1. Eloïse Gratton Toronto, October 26, 2015 Privacy and mobile devices : Is consent overrated?

2. Part I Using location in 2015

3. mobile privacy concerns in 2003

4. e911

5. Location technology  Location technology: network based, GPS, hybrid  2015: Location technology now includes wi-fi, web beacons, etc.

6. Types of location-based services  Sponsored services (proximity services, mobile dating, etc.) delivered by sms  2015: Sponsored services + social networks (Facebook, Foursquare, etc..) delivered via mobile devices

8. Profiling opportunities  Different type of location-based advertising  static profiling  real-time profiling  dynamic profiling  2015: Big Data, social networks, mobile devices are now connected to the web (linked to OBA), convergence in technologies

11. Express consent as preferred approach  Mobile device is a personal device + location information is sensitive  Opt-in consent as the preferred approach + challenges (small screen, limited space)  2015: Screen is larger, but consent still raises concerns…. (Part II)

12. Part II Remaining legal challenges

14. Challenges with “notice and choice” approach

15. Individuals typically…  get privacy defaults wrong  disseminate content more broadly than they intended or is advisable for their own good  struggle to keep up with the technological developments

16. “Superuser” vs. average user  In determining whether a commercial representation is false or misleading, the general impression of an advertisement should be assessed through the perspective of an "ordinary hurried purchasers," "relatively unsophisticated" and "not particularly experienced at detecting the falsehoods or subtleties found in commercial representations." (Richard v. Time Inc., 2012 SCC 8)

17. PIPEDA Report of Findings #2014-008 Agreement to an app’s “permissions” does not, by itself, equal consent to collect, use and disclose personal information - Google encouraged to provide users with greater clarity to avoid misperception Lessons Learned Consent must be meaningful; mobile app developers must inform users about how they collect, use and disclose personal information via their apps. More information about online consent. Privacy practice transparency can be greatly enhanced by providing privacy information to users at key decision points (i.e. by using “just-in- time” notifications).

18. Gad Albilia v. Apple Inc. [9] The Petitioner claims that personal identifiable information concerning each of the Class Members was collected through the Apps and was transmitted, without their knowledge or permission, to third parties, for purposes wholly unrelated to the use and functionality of their iDevices or the Apps. [10] The information collected would have included Class Members’ precise home and workplace locations and current whereabouts; unique device identifier (UDID) assigned to Class Members’ iDevice; personal name assigned to the device; Class Member’s gender, age, postal code, and time zone; as well as App-specific activity such as the functions Class Members performed on the App; search terms entered; and selections of movies, songs, restaurants, etc…;

19. Subjectivity in Consent  The form of the consent sought by the organization may vary, depending upon the circumstances, the type of information and the sensitivity of the information.  Under PIPEDA, in obtaining consent, the “reasonable expectations” of the individual are also relevant. 19

20. 20 PIPEDA Report of Findings #2015-001

21.  data on users’ TV + web habits + telephone patterns.  “It won’t mean you’ll see more ads, but you’ll see better ones.” (Wade Oosterman, president of Bell Mobility and Residential Services.) 21

22. PIPEDA Report of Findings #2015-001: Opt-out consent not adequate  Sensitivity of Information:  using sensitive URLs for the purpose of generating customer profiles  sheer breadth of information used for the RAP (internet, telephone and television network usage information, account/demographic information), more sensitive when compiled.  Reasonable Expectations of Bell Customers:  using information already collected for new secondary purpose  delivers paid services  is enabling the delivery of third-party ads  is a telecommunications service provider to whom users must entrust vast amounts of their sensitive personal information in order to gain access to mobile, internet, telephone services. 22

23. Very short timeframes available for society, and the law, to react to technological innovation

24. Is consent overrated?

25.  “Today’s privacy crisis is a function of innovation that happens too quickly. Given the accelerating pace of new information technology introductions, new uses of information often appear suddenly, perhaps overnight. Still, after the initial panic, we almost always embrace the service that once violated our visceral sense of privacy. The first reaction, what I call the “creepy factor,” is the frontier response. It doesn’t last long. The Puritans reassert their rational order more quickly all the time.” (Larry Downes, Policy Analysis, “A Rational Response to the Privacy “Crisis”, Jan 2103)

26.  “the success of the Internet has, in large part, been driven by the freedom to experiment with different business models, the best of which have survived and thrived, even in the face of initial unfamiliarity and unease about the impact on consumers.” (Remarks of Commissioner Maureen K. Ohlhausen, Consumer Electronics Show, Promoting an Internet of Inclusion: More Things AND More People, at 1, 2014)

27. Thank you! Eloïse Gratton Partner and National Co-Leader, Privacy and Data Security +514.954.3106 egratton@blg.com