6 ms·

>“This investigation sends a strong message to organizations that you can’t spy on your customers just because it fits in your marketing strategy. Not only is t

>“This investigation sends a strong message to organizations that you can’t spy on your customers just because it fits in your marketing strategy. Not only is this kind of collection of information a violation of the law, it is a complete breach of customers’ trust. The good news in this case is that Tim Hortons has agreed to follow the recommendations we set out, and I hope other organizations can learn from the results of this investigation.” – Michael McEvoy, Information and Privacy Commissioner for British Columbia Insane that there isn't any more forceful enforcement for "a violation of the law" than setting out "recommendations" and trusting that the guys under investigation for "violation" of the, presumably, privacy "law" will implement it.

airstrike 4y ago
You'd need a lawsuit for that. The investigation FTA was by "privacy agencies" which have no ability to enforce anything more severe than recommendations
- deleted 4y ago
  [deleted]
- revolvingocelot 4y ago
  I actually did read the article; I even grabbed a quote from it! Still, the governmental privacy authorities suggest that the law was broken; I'm aware that they aren't enforcement, because I read the article, but the language is pretty clear that they think these actions broke the law. >You'd need a lawsuit for that Can you elaborate? Is there Canadian privacy law being violated here that doesn't stipulate any penalty other than exposing Tim Hortons to private lawsuits? Forgive the directness of my question, your comment reads like you'd know. edit: reading the Report of Findings [0] on the page itself suggests that because the violations ceased once, er, the violating entity had been informed of the investigation and had suggested that it'd delete the harvested data, the joint investigation "therefore found this matter to be well-founded and conditionally resolved". So, nobody really cares [0] https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2022/pipeda-2022-001/ https://www.priv.gc.ca/en/opc-actions-and-decisions/investig...
  - throwaway_95283 4y ago
    Yeah Canada isn't the US, we have remedies available to us other than sending people to jail.
    - revolvingocelot 4y ago
      >Yeah Canada isn't the US, we have remedies available to us other than sending people to jail Can you elaborate? Is there Canadian privacy law being violated here that doesn't stipulate any penalty other than exposing Tim Hortons to private lawsuits? Forgive the directness of my question, your comment reads like you'd know. ...to be perfectly honest, "launch a civil suit and get pennies!" sounds much more American than throwing people in jail for privacy violations. The data is already out there.
      - throwaway_95283 4y ago
        Yeah I can, the The Office of the Privacy Commissioner of Canada, Commission d’accès à l’information du Québec, Office of the Information and Privacy Commissioner for British Columbia, and Office of the Information and Privacy Commissioner of Alberta collectively and individually do not have the power to imprison people. There is no determination they can make under the law that results in people or corporations going to jail.
        revolvingocelot 4y ago
        Kind of a non-sequitur of a response, not sure you read my comment, with its direct question? Even if you were responding to the second paragraph only -- and construed it as my suggesting people be imprisoned -- weird! Anyway, you answered, in a roundabout way, my direct question in another comment, namely >>They also have the power to refer their determinations to other branches of government / Attorneys General etc for further enforcement of the law should their concerns not be addressed [0] from which I can infer that this ""voluntary" "compliance"" thing they've got going on is the extent of the shit they're willing to give. My layman's reading of PIPEDA [1] suggests that court orders are eventually possible, but this act of obvious malfeasance (or, if that encroaches on a legal term, try 'fuckery') deserves a... promise to do better? Seems like the message is "if you get caught, we'll politely ask you to stop". Not the kind of response I'd like for the granularity of this kind of tracking. Sets a bad standard. [0] https://news.ycombinator.com/item?id=31588094 https://news.ycombinator.com/item?id=31588094 [1] https://laws-lois.justice.gc.ca/eng/acts/P-8.6/index.html https://laws-lois.justice.gc.ca/eng/acts/P-8.6/index.html
autoexec 4y ago
Surely, there's no "stronger message" than a company getting to make money hand over fist by exploiting their customers and then getting away with nothing but a slap on the wrist. That'll make sure no company ever decides to do that same thing since they'd obviously hate making tons of money and getting "recommendations" after a stern talking to. Talk to me about "strong messages" when CEOs are sent to prison and a company's assets are seized.
- bozhark 4y ago
  edit: Jail? Asset seizure? Nah, you want to make it non-viable as a business decision. Something like… Revoke their license retroactively to when they started doing this to consumers. Charge them for all individual incidents at maximum allocation per law. Allow the option of reduced fees per incident based on how quickly the business responds. Hold a minimum value per incident that you do not go under. Increase their tax responsibility by 15% for the next 5 years.
  - autoexec 4y ago
    Why not do most of that too? Yes, it should be non-viable as a business decision, but also something that will result in very personal and life altering consequences for those running the company. If I spied on even just a single person like this I'd be thrown in prison as a stalker. "Charge them for all individual incidents at maximum allocation per law." would mean a life sentence for CEOs when really just a decade or two behind bars would be enough to ensure that companies don't risk it.
    - bozhark 4y ago
      ¿Por que no los dos? The individual goes to jail, not the company. So how much does a fall guy cost a company? That’s just cost of business if responsibility is only held by the individual.
  - m12k 4y ago
    I think the GDPR has shown that all you need to do is set fines as a % of revenue, and they'll be taken seriously.
timsco 4y ago
Agreed - especially when you consider the provincial and federal tax dollars needed to prop up the various privacy commissions and launch an investigation like this one.
colpabar 4y ago
Ah you know, it's a multimillion dollar corporation, so laws are just tough to enforce, because reasons. It's not like if a regular person was caught doing this, because then it'd be simple: that person would go to jail. Also, there's no way that every other fast food app isn't doing the exact same thing. There's no way that mcdonald's is going to give me a free big mac just for having the app installed if they aren't collecting as much data as they can access on my device.
nopeNopeNooope 4y ago
deleted 4y ago
[deleted]

airstrike 4y ago

You'd need a lawsuit for that. The investigation FTA was by "privacy agencies" which have no ability to enforce anything more severe than recommendations

deleted 4y ago
[deleted]
revolvingocelot 4y ago
I actually did read the article; I even grabbed a quote from it! Still, the governmental privacy authorities suggest that the law was broken; I'm aware that they aren't enforcement, because I read the article, but the language is pretty clear that they think these actions broke the law. >You'd need a lawsuit for that Can you elaborate? Is there Canadian privacy law being violated here that doesn't stipulate any penalty other than exposing Tim Hortons to private lawsuits? Forgive the directness of my question, your comment reads like you'd know. edit: reading the Report of Findings [0] on the page itself suggests that because the violations ceased once, er, the violating entity had been informed of the investigation and had suggested that it'd delete the harvested data, the joint investigation "therefore found this matter to be well-founded and conditionally resolved". So, nobody really cares [0] https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2022/pipeda-2022-001/ https://www.priv.gc.ca/en/opc-actions-and-decisions/investig...
- throwaway_95283 4y ago
  Yeah Canada isn't the US, we have remedies available to us other than sending people to jail.
  - revolvingocelot 4y ago
    >Yeah Canada isn't the US, we have remedies available to us other than sending people to jail Can you elaborate? Is there Canadian privacy law being violated here that doesn't stipulate any penalty other than exposing Tim Hortons to private lawsuits? Forgive the directness of my question, your comment reads like you'd know. ...to be perfectly honest, "launch a civil suit and get pennies!" sounds much more American than throwing people in jail for privacy violations. The data is already out there.
    - throwaway_95283 4y ago
      Yeah I can, the The Office of the Privacy Commissioner of Canada, Commission d’accès à l’information du Québec, Office of the Information and Privacy Commissioner for British Columbia, and Office of the Information and Privacy Commissioner of Alberta collectively and individually do not have the power to imprison people. There is no determination they can make under the law that results in people or corporations going to jail.
      - revolvingocelot 4y ago
        Kind of a non-sequitur of a response, not sure you read my comment, with its direct question? Even if you were responding to the second paragraph only -- and construed it as my suggesting people be imprisoned -- weird! Anyway, you answered, in a roundabout way, my direct question in another comment, namely >>They also have the power to refer their determinations to other branches of government / Attorneys General etc for further enforcement of the law should their concerns not be addressed [0] from which I can infer that this ""voluntary" "compliance"" thing they've got going on is the extent of the shit they're willing to give. My layman's reading of PIPEDA [1] suggests that court orders are eventually possible, but this act of obvious malfeasance (or, if that encroaches on a legal term, try 'fuckery') deserves a... promise to do better? Seems like the message is "if you get caught, we'll politely ask you to stop". Not the kind of response I'd like for the granularity of this kind of tracking. Sets a bad standard. [0] https://news.ycombinator.com/item?id=31588094 https://news.ycombinator.com/item?id=31588094 [1] https://laws-lois.justice.gc.ca/eng/acts/P-8.6/index.html https://laws-lois.justice.gc.ca/eng/acts/P-8.6/index.html

autoexec 4y ago

Surely, there's no "stronger message" than a company getting to make money hand over fist by exploiting their customers and then getting away with nothing but a slap on the wrist. That'll make sure no company ever decides to do that same thing since they'd obviously hate making tons of money and getting "recommendations" after a stern talking to. Talk to me about "strong messages" when CEOs are sent to prison and a company's assets are seized.

bozhark 4y ago
edit: Jail? Asset seizure? Nah, you want to make it non-viable as a business decision. Something like… Revoke their license retroactively to when they started doing this to consumers. Charge them for all individual incidents at maximum allocation per law. Allow the option of reduced fees per incident based on how quickly the business responds. Hold a minimum value per incident that you do not go under. Increase their tax responsibility by 15% for the next 5 years.
- autoexec 4y ago
  Why not do most of that too? Yes, it should be non-viable as a business decision, but also something that will result in very personal and life altering consequences for those running the company. If I spied on even just a single person like this I'd be thrown in prison as a stalker. "Charge them for all individual incidents at maximum allocation per law." would mean a life sentence for CEOs when really just a decade or two behind bars would be enough to ensure that companies don't risk it.
  - bozhark 4y ago
    ¿Por que no los dos? The individual goes to jail, not the company. So how much does a fall guy cost a company? That’s just cost of business if responsibility is only held by the individual.
- m12k 4y ago
  I think the GDPR has shown that all you need to do is set fines as a % of revenue, and they'll be taken seriously.

timsco 4y ago

Agreed - especially when you consider the provincial and federal tax dollars needed to prop up the various privacy commissions and launch an investigation like this one.

colpabar 4y ago

Ah you know, it's a multimillion dollar corporation, so laws are just tough to enforce, because reasons. It's not like if a regular person was caught doing this, because then it'd be simple: that person would go to jail. Also, there's no way that every other fast food app isn't doing the exact same thing. There's no way that mcdonald's is going to give me a free big mac just for having the app installed if they aren't collecting as much data as they can access on my device.

nopeNopeNooope 4y ago

deleted 4y ago

[deleted]