A report from the Privacy Commissioner reveals that the Tim Hortons app tracked Canadians’ movement every couple of minutes every single day, even when it wasn’t open.
Following a joint investigation between federal and provincial privacy authorities, the Privacy Commissioner concluded that the “vast collection of location data” wasn’t beneficially proportional to creating better-targeted promotion of products and violated Canadians’ privacy rights.
“The Tim Hortons app asked for permission to access the mobile device’s geolocation functions, but misled many users to believe information would only be accessed when the app was in use. In reality, the app tracked users as long as the device was on, continually collecting their location data,” the Office of the Privacy Commissioner writes.
“The app also used location data to infer where users lived, where they worked, and whether they were travelling. It generated an “event” every time users entered or left a Tim Hortons’ competitor, a major sports venue, or their home or workplace.”
“The investigation uncovered that Tim Hortons continued to collect vast amounts of location data for a year after shelving plans to use it for targeted advertising, even though it had no legitimate need to do so.”
Daniel Therrien, the Privacy Commissioner of Canada, stated that “Tim Hortons clearly crossed the line” by implementing a near-constant data harvesting application and that it was “clearly an inappropriate form of surveillance.
Besides learning where Canadians lived, worked, and when they defected to other coffee and bakery chains, the Privacy Commissioner also says that such information can also allow companies to deduce people’s sexual orientation or preferences, social and political affiliations, as well as their religious beliefs.
Tim Hortons has denied that they ever intended to collect such information and that they only used the data collected in aggregate modelling to analyze user trends.
Following the results of the investigation, privacy authorities are recommending that Tim Hortons delete all remaining location data, establish and maintain a new privacy management program, and report back with details of the measures the company has taken to comply with the recommendations.
The company says it will comply with the recommendations.
