'A Mass Invasion of Privacy' but No Penalties for Tim Hortons |
One way to figure out how deeply Tim Hortons is woven into Canada's fabric is a cross-border comparison. If McDonald's, perhaps its closest analogue in the United States, wanted to have the same per capita reach in that market as Tim Hortons boasts in Canada, it would have to roughly triple its 13,000-plus American outlets. |
 | | "What happened in Tim Hortons is also happening elsewhere," Daniel Therrien, the federal privacy commissioner, said.Ian Austen/The New York Times |
|
Despite being foreign owned since 2014, Tim Hortons still waves the Canadian flag as vigorously as it can. But last week, a scathing report by the federal privacy commissioner and three of his provincial counterparts laid out in great detail how Tim Hortons ignored a wide array of laws to spy on Canadians, creating "a mass invasion of Canadians' privacy." |
"As a society, we would not accept it if the government wanted to track our movements every few minutes of every day," the federal privacy commissioner, Daniel Therrien, said in his last official news conference. "It is equally unacceptable that private companies think so little of our privacy and freedom that they can initiate these activities without giving it more than a moment's thought." |
The vector for Tim Hortons' large-scale snooping, according to the report, was its mobile phone app, which was downloaded 10 million times in the three years following its introduction in 2017. At first, the app had typical retail functions involving payment, loyalty points and placing orders. |
But the privacy commissioners found that in 2019, Tim Hortons slipped in a new feature. With the help of Radar, a geolocation software company based in the United States, it turned the GPS systems in customers' phones into a corporate snooping tool. Many apps, of course, ask users for permission to access their phones' GPS while they're actively using the apps for potentially useful features like locating the nearest outlet of a store, bank or restaurant. |
The Tim Hortons app, however, went far beyond that, tracking users around the clock anywhere in the world — even when the app was closed. It recorded not only their geographic location, but whether that location was a house, factory or office and even, in many cases, the name of the building they were in. It even, according to the report, recorded whether they were popping into rival coffee shops. The continuous tracking took place despite users being told that they would only be tracked while using the app. |
Originally, the report found, Tim Hortons intended that the system would track individuals to send them specific promotions, like coupons for a Tim Hortons stand if they were, say, at an arena for a hockey game. It dropped that plan to monitor individuals but did use the data, in an aggregated form, to look for patterns and changes in where and when Canadians picked up their double-doubles. |
The report goes on to detail a wide range of other deficiencies, like inadequate protection of the data the app was harvesting, and deceptions in privacy statements. |
The tracking system was only shut down in June 2020 after the joint privacy investigation began. It was prompted by an article in The National Post by James McLeod, who discovered that the app was constantly documenting his whereabouts, even when he was overseas on vacation. |
When the report was released, Mr. Therrien and the other privacy commissioners made it clear that Tim Hortons had breached the privacy of Canadians to an extraordinary extent. |
"Geolocation data is incredibly sensitive because it paints such a detailed and revealing picture of our lives," he said, adding that "the risks related to the collection and use of location information remain high, even when 'de-identified,' as it can often be re-identified with relative ease." |
While there are some class actions against Tim Hortons underway, the company has not been fined or penalized under federal or provincial privacy laws. |
 | | The Tim Hortons app recorded its users' movements.Ian Austen/The New York Times |
|
The app remains available for download on both iPhones and Android phones. (I asked Apple and Google if the tracking software violated their app store policies or if they had taken any action against Tim Hortons. Neither company got back to me.) |
In an email, Tim Hortons said that it began its own privacy review in 2020 and is implementing all of the recommendations in the privacy commission's report. |
"We've strengthened our internal team that's dedicated to enhancing best practices when it comes to privacy and we're continuing to focus on ensuring that guests can make informed decisions about their data when using our app," the company said. |
Mr. Therrien and outside experts have long argued that Canada's privacy laws, or its system for enforcing them, are in need of substantial revision. It took a journalist to discover what Tim Hortons was doing, the official investigation dragged on for nearly two years and, ultimately, there were no penalties. Only Quebec's privacy office currently has the power to impose fines, but the maximum penalty it could have imposed on Tim Hortons, whose corporate parent had sales of $2 billion in 2020, is 10,000 Canadian dollars. |
"The laws have no teeth," Jill Clayton, the information and privacy commissioner for Alberta, told the news conference. |
Mr. Therrien said that the Tim Hortons case is not an isolated example — it's just the one that was exposed. |
"It is clear that what happened in Tim Hortons is also happening elsewhere in the collection-of-information ecosystem," he said. "Are there sufficient safeguards? Clearly not." |
 | | A Royal Canadian Navy frigate and aircraft on a Asia-Pacific exercise in 2020.Royal Canadian Navy, via Reuters |
|
- Chinese jets have increasingly been harassing Canadian and Australian military planes. For both countries, the Chinese pilots' actions in recent weeks are worrying escalations, and create the risk of a midair collision or crash.
- Each and every individual cigarette sold in Canada will carry a warning message under the terms of a new federal regulation, Vjosa Isai reports. The individual warnings are said to be the first in the world and will come in addition to the warning messages already printed on cigarette packages.
- After a tenure that largely overlapped with the pandemic, Sasha Suda is stepping down as director and chief executive of the National Gallery of Canada to head the Philadelphia Museum of Art.
- When Charlie Montoyo isn't managing the Toronto Blue Jays, he can be found playing percussion at salsa clubs.
- While growing up in Markham, Ontario, Iman Vellani once dreamed of becoming part of a Marvel project. Now, the 19-year-old is starring in "Ms. Marvel," a Disney+ series about a teenage Muslim superhero.
- "Come From Away," the inspirational musical about Gander, Newfoundland's support for thousands of stranded air travelers after the Sept. 11 terrorist attacks, will end its run on Broadway in October. It opened in 2017.
- A veil of secrecy once covered many desirable surf spots, including some on Vancouver Island. It's been pulled away by Instagram.
- In an Opinion guest essay, Kim Phuc Phan Thi, who lives in Ajax, Ontario, tells the world that "I am not 'Napalm Girl' anymore."
- International Real Estate takes a look at a 19th-century brick house with a distinctive central tower in Port Hope, Ontario.
|
A native of Windsor, Ontario, Ian Austen was educated in Toronto, lives in Ottawa and has reported about Canada for The New York Times for the past 16 years. Follow him on Twitter at @ianrausten. |
How are we doing?
We're eager to have your thoughts about this newsletter and events in Canada in general. Please send them to nytcanada@nytimes.com. |
Like this email?
Forward it to your friends, and let them know they can sign up here. |
|
