Tim Hortons Probed for Privacy Breach After Allegedly Tracking Mobile App Users

Canadian regulators said they’re investigating whether the coffee chain Tim Hortons breached privacy law by consistently tracking the locations of mobile ordering app users without getting prior legal consent. 

The Office of the Privacy Commissioner of Canada and authorities in British Columbia, Quebec, and Alberta, say they’re investigating whether or not the company’s method of constantly tracking mobile app users violates the Personal Information Protection and Electronic Documents Act, Canada’s federal privacy law.

A spokesperson for Tim Hortons said the mobile app has recently been updated to only compile user location data when users have the mobile order app open.

However, earlier in June the app was reportedly tracking some users’ geolocation at all hours of the day as users went about their regular activities. Some of those users may have unknowingly agreed to the location tracking in their mobile device’s settings.

According to a report from Saltwire Network, the app has been tracking customers’ locations for more than a year. It’s unclear how many users have been affected by the app’s location data collection, but it could potentially be millions of Canadians. 

James McLeod, the author of the Saltwire Network report states, “I didn’t realize how much until I saw my coordinates in a trove of data that RBI (Restaurant Brands International, Inc.) sent to me after I made a request under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) last fall. According to the data, Tim Hortons had recorded my longitude and latitude coordinates more than 2,700 times in less than five months, and not just when I was using the app.”

McLeod added “I had no idea how extensive the tracking data was until I saw it. There were readings taken at all hours of the day and night, and RBI kept tabs on me every time the app thought I was visiting one of its competitors.”

The investigation launched by The Office of the Privacy Commissioner of Canada and others will examine “whether the organization is obtaining meaningful consent from app users to collect and use their geolocation data for purposes which could include the amassing and use of detailed user profiles, and whether that collection and use of the data is appropriate in the circumstances.” 

The statement continues, “The federal Privacy Commissioner’s office considers this to be an issue of great importance to Canadians given the privacy issues it raises. Geolocation data can be very sensitive as it can reveal information about the habits and activities of individuals, for example, medical visits or places that they regularly frequent.”

Canadian privacy regulators have restricted authority to enforce penalties themselves, however, they can file lawsuits against companies in Canadian federal courts, which can inflict fines on the coffee chain.

According to CTV News, a spokesperson for Tim Hortons stated in an email, ‘Since Tim Hortons launched our mobile app, our guests always had the choice of whether they share location data with us, including ‘always’ sharing location data — an option offered by many companies on their own apps.” The spokesperson also added that they’ll co-operate with the Canadian privacy regulatory authorities and they’re confident about resolving the matter.

Canadian privacy regulators have been pretty busy in the last few months, regardless of their somewhat limited enforcement capabilities. In February, the privacy regulators began an investigation into the facial recognition company Clearview AI, to explore whether or not the very controversial startup has encroached on local privacy laws by collecting a photo database that the company asserts can help law enforcement solve crimes.

In 2019, Canada’s Privacy Commissioner also criticized both Equifax and Facebook for not satisfactorily keeping consumers’ data safe. On Sept. 7, 2017, Equifax Inc. announced that a cyber attack left more than 143 million individuals’ private information vulnerable. About 19,000 Canadians were affected. The investigation into Facebook by the Office of the Information and Privacy Commissioner for British Columbia found that the social media giant had seriously breached Canadian privacy laws.

Just last week LifeLabs, Canada’s biggest laboratory testing company, was found to have failed to protect millions of Canadians’ private personal health information. Privacy commissioners in British Columbia and Ontario found that the laboratory testing company failed to enforce proper protocol to protect the personal data. The LifeLabs data breach impacted approximately 15 million Canadians. 

While mobile users are generally in control of their apps’ settings, do you think geolocation tracking is used more often than we realize? Do you think Tim Horton’s is responsible for violating users’ privacy? Tell us your thoughts in the comment section below! 

Read More Lawsuit & Settlement News:

Bell Mobility Relevant Advertising Program Class Action Lawsuit Certified

Long Term Disability Lawyer | Insurance Claim Denial Help

Canada Roundup Glyphosate Cancer Class Action Lawsuit Investigation

Vancouver Police Face Privacy Lawsuit Over Mass Surveillance