PIPEDA: Guidelines for obtaining meaningful consent

Overview

Meaningful consent is an essential element of Canadian private sector privacy legislation. Under privacy laws, organizations are generally required to obtain meaningful consent for the collection, use and disclosure of personal information. However, advances in technology and the use of lengthy, legalistic privacy policies have too often served to make the control – and personal autonomy – that should be enabled by consent nothing more than illusory. Consent should remain central, but it is necessary to breathe life into the ways in which it is obtained.

Building on previous publications examining the current state of consent, including challenges and potential solutionsFootnote1, this document sets out practical and actionable guidance regarding what organizations should do to ensure that they obtain meaningful consent.

This document is being jointly issued by the Office of the Privacy Commissioner of Canada (“OPC”) and the Offices of the Information and Privacy Commissioner of Alberta (“OIPC-AB”) and British Columbia (“OIPC-BC”). It reflects the principles underlying the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and its substantially similar provincial counterparts: the Alberta Personal Information Protection Act; the British Columbia Personal Information Protection Act; and, the Quebec Act Respecting the Protection of Personal Information in the Private SectorFootnote2. While all of these Acts are based on the same underlying principles, some differences exist. Organizations are responsible for understanding their specific obligations under the legislation to which they are subject.Footnote3

Seven guiding principles for meaningful consent

During the OPC’s 2016 Consent Consultations, some suggested that regulators develop templates for privacy policies; we do not believe that should be our role. Rather, our view is that organizations are best placed to find innovative and creative solutions for developing a consent process that respects their specific regulatory obligations as well as the nature of their relationship with their customers. However, in designing such a process, we expect organizations to be guidedFootnote4 by the following principles:

1. Emphasize key elements

Information provided about the collection, use and disclosure of individuals’ personal information must be readily available in complete form – but to avoid information overload and facilitate understanding by individuals, certain elements warrant greater emphasis or attention in order to obtain meaningful consent.

PIPEDA requires individuals to understand the nature, purpose and consequences of what they are consenting toFootnote5. In order for consent to be considered valid, or meaningful, organizations must inform individuals of their privacy practices in a comprehensive and understandable mannerFootnote6. This means that organizations must provide information about their privacy management practices in a form that is readily accessible to those interested individuals who wish to read it in full.

However, the reality is that information buried in a privacy policy or terms of use serves no practical purpose to individuals with limited time and energy to devote to reviewing privacy information. To receive meaningful consent, organizations must allow individuals to quickly review key elements impacting their privacy decisions right up front as they are considering using the service or product on offer, making the purchase, or downloading the app, etc. For this purpose, organizations must generally put additional emphasis on the following key elements:

What personal information is being collected

Organizations must identify for individuals what personal information is being, or may be, collected about them. This must be done with sufficient precision for individuals to meaningfully understand what they are consenting to.Footnote7

With which parties personal information is being shared

Individuals expect that the personal information they provide to one organization will not be shared with another without their knowledge and consent. As such, disclosures to third parties must be clearly explained, including the types of information being shared. Organizations should be as specific as possible in enumerating these third parties. In the case where third parties may change periodically or are too numerous to specify, organizations should at the very least specify the types of third parties information is shared with and then use other means (such as layering) to be more specific. Particular attention should be paid to any disclosures to third parties that may use the information for their own purposes, as opposed to simply providing services for the first-party.

For what purposes personal information is collected, used or disclosed

Individuals should be made aware of all purposes for which information is collected, used or disclosed. At a minimum, they must be informed of purposes in sufficient detail such as to ensure they meaningfully understand what they are invited to consent to. These purposes must be described in meaningful language, avoiding vagueness like ‘service improvement’. Purposes that are integral to the provision of the service should be distinguished from those that are not, and any available options explained. Organizations should in particular highlight any purposes that would not be obvious to the individual and/or reasonably expected based on the context.

Risk of harm and other consequences

Under PIPEDAFootnote8, for consent to be valid, it must be reasonable to expect that individuals understand the consequences of the collection, use or disclosure to which they are consentingFootnote9. One such consequence, about which individuals should be made clearly aware, is risk of harm – and, in particular, those residual risks which remain after an organization has applied any mitigation measures designed to minimize the risk and impact of potential harms. If there is a meaningful risk that such residual risk will materialize and will be significant, the OPC is of the view that it is a potential consequence about which individuals must be notified.

The OPC’s premise is that if an organization identifies potential harms that may arise from the collection, use or disclosure of personal information, PIPEDA’s accountability principle will require that the organization will seek to minimize this risk. In some cases, mitigation efforts will reduce the risk significantly. In other cases the risk will remain meaningful. Only meaningful residual risks of significant harm must be notified to individuals.

By meaningful risk, we mean a risk that falls below the balance of probabilities but is more than a minimal or mere possibility. Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property.Footnote10

Note that where there is a likely (probable) risk of significant harm, the intended collection, use or disclosure would generally be considered inappropriate under subsection 5(3) of PIPEDA and therefore should not be the subject of consent.

Risk of harm should be considered broadly, and in addition to harms which arise directly from the activity, can include reasonably foreseeable harms caused by bad actors or othersFootnote11 (e.g. unauthorized re-use of social media information intended for a limited audience).

At this time, there is no prescribed form in which the above elements should be highlighted so as to give them prominence. We encourage organizations to consider adopting standardized mechanisms, to the extent that best practices emerge in the future in different sectors. Organizations should also consider the principles which follow in this document in determining the most appropriate means of communicating these key elements, while keeping in mind the requirement for additional emphasis on this information.

2. Allow individuals to control the level of detail they get and when

Information must be provided to individuals in manageable and easily-accessible ways (potentially including layers) and individuals should be able to control how much more detail they wish to obtain, and when.

Beyond the four elements above, the level of detail required to make a consent decision will vary by individual, and by situation. One person may be comfortable with a quick review of summary information; another may want to do a deeper dive. One person may want to do a more in-depth review of an organization’s privacy practices up-front; another may look at information piece-meal, returning to it later when they have more time or depending on what services they are using and when. Individuals may also want the opportunity to review in detail the information that they ‘clicked-through’ when they signed up for the service originally. All approaches to seeking privacy information should be respected and supported by organizations.

Presenting information in a layered-formatFootnote12, or by another means that supports user-control over the level of detail provided to them, helps make better sense of lengthy, complex information by offering a summary of the key highlights up front. Moreover, this information should remain available to individuals as they engage with the organization. Consent choices are not made just once; at any time, individuals should be able to re-consider whether they wish to maintain or withdraw their consent, and full information should be available to them as they make those decisions.

3. Provide individuals with clear options to say ‘yes’ or ‘no’

Individuals cannot be required to consent to the collection, use or disclosure of personal information beyond what is necessary to provide the product or service – they must be given a choice. These choices must be explained clearly and made easily accessible. Whether each choice is most appropriately ‘opt-in’ or ‘opt-out’ will depend on factors discussed in the “Form of Consent” section of this document.

Collections, uses or disclosures of personal information over which the individual cannot assert any control (other than to not use a product or service) are called conditions of service. For a collection, use, or disclosure to be a valid condition of service, it must be integral to the provision of that product or service such that it is required to fulfill its explicitly specified and legitimate purpose. Organizations should be transparent and prepared to explain why any given collection, use or disclosure is a condition of service, particularly if it is not obvious.

Otherwise, for all other collections, uses and disclosures, individuals must be given a choice (unless an exception to the general consent requirement applies).

4. Be innovative and creative

Organizations should design and/or adopt innovative consent processes that can be implemented just-in-time, are specific to the context, and are appropriate to the type of interface used.

When seeking consent online, organizations should do more than simply transpose in digital form, their paper-based policies from the offline environment. The digital environment is dynamic in nature, and its capabilities should be considered and taken advantage of. Organizations are encouraged to use a variety of communications strategies – including “just-in-time” notices, interactive tools and customized mobile interfaces – to explain their privacy practices, including the following:

“Just-in-time” notices

An important consideration in obtaining meaningful consent in the online environment is the speed with which transactions take place. In wanting to quickly access information and services, users often feel a sense of urgency in making decisions about sharing their information. It is therefore important for organizations to bring relevant privacy information to the forefront where it is conspicuous, quick to access, and intuitive. For example, if a user’s age is being requested to register for an online service, a just-in-time notice explaining why this information is needed should appear near the space where the user would input the information. As another example, if a user’s location is required to enable a certain feature of a service, a just-in-time notice explaining this and requesting access can be made when that user first accesses the feature, rather than only when signing up for the service originally.

Interactive tools

Organizations have also been using the interactive properties of the Internet to aid in the presentation of privacy information. We have seen examples in which organizations create interactive walkthroughs of their privacy settings (presenting them to users at initial sign-up, and then again periodically as ‘refreshers’), videos explaining key concepts, and/or infographics and similar visual tools.

Customized mobile interfaces

Mobile devices present an amplified communication challenge. Individuals’ time and attention are at a premium, and the medium does not lend itself to lengthy explanations. As such, organizations need to highlight privacy issues at particular decision points in the user experience where people are likely to pay attention and need guidance the most. In that context, privacy information needs to be optimized to be effective in spite of the physical limitations of screen size. Our mobile apps guidance is a good resource when designing the mobile consent experience.

5. Consider the consumer’s perspective

Consent processes must take into account the consumer’s perspective to ensure that they are user-friendly and that the information provided is generally understandable from the point of view of the organization’s target audience(s).

Consent is only valid where the individual can understand that to which they are consenting.Footnote13Organizations put significant resources into the design of user experiences and interactions; surely, they can put similar efforts toward ensuring that their consent process is understandable, user-friendly and customized to the nature of the product or service they are offering as well as their target audiences.

Organizations should consider both the content of privacy communications and their accessibility from the perspective of their users. This includes using clear explanations, a level of language suitable to a diverse audience, and a comprehensible means of displaying and/or communicating information. Organizations should also ensure that privacy policies and notices are easily accessible from all devices members of their target audience(s)may be using, including digital health technologies, smart phones, tablets, gaming devices, as well as more traditional PCs or laptops. If the practices being described are complex and involve multiple parties, the organization should make a concerted effort to ensure that users can easily access and understand all of the key elements.

In order to do all of this effectively, organizations may consider:

• Consulting with users and seeking their input when designing a consent process;
• Pilot testing or using focus groups to ensure individuals understand what they are consenting to;
• Involving user interaction/user experience (UI/UX) designers in the development of the consent process;
• Consulting with privacy experts and/or regulators when designing a consent process; and/or,
• Following an established ‘best practice,’ standard or other guideline in developing a consent process.

The suggestions above are non-exhaustive, and are intended to be scalable depending on the size of organizations and the amount and type of personal information they collect, use or disclose.

6. Make consent a dynamic and ongoing process

Informed consent is an ongoing process that changes as circumstances change; organizations should not rely on a static moment in time but rather treat consent as a dynamic and interactive process.

Ensuring the effectiveness of individual consent is a dynamic process that does not end with the posting of a privacy policy or notice, but rather, continues as organizations innovate, grow and evolve. When information flows are complex, as they often are, organizations should provide some interactive and dynamic way to anticipate and answer users’ questions if the information provided is not clear or gives rise to follow-up questions. While providing 1-800 numbers may not be feasible or practical in a fast-paced online environment, there are myriad other ways organizations can do this, such as, developing and regularly updating FAQs, using new smart technologies, chatbots, etc.

When an organization plans to introduce significant changes to its privacy practices, it must notify users and obtain consent prior to the changes coming into effect. Significant changes include using personal information for a new purpose not anticipated originally or a new disclosure of personal information to a third party for a purpose other than processing that is integral to the delivery of a service.

Organizations should also consider periodically reminding individuals about their privacy options and inviting them to review these.

Lastly, as a best practice, organizations should periodically audit their information management practices to ensure that personal information continues to be handled in the way described to individuals.

7. Be accountable: Stand ready to demonstrate compliance

Organizations, when asked, should be in a position to demonstrate compliance, and in particular that the consent process they have implemented is sufficiently understandable from the general perspective of their target audience(s) as to allow for valid and meaningful consent.

In order for an organization to demonstrate that it has obtained valid consent, pointing to a line buried in a privacy policy will not suffice. Instead, organizations should be able to demonstrate – either in the case of a complaint from an individual or a proactive query from a privacy regulator – that they have a process in place to obtain consent from individuals, and that such process is compliant with the consent obligations set out in legislation. This is an integral part of not only the consent process, but of an effective accountability regime.

Such demonstrations may include – but are not limited to – showing, when called upon, that the organization has considered and implemented the principles in this document. Again, regulators’ expectations around the steps an organization has taken to demonstrate compliance and accountability will depend on the size of organizations and the amount and type of personal information they collect, use or disclose.

For general information on privacy management practices, please refer to our guidance document, “Getting Accountability Right with a Privacy Management Program.”

Determining the appropriate form of consent

Beyond the above principles, it is important for organizations to consider…

Read The Full OPC Communication