Andy Kaplan-Myrth's Public Library

Can I use pre-checked tick boxes to gain express consent?

In ACMA’s view an individual providing their information on a screen with a pre-checked tick box does not constitute consent.

However as previously described a clear an unambiguous conditional statement such as “To subscribe to our e-newsletter and receive information on our products and services by email provide your email address/mobile telephone number here ….” should be sufficient to obtain consent.

DHS | Stop.Think.Connect. Campaign

www.dhs.gov/...stop-think-connect.shtm

- Preview

spam cybersecurity

Apr

18

2012

Commissioner’s Findings - PIPEDA Case Summary #2009-008: Report of Findings: CIPPIC v. Facebook Inc. - July 16, 2009

www.priv.gc.ca/...2009_008_0716_e.asp

- Preview

296. Apart from the context of photo tagging, Facebook runs an invitation program whereby it asks users for the email addresses of non-users in order to send them invitations to join Facebook. The “Invite Your Friends” page allows for users to provide Facebook either with single addresses or with access to the address books of their Webmail accounts or email applications. The page makes no reference to a requirement for non-users’ consent.

297. The invitation that Facebook sends to non-users permits the invitee to opt out of “any future commercial mailings from Facebook.” If an invitee opts out of joining Facebook, the next user who attempts to send the same non-user an invitation receives a message to the effect that the person cannot be invited. The non-user is not informed that Facebook retains the email address even if the invitation is not accepted.

298. In its representations to our Office, Facebook stated its position as follows:

“Facebook does retain the email address an invitation is sent to and a record of the account from which it was sent, in order to make the friend connection between the two individuals if and when the invitation is accepted. Previous invitations are kept as well so that users can make connections with all individuals who have invited them. This is primarily to serve the interests of the person who uploaded the contact information, to allow them to know when their friend (notably, the person whose email address they already had in their address book) joins the service.”

299. Facebook also confirmed that the email addresses are used solely for the purpose of the invitation service and are not available to any user of the service other than the one who provided it. Facebook acknowledged that it retains these email addresses indefinitely unless it receives a request from the non-user to remove it.
3 more annotation(s)...
- Likewise in consideration of Principle 4.3, I am also concerned that Facebook does not obtain the consent of non-users in respect of its invitation feature, whereby it actively encourages users to provide non-users’ email addresses, uses these addresses to send invitations to the non-users, retains the addresses indefinitely, and further uses the addresses to provide users with an invitation history and track the success of its referral program.
- 308. The “Invite New Friends” email invitation feature is also an activity by Facebook. Facebook maintains that it provides this service for the use of its users, but clearly the service also helps Facebook gain new members and thereby increase its ability to generate revenue.
  
  309. In my view, therefore, Facebook should assume some responsibility for seeking consent in these contexts. The question is, what kind of responsibility?
- 312. Furthermore, Principle 4.3 states that the knowledge and consent of the individual are required. For situations where one party collects from a second party the personal information of a third, our Office has determined in previous cases that, depending on the circumstances, it may be deemed incumbent on the second party (in this case, the Facebook user) to directly obtain the consent from the third (in this case, the non-user). We have also determined in such cases that the first party (in this case, Facebook), though not responsible for directly obtaining consent, must nevertheless take reasonable measures to ensure that consent is obtained by the second party. In other words, the first party must exercise due diligence to ensure that the requirement for consent is met.
  
  313. Accordingly, I am satisfied that Facebook may reasonably rely on users to obtain non-users’ consent, provided that the company itself exercises reasonable due diligence. Moreover, I believe that reasonable due diligence in the circumstances would consist in taking appropriate steps to ensure that users are well aware that they must obtain non-users’ consent before disclosing their email addresses to Facebook. This would mean not only informing users clearly of the consent requirement in the Privacy Policy, but also notifying them of the requirement at each instance of disclosing non-users’ email addresses to Facebook. It would also mean enforcing punitive measures to deal with users who are found to be in violation of the consent requirement.

Commissioner’s Findings - PIPEDA Report of Findings #2012-002: Facebook didn’t get non-members’ consent to use email addresses to suggest friends, investigation finds - February 8, 2012

www.priv.gc.ca/...2012_002_0208_e.asp

- Preview

- Where an organization uses personal information - in this case, a non-user’s email address for generating friend suggestions – that organization must obtain the knowledge and consent of the individual at the earliest opportunity;