

Prompting priceless reactions of surprise from her colleagues, Sen. Julie Miville-Dechêne recounted the story of the bovine fugitives in the Senate chamber this week — and attempted to make a moo-ving point about politics.

“Honourable senators, usually, when we do tributes here, it is to recognize the achievements of our fellow citizens,” Miville-Dechêne began in French, having chosen to wear a white blouse with black spots for the occasion.

“However, today, I want to express my amused admiration for a remarkably determined herd of cows.”

On a day when senators paid tribute to a late Alberta pastor, the crash of a luxury steamer off the coast of Newfoundland in 1918 and environmental negotiators at the recent climate talks in Egypt, senators seated near Miville-Dechêne seemed udderly taken aback by the lighter fare — but there are no reports that they had beef with what she was saying.

Miville-Dechêne’s storytelling touched on the highlights of the cows’ evasion of authorities after a summer jailbreak — from their wont to jump fences like deer to a local official’s entreaty that she would not go running after cattle in a dress and high heels.

The climax of her narrative came as nine cowboys — eight on horseback, one with a drone — arrived from the western festival in nearby St-Tite, Que., north of Trois-Rivières, and nearly nabbed the vagabonds before they fled through a cornfield.

“They are still on the run, hiding in the woods by day and grazing by night,” said Miville-Dechêne, with a note of pride and perhaps a hint of fromage. 

She neglected to mention the reported costs of the twilight vandalism, which locals say has cost at least $20,000.

But Miville-Dechêne did save some of her praise for the humans in the story, congratulating the municipal general manager, Marie-Andrée Cadorette, for her “dogged determination,” and commending the would-be wranglers for stepping up when every government department and police force in Quebec said there was nothing they could do. 

“There is a political lesson in there somewhere,” said the former journalist.

Miville-Dechêne ended on what could perhaps be interpreted as a butchered metaphor about non-partisanship: “Finally, I would like to confess my unbridled admiration for these cows that have found freedom and are still out there, frolicking about. While we overcomplicate things, these cows are learning to jump fences.”

This report by The Canadian Press was first published Nov. 26, 2022.

Marie-Danielle Smith, The Canadian Press

Continue Reading

Trending

X