Privacy chief of Canada: Home Depot shared personal customer data with Meta

Following an investigation of Home Depot Canada (HD) the Privacy Commissioner of Canada, Philippe Dufresne, made a statement on Home Depot’s compliance with PIPEDA. The statement said in part: "As you know, this week is Data Privacy Week, and we have released the results of our investigation into Home Depot Canada’s sharing of customer information with Meta Platforms (META), which operates Facebook. Our key finding, and an important reminder for all organizations, is that when a customer chooses to receive an electronic receipt instead of a printed one, they are not consenting to have their personal information shared with third parties. Since at least 2018, Home Depot had been collecting customer email addresses at store checkouts for the stated purpose of providing customers with an electronic copy of their receipt…However, my Office’s investigation following a complaint under the Personal Information Protection and Electronic Documents Act or PIPEDA revealed that Home Depot sent these email addresses, in a coded format, along with high-level details about each customer’s in-store purchases, to Meta, who would then use this information to determine if a customer had a Facebook account. If they did, Meta would compare the person’s in-store purchases to Home Depot’s advertisements sent over the platform to measure and report on the effectiveness of those ads. Meta could also use the information for its own business purposes, including user profiling and targeted advertising that was unrelated to Home Depot. While each email address that Home Depot shared with Meta was encoded so that it could not be read by individuals at Facebook, Meta employed an automated process that allowed it to match email addresses attached to individual Facebook accounts. I am pleased to share that in response to the recommendations in our report, Home Depot has discontinued this practice as of October 2022. Home Depot has also confirmed that it would obtain express and meaningful opt-in consent should it put in place a similar practice in the future ." Reference Link