Tim Hortons app tracked too much personal information without adequate consent, investigation finds

App’s data tracking resulted in loss of users’ privacy, says report by federal, provincial authorities The federal privacy commissioner’s investigation into the Tim Hortons mobile app found that the app unnecessarily collected extensive amounts of data without obtaining adequate consent from users.
The commissioner’s report, which was published Wednesday morning, states that Tim Hortons collected granular location data for the purpose of targeted advertising and the promotion of its products but that the company never used the data for those purposes.
“The consequences associated with the App’s collection of that data, the vast majority of which was collected when the App was not in use, represented a loss of Users’ privacy that was not proportional to the potential benefits Tim Hortons may have hoped to gain from improved targeted promotion of its coffee and associated products,” the report read.The joint investigation was launched about two years ago by the Office of the Privacy Commissioner of Canada in conjunction with similar authorities in British Columbia, Quebec and Alberta. It came after reporting from the Financial Post found that the Tim Hortons app tracked users’ geolocation while users were not using the app.
According to a presentation to investors shared in May, the restaurant chain’s app has four million active users.
3rd party collected geolocation data
Tim Hortons was using a third-party service provider, Radar, to collect geolocation data of users. In August 2020, Tim Hortons stopped collecting location data.
However, the investigation found that there was a lack of contractual protections for users’ personal information while being processed by Radar. The report describes the language in the contractual clauses to be “vague and permissive,” which could have allowed Radar to use the personal information collected in aggregated or de-identified form for its own business. ..Source.: cbc.ca