New Guidelines for Mandatory Breach Reporting under PIPEDA and how they Impact Digital Advertising

From IAB Canada:

As anticipated, the Office of the Privacy Commissioner of Canada (OPC) clarified where obligation lies in reporting a data breach, while personal information is resting with a third-party processor. Developed to assist organizations in meeting their breach reporting and record-keeping obligations under PIPEDA’s mandatory breach reporting regime, this come into full force on November 1, 2018.

This critical piece of PIPEDA legislation impacts virtually all IAB Canada members and we strongly recommend you review these final guidelines with your internal privacy compliance officer and all members of the organization dealing directly with data management and processing. We also recommend that you discuss this will your media partners to ensure these new guidelines are fully understood.

The principal organization retains control of personal data, throughout the entire process, and therefore retains accountability and the responsibility for reporting a breach.

To summarize, the OPC reinforces that the principal organization bears the responsibility in reporting the breach. As they have control of the personal information it is therefore their responsibility to report a violation.

IAB Canada would like to stress the importance of maintaining a secured partner strategy. It is more important than ever to ensure that you have trusted vendors who are in full compliance of PIPEDA regulation. We strongly recommend that this is reflected in your agreements and that you revisit any existing contracts to revise as necessary.

To read the full article, click here. For more information about the Office of the Privacy Commissioner of Canada (OPC), click here.

It’s Not Easy Being Green: The Dos and Don’ts of Advertising Cannabis Online

Now that marijuana is legal in Canada, and companies have been licensed to sell it (with a longer list of companies awaiting that licence), there comes the challenge of separating yourself from the rest of the bourgeoning, and in many ways, exploratory market. We say challenge because, while Health Canada has released its strict regulations around digital marketing of cannabis, that’s all its really done, and questions remain around its broad language on how to properly (i.e. legally) proceed.

As companies push the boundaries and experiment in the grey areas, we’re likely to see a more concrete framework form. For now though, all we have to go on is the act itself, and what it tells us about what we can and can’t do on-line when advertising cannabis.

First, we can take a cue from where it came from. Much of the language is lifted directly from the Tobacco Act and its restrictions around advertising cigarettes.  Think about how and where you see cigarette ads – think about the last time you even saw a cigarette ad –  and you’re starting to get the idea.

Another thing to consider is the whole reason weed is legal now in the first place. It’s not because the Prime Minister believes that smoking up is good for you (JT’s stint as a snowboard instructor in Whistler, notwithstanding.) Prohibition is over largely to squeeze out the black market and prevent weed from falling into the hands of young people. The commercial viability of legal weed is the last of the government’s concerns.

So, as digital marketers, what can we do? Probably best to start with what we can’t do.

First, no lying. False advertising is as illegal here as it is in every other market. So, no overhyping your products potency or underplaying its health risks. No suggesting that you’ll finish that screenplay or get better at yoga.

No advertising to kids. Obvious, but it has implications – especially online. We have to take reasonable precautions that our ads won’t be seen by anyone under the legal age (18 in Alberta and Quebec, 19 in the rest of the country.) This means making sure our direct emails are sent to adults and those customers are identified by name. And while websites are fair game, they must be age-gated.

We can’t promote a lifestyle. According to the act, ads may not evoke “a positive or negative emotion about or image of, a way of life such as one that includes glamour, recreation, excitement, vitality, risk or daring.” It’s here where you can see those grey areas starting to form. The question becomes how to promote the recreational use of marijuana without ever referring to recreation.

We can’t use testimonials from users or hire celebrities to endorse a product. (That sound you hear is Snoop Dogg shutting down his Canadian Operations department.) We can’t sponsor a person or event. Our ads can’t depict characters or mascots, animals, or cartoons – again, anything that might appeal to children.  

In fact, we can’t depict people in our ads at all. Here’s another place where it remains to be seen how far this rule can be stretched. Is a hand considered a person?  

So what can go in our digital ads? This is one of those questions that marketers would like the government to be more forthcoming with. While we wait for that, we can look to packaging rules for guidance. We’re talking a single, uniform colour, a standardized font size and no graphics other than the company logo and, probably, a health warning.

It’s true, the act doesn’t leave a lot of room to play in. But it does leave plenty of questions. Is a hand considered a person? Is an image of a car a depiction of a certain lifestyle? How about AR technology, as some companies are already trying out, to enhance otherwise “safe” packaging?

So, online marketers have to decide: Push the boundaries of what’s allowed and risk hefty fines or even jail time, or play it uber-safe and get left behind as others innovate and find new routes.

As the market grows into its own, expect to see the advertising side of it grow too. Remember, nobody in the world has ever tried this before, and no one can predict how it will play out. As digital advertisers, we have to keep our eyes open, understand the spirit of the act, and make sound, educated judgements.

Then again, this stuff might just sell itself.