from OTTAWA Rapport d’Ottawa

by/par Carol Hughes

Federal member of Parliament Algoma-Manitoulin-Kapuskasing

Lastweek,PrivacyCommissionerPhilippe

Dufresne released a report detailing home improvement giant Home Depot selling private customer data to Meta, owners of Facebook and Instagram, without the consent or knowledge of customers. The information that was shared included customer details from e-receipts, namely encoded email addresses and in-store purchase information.Whileitcanbelegaltosharethattype of information with other companies, it requires that users actively consent to information sharing, under the Personal Information Protection and ElectronicDocumentsAct(PIPEDA).

This was not done. Home Depot told the Privacy Commissioner that it believed it received implied consent from users, as their privacy statement on their website states they “use deidentified information for internal business purposes,suchasmarketing,customerservice,and businessanalytics.”Dufresneadvisedthatthiswas insufficient as a form of consent from customers, and when pressed, Home Depot doubled down, stating they did not notify customers at check-out