An illustration picture shows a Google logo with two one euro coins, taken in Munich January 15, 2013.© Michael Dalder / Reuters
The Office of the Privacy Commissioner of Canada has shown admirable persistence in investigating a complaint against Google Inc.
A Canadian man who suffers from sleep apnea – a temporary cessation of breathing – had searched the Internet for information about "continuous positive airway pressure" devices, which can relieve that condition. After that, ads for CPAP devices relentlessly pursued him as he travelled to other websites. He'd shut down his computer and restart, but to no avail. He kept seeing those ads.
Sleep apnea isn't an embarrassing condition, but it is a private medical matter. If Google ends up populating the websites you visit with car ads, after you do Internet searches when you want to buy a new car, that's legal. But Canadian privacy law says that companies must ask for explicit consent to use sensitive information in targeting online ads – and personal health is a sensitive matter.
Privacy commission staff were assiduous in replicating the complainant's CPAP searches, and they got results very similar to his. Google Inc.'s own attempts to liberate the complainant from the ads were ineffective. The company believed, apparently in good faith, that it had solved the problem when it hadn't – as the privacy commissioner was able to show.
The interim privacy commissioner, Chantal Bernier, was right to observe in an interview with The Globe that "if an organization as sophisticated as Google has difficulty ensuring compliance with its privacy policy, surely others have the same challenges. The operational challenges are inherent to online behavioural advertising."
Challenging, but legally required. Google's privacy policies are already very similar to those of Canadian privacy law. With the considerable help of the privacy commissioner, one Canadian showed an enormous corporation that it is not putting its own privacy policies into effect.