(Ottawa) The Home Depot provided personal data of its customers to Meta, Facebook’s parent company, without obtaining their prior consent. The privacy commissioner, Philippe Dufresne, denounced this practice in a report made public on Thursday.
The American DIY chain provided the email addresses of its customers collected through electronic receipts. She was using Meta’s “Offline Conversions” feature to also provide her with information about purchases made.
Email addresses were encrypted, but Meta was able to determine if they were associated with a Facebook account to link them to a person. This practice had been going on since at least 2018, according to the privacy commissioner. She stopped in October 2022 after her intervention.
The commissioner was unable to say how many customers had been affected, but in all likelihood it is a significant number.
Not explained clearly
Home Depot argued that it had obtained “implied consent” from its customers and that customers could still read its privacy statement on its website or request it in-store. This argument did not convince the Commissioner since the policy did not clearly explain that information was going to be transferred to Meta.
“When people are asked for a paper or electronic receipt, there is no way to assume that when we choose the electronic receipt, information will be transmitted to third parties,” he explained at a press conference.
Innovation, Science and Industry Minister François-Philippe Champagne tabled Bill C-27 in June, which provides for fines of up to $25 million for companies that do not properly protect the personal data of their customers. clients. It would also give new powers to the Privacy Commissioner. It has passed second reading and must be studied in parliamentary committee.
This is the second time that Justin Trudeau’s government has tried to pass a bill to better protect consumer privacy. The first had already been filed in 2020, but it died on the order paper after the start of the most recent federal election campaign.
