Canada: It's A Sensitive Subject – Canadian Vibrator Manufacturer In Hot Water Over Collection Of User's Intimate Information

The development of the Internet of Things ("IoT"), the term used to describe the growing number of physical objects that use sensors to collect and share data over telecommunication networks, means that consumers are more connected than ever to the devices they own. While advancements in IoT technology have led to a host of benefits, they have also created concerns over privacy and cybersecurity. In a privacy sweep released on September 22nd, the Global Privacy Enforcement Network found that the majority of privacy communications of Internet-connected devices are generally poor and fail to inform users about exactly what personal information is being collected and how it will be used.¹ The sweep, conducted by 25 data protection authorities around the world, reviewed a total of 314 devices and found that 59% of privacy communications for IoT devices did not adequately explain how personal information is collected, used, and disclosed.² The sweep also found that 68% of users are not fully informed about how personal information collected by the devices is stored and safeguarded; this number increases to 76% for users of IoT devices specifically examined by the Office of the Privacy Commissioner of Canada (the "OPC").³

In recent news, several of the issues brought to light by the sweep were raised by an American consumer known as N.P., who launched a complaint in Illinois against the US subsidiary of Standard Innovation® Corporation (the "Company"), a Canadian-based manufacturer of "sensual lifestyle products." The complaint alleges that the Company failed to disclose to consumers that its signature product, a high end vibrator known as the We-Vibe® (including its corresponding mobile application known as We-Connect") collects sensitive data about the user in real time and transmits this information to its servers in Canada.

Although the complaint against the Company was brought in the US, it highlights some important considerations for companies doing business in Canada. This article discusses these issues in the context of Canada's federal and provincial privacy legislation and reviews the OPC's position on privacy concerns in the context of the IoT.

Is it "Personal Information"?

In her statement of claim, N.P. alleges that the Company collected her email address and tied it to data about her We-Vibe® use including the date and time of each use and selected product settings (the "Usage Data"). In this case, one of the central issues is whether the Usage Data is considered "personal information." Canada's Personal Information Protection and Electronic Disclosure Act ("PIPEDA") defines "personal information" as information about an identifiable individual. While it is generally the case that email addresses constitute personal information⁴, the OPC's position on usage data is less clear. In a recently published paper on the IoT, the OPC suggests that even aggregate information (i.e., "compiled or statistical information that is not personally identifiable") can lead to an identifiable individual.⁵ According to the Federal Court in Gordon v Canada, if there is a serious possibility that an individual could be identified through the use of information, either alone or in combination with other available information, that information will be about an identifiable individual and will therefore qualify as personal information under PIPEDA.⁶ In fact, a study by the Massachusetts Institute of Technology found that it was possible to identify the unique purchasing habits of consumers in 90% of cases by using de-identified information from credit card purchases and matching activity against other publicly available information on Internet-enabled platforms such as LinkedIn, Facebook, Twitter and Foursquare.⁷

In the case of the We-Vibe®, if the Company packaged N.P.'s usage data with her email address, this combination of information is likely able to identify her and is therefore considered personal information under PIPEDA. As such, the Company is required to protect N.P.'s personal information at a standard commensurate with the sensitivity of the data and the potential risk of harm to individuals from unauthorized access, disclosure, copying, use, or modification of it. The highly personal nature of N.P.'s data and the corresponding risk to her social well-being from its disclosure suggest that the standard required of the Company under PIPEDA is high. Organizations that collect data about their users, especially in the context of the IoT, should be conscious of the likelihood that such data could be considered personal information by the OPC and attract PIPEDA protection. Organizations should also be conscious of the fact that data collected about users of certain IoT technology can be considered sensitive personal information and result in more onerous data protection obligations.

What Constitutes Meaningful Consent?

N.P. raises a number of privacy issues in her complaint: the Company's collection of her personal information, its reasons for the collection, and what it did with her personal information after it was collected. First, she alleges that the Company's monitoring of her We-Vibe® use and collection of her Usage Data was without her consent. Second, she alleges that the Company did not disclose the purpose of its data collection, nor did it make that purpose clear to users. Finally, she alleges that the Company transmitted her Usage Data to the Company's servers in Canada, also without her consent.

Collectively, PIPEDA and the OPC's published guidance remind organizations of their obligation to develop and implement robust and compliant privacy policies that address all of PIPEDA's 10 fair information principles, which include: accountability, identifying purposes, consent, and transparency. When software applications are interconnected, as in the case of We-Vibe's® products, organizations may collect usage information for product development and research purposes from a related app. The purposes and methods of data collection should be disclosed so that users have knowledge and choices regarding their data. In the complaint against the Company, N.P. stated that she would not have purchased the product had she been aware of how her Usage Data was being monitored, collected, and transmitted. The principle of identifying purposes is tied to obtaining meaningful consent from users; an individual must understand specifically why and how his or her information is collected, used, and disclosed in order to provide such consent. This means that organizations should avoid broadly worded privacy policies that contain blanket statements.

Recently, the OPC addressed the existing consent model (i.e., the binary, one-time consent users provide upon sign up in the form of accepting an organization's terms and conditions) and commented that this model may not adequately address the IoT and the way that connected devices collect data on an ongoing basis. This issue was also recently raised at the International Conference for Data Protection and Privacy Commissioners where international privacy authorities adopted the Mauritius Declaration on the Internet of Things.⁸ The Mauritius Declaration provides that when a customer purchases an IoT device, proper, sufficient and understandable information should be provided, and that current privacy policies do not always provide information in a clear, understandable manner.⁹ The regulators commented that consent obtained from users upon sign up for various products and services on the basis of these long and detailed agreements is not likely to be informed. This creates an interesting conflict between an organization's obligation to be clear, concise, and open on one hand, while also providing a detailed, thorough, and comprehensive privacy policy to minimize its legal risk on the other. Practically, an organization that develops and markets apps should consider addressing the 'small screen problem' by using prompts at the point of collection and having readily accessible links for consumers to consult its privacy policies. From a legal perspective, this discussion also supports the movement to "plain language" drafting, and may mean that organizations and their legal counsel need to rethink the way they write these policies.

CyberSecurity Issues & IoT

Unlike the Ashley Madison case (see our article on the OPC's investigation and report here), We-Vibe® was not hacked, nor is N.P. alleging a security breach. However, her complaint raises a warranted "red flag" that there are increased security risks when it comes to IoT devices. In a system of interconnected devices, it only takes one "weak link" for a hacker to potentially gain access to an entire system, obtain a much larger repository of personal information, and increase the risk of harm to individuals affected by the breach. A 2015 study on 10 IoT devices by Hewlett Packard revealed that "weak links" are more prevalent than we think, finding that none of the 10 systems examined required strong passwords, and only one device required two-factor authentication.¹⁰

According to a 2016 Symantec report on internet security threats, new mobile vulnerabilities in 2015 increased 214% from the previous year.¹¹ With these startling figures in mind, it is becoming more critical for developers and businesses creating IoT apps to review not only their own security measures, but the security measures of the Internet-enabled devices their app may connect to (including routers, sensors, video cameras, etc.). In a statement to the press, We-Vibe® has commented that it has "engaged external security and privacy experts to conduct a thorough review of our data practices." Businesses are reminded to similarly engage in ongoing proactive measures such as conducting security system audits on a regular basis as a best practice.

Evolving Challenges in the IoT World

The We-Vibe® case illustrates a few interesting lessons for organizations with consumer-facing IoT products. With the advent of the IoT, it is becomingly increasingly possible for a wide range of information shared or communicated to a variety of devices to create "personal information," triggering obligations under applicable privacy legislation. From a business perspective, as N.P.'s claim demonstrates, organizations never want to be in a situation where the consumer "stumbles upon" the organization's actual privacy practices (or lack thereof). Ensuring transparency in privacy policies and procedures minimizes the risk of reputational damage and future litigation. As a matter of practice, businesses should implement thorough and specific privacy policies that are drafted in an understandable manner, update these policies regularly to reflect changes in privacy practices and laws, and make these policies readily available to consumers.¹² In terms of preventative measures, organizations should be aware that IoT devices increase and create unique cybersecurity risks. These risks can be identified in a number of ways, such as engaging security professionals and consultants to address security gaps for interconnected devices and highlighting sensitive information that may require higher levels of security.

Although the specific privacy risks to an organization may still be unsettled in the evolving world of the IoT, one thing is clear: now is the time to re-evaluate your privacy policies, because the IoT is here to stay.

The authors of this article gratefully acknowledge the contributions of articling student Rowan Groenewald.

Footnotes

1. Office of the Privacy Commissioner of Canada, "Global Internet of Things Sweep finds connected devices fall short on privacy" (September 22, 2016), online: PRIV.gc.ca (https://www.priv.gc.ca/en/opc-news/news-and-announcements/2016/nr-c_160922/).

2. Office of the Privacy Commissioner of Canada, "Results of the 2016 Global Privacy Enforcement Network Sweep" (September 22, 2016), online: PRIV.gc.ca (https://www.priv.gc.ca/en/opc-news/news-and-announcements/2016/bg_160922/).

3. Ibid.

4. Office of the Privacy Commissioner of Canada, "Personal Information" (October 2013), online: PRIV.gc.ca (https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda-compliance-help/pipeda-interpretation-bulletins/interpretations_02/); See also Office of the Privacy Commissioner of Canada, "Joint Investigation of Ashley Madison by the Privacy Commissioner of Canada and the Australian Privacy Commissioner/Acting Australian Information Commissioner" (August 22, 2016), online: PRIV.gc.ca (https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2016/pipeda-2016-005/).

5. Policy Research Group of the Office of the Privacy Commissioner of Canada, "The Internet of Things: An introduction to privacy issues with a focus on the retail and home environments" (February 2016), online: PRIV.gc.ca (https://www.priv.gc.ca/en/opc-actions-and-decisions/research/explore-privacy-research/2016/iot_201602/).

6. 2008 FC 258 at para 34.

7. Supra note 5, citing Robert Lee Hotz, "Metadata Can Expose Person's Identity Even Without Name", (January 29, 2015), online: The Wall Street Journal (http://www.wsj.com/articles/metadata-can-expose-persons-identity-even-when-name-isnt-1422558349).

8. See International Conference for Data Protection and Privacy Commissioners, "Mauritius Declaration" (October 14, 2014), online: Privacy Conference 2014 (https://icdppc.org/wp-content/uploads/2015/02/Mauritius-Declaration.pdf).

9. Supra note 8 at bullet 3.

10. Hewlett Packard Enterprise, Internet of things research study: 2015 Report, online: Hewlett Packard Enterprise (https://www.hpe.com/h20195/V2/GetPDF.aspx/4AA5-4759ENW.pdf).

11. Symantec, Internet Security Threat Report (Vol 21, April 2016), online: Symantec (https://www.symantec.com/content/dam/symantec/docs/reports/istr-21-2016-en.pdf).

12. As a resource, the OPC has released some guidance for businesses to improve their existing privacy policies, available online: PRIV.gc.ca (https://www.priv.gc.ca/en/privacy-topics/privacy-policies/02_05_d_56_tips2/).

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.