Legal Commentary

Complaint spurred Ticketmaster change

By David Canton

For the London Free Press - November 10, 2008

Read this on Canoe

In a recent decision, Canada’s assistant privacy commissioner expressed “grave concern” after finding a major online company operating nationwide was violating federal privacy laws, years after the Personal Information Protection and Electronic Documents Act (PIPEDA) took effect.

A citizen’s complaint led the Privacy Commissioner to probe Ticketmaster Canada Ltd.’s privacy policy.

Headquartered in the U.S., Ticketmaster promotes events and sells tickets for event providers across Canada. In doing so, it collects and routinely discloses personal information to third parties for secondary marketing purposes.

The complaint alleged Ticketmaster’s practices contravened “principles of access, openness, accountability and consent” required by PIPEDA.

In particular, the complainant believed:

- Ticketmaster’s privacy policy was complicated and overly long;

- The company showed a lack of accountability in the way it handled personal information disclosed to third parties;

- Express, informed consent was not sought;

- Customer access to personal information was difficult.

The commissioner found Ticketmaster’s privacy policy was confusing and inconsistent, and customers weren’t adequately informed of the use and disclosure of their personal information.

Most notably, customers were forced to consent to Ticketmaster’s collection and disclosure to third parties of personal information as a condition of service, in direct contravention of PIPEDA.

Thus, the allegations that Ticketmaster’s practices violated the principles of openness and consent were well- founded.

But the allegation that Ticketmaster’s practices violated the principles of accountability was not well-founded, as adequate protection was provided to customers through contracts with third parties.

As a result of the findings, Ticketmaster revised its privacy policy to meet PIPEDA requirements.

Customers are now given the up-front opportunity to opt in to receive marketing material from Ticketmaster, and to allow the firm to share their personal information with third parties for secondary marketing. This puts control back into the consumer’s hands.

Customers are also now more consistently informed of Ticketmaster’s information-sharing policies.

The impact of this decision reaches beyond online ticket sellers. The assistant commissioner found companies operating in Canada must ensure their business practices comply with PIPEDA. Particularly, they should:

- Explicitly inform consumers of the use of any personal information collected and provide a clear opportunity to opt in or out;

- Protect personal information of customers being disclosed to third parties by contractual or other means;

- Effectively and consistently communicate to customers its personal information use and disclosure policies and practices;

- Ensure privacy policies are easily accessible so custo-mers can become informed without unreasonable effort.

Full post as published by eLegal Canton on November 10, 2008 (boomark / email).