Jan. 16 --Google Inc.’s use of sensitive personal health
information to target individuals with health-related advertisements violated
Canada's privacy law, the Office of the Privacy Commissioner of Canada ruled in
made public Jan. 15.
Google has agreed to resolve the issue by June 2014,
the national data protection authority said in a Jan. 15 statement.
Google Canada spokeswoman confirmed Jan. 15 that Google has agreed to take
prohibits the use of sensitive health and medical information for
interest-based advertising. “We've worked closely with the Office of the
Privacy Commissioner throughout this process and are pleased to be resolving
this issue,” the spokeswoman told Bloomberg BNA.
The use of personal
health information to drive online behavioral advertising is a violation of the
Personal Information Protection and Electronic Documents Act (PIPEDA) and the
DPA's guidelines on online behavioral advertising, Interim
Privacy Commissioner Chantal Bernier said in a statement accompanying the
release of PIPEDA Report of Findings 2014-001.
“Most Canadians consider
health information to be extremely sensitive. It is inappropriate for this type
of information to be used in online behavioral advertising,” she said.
“Organizations such as Google must ensure privacy rights are respected.”
Bernier said that her office's investigation
of Google's targeted health ads benefited from collaboration with the U.S.
Federal Trade Commission.
FTC Bureau of Consumer Protection Director
Jessica Rich said in the Canada DPA's statement that collaborative
investigations are critical in addressing the increasingly global scope of
The federal privacy agency said in its ruling that its
investigation responded to an individual's complaint about the delivery of
tailored advertisements through Google's AdSense service. The individual
alleged that after he searched online for medical devices for sleep apnea, he
was “followed” by ads for such devices when he visited websites that display
ads from Google's AdSense service, the agency said.
Technical testing by
the agency's investigators verified the allegations, finding that an interest
in continuous positive airway pressure devices through a Google search was
followed by the presentation of advertising for those devices when visiting
unrelated sites about news, weather or reference information that also
displayed Google advertisements, the ruling said.
“Since Google did not
seek express consent in the circumstances, we are of the view that in this
context, Google has contravened” PIPEDA, the agency concluded in its
Google responded to the
are displayed, the company will not associate a cookie or other identifiers
with sensitive categories such as health information, the DPA said in the
Google said the complaint related to “remarketing” campaigns in
which advertisers target ads to recent visitors to their sites and acknowledged
that some users of its ad service didn't comply with the prohibition against
interest-based advertising related to sensitive issues, the DPA said. Google
involved in remarketing campaigns and would offer further training to its staff
on addressing potential privacy violations, the ruling said.
investigation also identified shortcomings in Google's systems for monitoring
monitoring of remarketing campaigns for possible privacy violations and to
upgrading its automated review system, the DPA ruling said.
concluded that the complaint was “well-founded” but also that because Google
has proposed remedial measures it has been “conditionally resolved.”
Bernier said in her statement that the agency will follow up its
investigation of Google's practices by reviewing whether other advertising
networks are complying with Canadian privacy law. “We will be contacting
various advertising stakeholders in the near future to share these
investigation results and remind them of their privacy obligations.”
To contact the reporter on this story: Peter Menyasz in Ottawa at firstname.lastname@example.org.
To contact the editor
responsible for this story: Donald G. Aplin at email@example.com.
PIPEDA Report of
Findings 2014-001 is available at http://www.priv.gc.ca/cf-dc/2014/2014_001_0114_e.asp.
To view additional stories from Privacy & Data Security Law
Resource Center™ register for a free trial now