Watchdogs look into app’s use of location tracking
GPS technology that can infer locations customers visit ‘raises serious concerns’
TORONTO Watchdog agencies including the federal privacy commissioner say they’re now looking at the Tim Hortons app’s use of location tracking technology.
Last week, the Financial Post reported that the Tims app uses technology from Radar Labs, a U.S. company that states on its website that it can check a phone’s location in the background as often as every three to five minutes.
Radar uses those GPS coordinates to infer the location of customers’ homes, where they work, as well as every time the company thinks they visited one of their client’s competitors.
The Tim Hortons app does not disclose that it’s doing this level of tracking, though it states it may use location “to provide tailored offers and choices ... depending on the community where you live, or we may send you a tailored offer on your morning commute.”
In response to inquiries from the Financial Post, privacy commissioners’ offices at the federal level and in B.C. said they’re looking into the Tim Hortons app. Quebec’s privacy commissioner also said it’s concerned and is analyzing the situation.
“What we can say is that this raises serious concerns and we will be contacting Tim Hortons,” a spokesperson for federal privacy commissioner Daniel Therrien said in an email.
A spokesperson for the Office of the Information and Privacy Commissioner of B.C. said in an email, “Our office is aware of the persistent location tracking in the Tim Hortons app as reported by media, and will be looking into the issue in more detail. We also encourage anyone with privacy concerns about this mobile app to submit a complaint to our office.”
Tim Hortons chief corporate officer Duncan Fulton said in an emailed statement that the app gets consent from users because they allow the app to access location services on the phone.
“Like all apps on IOS and Android, guests receive notice and must provide their permission — their express consent — before our app can access the location of their device,” he said.
“We also provide information about our privacy practices in our plain-language privacy policy. Last week, we sent out an additional notice to our guests about how we use location data, and information about how users can adjust their location settings.”
Two lawyers who spoke to the Financial Post said the law is clear on collecting personal data in Canada, and simply asking for location permission isn’t enough to get consent. However, both lawyers said that enforcement of the letter of the law is often lacking.
“Companies need to be forthright in advance about what they’re proposing to do with your information, and they have to get consent, and that consent has to be based on you understanding what is going on,” said David Fraser, a lawyer at Mcinnes Cooper in Halifax who specializes in privacy issues.
“If they don’t explain those purposes, they would be offside the legislation.”
The federal privacy commissioner has issued guidelines on what constitutes meaningful consent under Canada’s data privacy laws, and the document specifically addresses location data.
“If there is a use or disclosure a user would not reasonably expect to be occurring, such as certain sharing of information with a third party, the downloading of photos or contact lists, or the tracking of location, express consent would likely be required,” the document said.
Fraser said that granting an app permission to access the GPS device on a user’s phone is not the same as consenting to location tracking.
“On an IOS device or an Android device, an app is not able to find out your location unless you’ve given permission to the operating system to access your location information,” he said.
“There’s a decision from the privacy commissioner of Canada that app permissions do not equal consent.”
Bill Hearn, a partner at Foglers Rubinoff LLC in Toronto, offered the same interpretation of Canada’s Personal Information Protection and Electronic Documents Act.
“I’m not picking on Tims, but industry has arguably flouted some of Canada’s consent and privacy requirements because the consequences were really not meaningful, and that there was not deterrence,” he said.