Canada's New Guidance on Meaningful Consent

What was published

Last month the federal Privacy Commissioner published guidelines on obtaining meaningful consent, to be applied from January 1, 2019.

They do not create a new law. They explain how the Commissioner reads the consent rules already in PIPEDA, Canada's federal private-sector privacy law.

Those rules say consent only counts if the person could reasonably be expected to understand what they are agreeing to: what happens to their information, why, and with what consequences.

For a small business, most of this lands on the website's forms and the privacy page beneath them. What follows summarises published guidance; it is not legal advice.

Why the usual privacy page falls short

Most small business privacy pages were written once, often from a template, and describe everything a business might conceivably do with information.

The guidelines expect the important points to be easy to find and easy to understand, for the people the business actually serves, on the device they are using.

Somebody filling in a quote form on a phone will not open a page of four thousand words. If the facts that matter are only in there, the consent behind that form is thin.

Four things to put up front

The guidelines name four elements to emphasise.

• What you collect, named plainly: name, phone, address, details of the job.
• Who else receives it, such as an email service, booking system or payment processor.
• Why you collect it, with optional purposes kept apart from necessary ones.
• Any real risk of harm that remains once your safeguards are in place.

The second is where most policies are weakest. Saying information may be shared with service providers tells a reader nothing; naming the kinds of service tells them where their details go.

The fourth applies to fewer businesses than it sounds: a meaningful risk that survives your precautions, not a list of everything that could go wrong.

Layers instead of one long page

The guidelines favour layered information: a short version first, with the detail a tap away.

On a website, that means a sentence beside the form saying what the details are for, a plain summary at the top of the privacy page, and the full policy beneath it.

They also favour information at the moment it matters: a line beside the newsletter box saying what will be sent and how often, rather than a paragraph on another page.

The layers have to agree. A form note promising one thing and a policy saying another is worse than either alone.

Choices that are actually choices

Where something is not needed to provide what the person asked for, they must get a clear way to say yes or no.

A quote request needs a name and a way to reply, not a newsletter subscription. The newsletter belongs in a separate, unticked box; the regulator's guidance on CASL already says a pre-ticked box is not express consent.

The same goes for any optional use a form feeds: adding the address to an advertising audience, passing the enquiry to a partner, keeping it to send offers later.

Making an optional use the price of the service is what the law rules out. And sensitive details, such as health or financial information, generally call for an express yes.

A worked example

A two-broker mortgage office in a suburban plaza had a pre-qualification form on its website asking for income, debts and a phone number.

Under the button sat a newsletter box, already ticked, and a link to a privacy policy adapted from a template written for a much larger company.

The policy said information might be shared with third parties. In practice the form went through an online form service, the newsletter list lived with an email service, and the addresses were uploaded to an advertising audience.

None of that was visible to the person filling in the form, and financial details are exactly what calls for a clear, express yes.

The fix took an afternoon: a two-sentence note beside the form, the newsletter box unticked on its own line, and a summary at the top of the policy naming what was collected, who received it and why.

The advertising upload stopped until people had agreed to it separately.

Consent that keeps up

The guidelines treat consent as an ongoing process rather than a single click.

Before you use information for something new, or share it with a new kind of third party, the people it belongs to have to be told and asked.

On a small business site this usually happens quietly: a newsletter started from the enquiry list, a new booking system, a customer list uploaded for advertising.

Withdrawal has to be possible too, subject to legal or contractual limits. The way out should be as easy to find as the way in, which for email means a working unsubscribe link every time.

And keep every version of your form wording and privacy page, with the date each went live. If anybody asks what a customer agreed to, that is the answer.

Which businesses this covers

PIPEDA governs commercial activity across much of Canada, along with personal information that a business moves between provinces or out of the country.

A few provinces also have a private-sector privacy statute of their own. Whether that or PIPEDA governs a particular business turns on where and how it deals with personal information, which is a question for a lawyer.

The practical steps are sensible under either. One specific point: for children under 13, the guidelines expect a parent or guardian's consent in all but exceptional circumstances.

The counter-case

Some sites collect very little. One with no forms and nothing beyond basic analytics has little to explain, and a short, plain privacy page covers it.

These are guidelines rather than new law, and a business that did careful GDPR work last month will find much of this done.

But the rule underneath is already law, and a business that collects financial or health details, runs a newsletter or advertises to its customer list has real work to do before January.

Say plainly what you collect, who receives it and why, and make every optional use a separate yes.

Before January

1. List every form on the website.
2. Write down where each one sends its details.
3. Add a short note beside each form.
4. Untick and separate every optional box.
5. Put a plain summary at the top of the policy.
6. Ask before any new use of existing data.
7. Keep dated copies of the wording.

Step two is the one everything else depends on. You cannot tell visitors who receives their details until you know yourself, and most businesses find at least one destination they had forgotten.

The European side of the same work is covered in a last GDPR check for a Canadian site.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.