We urge everyone to read the CIPPIC petition filed yesterday in Canada asking for a investigation of Google and Doubleclick. Among the key questions raised is whether the two companies are violating Canadian privacy law (Personal Information Protection and Electronic Documents Act-PIPEDA). The full document is on the Canadian Internet Policy and Public Interest Clinic website. But here are some key excerpts raising very important issues. Bravo! (and Merci) CIPPIC.
“37. Googleâ€™s servers automatically record information when the user visits Googleâ€™s website or uses Google products. Google server logs record the search request, URL, Internet Protocol (IP) address, browser type and language, and the date and time of the request, and one or more cookies that may uniquely identify the userâ€™s browser. Google stores server logs indefinitely, but â€œanonymizesâ€ them after 18 months.
38. The act of collecting user search queries and IP addresses invokes PIPEDA, requiring Google to provide adequate notice to users of any collection, retention, use, or disclosure of personal information other than that which can be reasonably implied (in this case, collection, retention and use necessary to deliver search results to the individual user). Without such notice, Google cannot be said to be obtaining meaningful consent from users to any other information practices, including retention and use for targeted marketing purposes.
39. The fact that Google’s search service is entirely dependent upon targeted marketing to users is not evident to the ordinary computer user. It cannot therefore be said that users implicitly consent to the use of their data for marketing purposes, even if such use is central to Google’s business model. Indeed, most users likely do not reasonably expect Google to retain their search queries in connection to their IP address for much longer than necessary to deliver the requested search results.
62. Google collects a variety of personal information about its users and uses that information to, among other things, improve its target marketing services. Online advertising services are constantly being improved, sometimes in ways that involve greater collection and use of personal data. This raises the question of what level of data collection and analysis is necessary for the purpose of target marketing; at what point is Google collecting more personal data than necessary for advertising purposes? No doubt Google is limiting its collection of data to that which is relevant for the marketing purposes, but the test in Canada is necessity, not relevance.
63. CIPPIC submits that a determination of what is necessary under Principle 4.4 should be driven not by what is possible or desirable from an advertising perspective, but rather what is actually necessary for Google to provide the service. The same test should be applied to all online advertisers, not just Google.”