On April 7, 2015, the Office of the Privacy Commissioner (“OPC”) released PIPEDA Report of Findings #2015-001 “Results of Commissioner Initiated Investigation into Bell’s Relevant Ads Program.” The OPC investigated an advertising program initiated by Bell after it received “an unprecedented number of public complaints” shortly after Bell announced, in August 2013, that it would use customers’ personal information to enable targeted ads. The resulting finding is particularly noteworthy for its extensive discussion of the factors used to determine whether an organization can rely on opt-in or opt-out consent when it collects, uses, or discloses its individuals’ personal information. Charities and not-for-profits must be aware of these factors in situations when they engage in commercial activity, such as the selling, bartering, or leasing of donor, membership, or other fundraising lists. 

Under the Personal Information Protection and Electronic Documents Act (“PIPEDA”), which applies to all organizations that engage in commercial activity, organizations must obtain “knowledge and consent of the individual...for the collection, use, or disclosure of personal information, expect where appropriate.” Consent can be either opt-in, where an individual must provide a positive agreement to a stated purpose, or opt-out, where an organization can assume consent unless the individual opts-out. The “selling, bartering, or leasing of donor, membership or other fundraising lists” is specifically included in the PIPEDA definition of commercial activity, therefore requiring some charities and not-for-profits to consider the consent provisions. 

In past findings, the OPC has generally preferred opt-in consent, stating that “opt-in consent is the most appropriate and respectful form for organizations to use.” Similarly, in the Bell investigation the OPC found that Bell’s opt-out mechanism was inadequate, particularly because it failed to give customers an express (opt-in) choice to participate in the advertising program. The OPC indicated that opt-in consent is required based primarily on two key factors, as provided by PIPEDA:

1. the degree of sensitivity of the personal information involved, and
2. the reasonable expectations of the individuals.

Regarding the second factor, the Bell decision appears to be the first OPC finding to provide a clear description of how “reasonable expectations” is to be considered in this context. It states that:

Reasonable expectations is an objective standard which requires that our Office consider all of the relevant contextual factors surrounding the practice in question, including the type of services the organization offers, and the nature of the relationship between the organization and its customers. These contextual factors must not be considered in isolation but rather, evaluated as a whole.

The broad concepts and additional commentary that this finding provides are useful for all organizations to apply when considering what the appropriate form of consent is in their particular context. When doing so, organizations must remember not only the factors set out above, but also the fact that, even if opt-out consent is appropriate in a given situation, the OPC has also set further detailed conditions that must be met when an organization uses opt-out consent. These include:

1. The personal information must be demonstrably non-sensitive in nature and context.
2. The information-sharing situation must be limited and well defined as to the nature of the personal information to be used or disclosed and the extent of the intended use or disclosure.
3. The organization's purposes must be limited and well-defined, stated in a reasonably clear and understandable manner, and brought to the individual's attention at the time the personal information is collected.
4. The organization must establish a convenient procedure for easily, inexpensively, and immediately opting out of, or withdrawing consent to, secondary purposes and must notify the individual of the procedure at the time the personal information is collected.

It is clear from the Bell finding as well as past OPC findings, that opt-in consent is the recommended and most unequivocal form of consent, and organizations choosing to use opt-out consent should carefully review the context in which they do so in order to ensure that they are providing an adequate opportunity for consent and are, therefore, in compliance with PIPEDA.

Terrance S. Carter is the managing partner with Carters Professional Corporation, and counsel to Fasken Martineau DuMoulin LLP on charitable matters. He is a member of Canada Revenue Agency’s Technical Issues Group, past member of CRA’s Charities Advisory Committee, Chair of the National Charity and Not-for-Profit Section of the Canadian Bar Association, and has been recognized as a leading expert in Canada by Lexpert and Best Lawyers in Canada. He can be reached at tcarter@carters.ca.

Sepal Bonni, B.Sc., M.Sc., J.D., Trade-mark Agent - Called to the Ontario Bar in 2013, Ms. Bonni joined Carters’ Ottawa office to practice intellectual property law after having articled with a trade-mark firm in Ottawa. Ms. Bonni has practiced in all aspects of domestic and foreign trade-mark prosecution before the Canadian Intellectual Property Office, as well as trade-mark portfolio reviews, maintenance and consultations, and is increasingly interested in the intersection of law and technology, along with new and innovative strategies in the IP world.