Privacy Law: Google and PIPEDA

by Shaya Silber

Changes to Google’s privacy policy in March 2012 has raised many questions.  Some of the most common concerns revolve around the fact that the information that Google collects from one service is going to be shared with its other platforms as well.  Google made another major change by implementing one uniform privacy policy for most of its platforms.

A Step in the Right Direction

What most people don’t realize is that some of the changes are arguably a step in the right direction. Google brought the policies of several of its services under one umbrella policy. Previously, each of Google’s platforms had its own policy. Each privacy policy was long, technical, and tedious.  Most people did not bother to read the old policy. The few who were brave enough to wade their way through the long, technical document were often confused by its legal jargon.

In the new privacy policy, Google has made a simple, centralized, user-friendly policy.  The policy breaks down the type of information that Google is collecting, as well as the purpose of said collection. For the most part, the new policy does not contain a lot of legal jargon, and is simple to understand.  In user-friendly terms, it discusses how the information is used.  If that weren’t enough, Google outlines the steps that you can take in order to access your information and edit your information gathering settings. This includes opting out of targeted advertising. For example, a common complaint is that Google’s targeted ads hit too close to home. Some people may even describe them as “creepy”. However, under the new policy, Google makes it very easy and quick to opt out of targeted advertising.

As far as Canadian privacy law is concerned, Google’s new policy does not yet seem to be in violation of any law.  The most applicable law would be PIPEDA.  PIPEDA governs the collection, use, and disclosure of private information by private sector companies. In a nutshell, a company must obtain consent before they can collect, use, or disclose an individual’s private information.

It’s arguable that Google’s new policy is a step towards better compliance with PIPEDA. The old system used a series of complicated and tedious privacy policies for each of Google’s products. Each user agreed to those policies, but likely did not understand what they were agreeing to.  In the new policy, user consent is arguably more informed.  Furthermore, a user would have a difficult time arguing that they were not aware of Google’s policy.  This is especially true given the persistent notices that Google has been plastering across their sites.

Privacy law is a rapidly developing area of law. Each business is different, with unique information collection practices. It is difficult to know which privacy law applies to your business, and how to execute a proper privacy policy. If you are starting a new business or website, it is wise that you review your information collection practices with a privacy lawyer before opening up shop.