Skip to content
Schedule a Call
Call Now

The Tim Hortons App Investigation: A Call for Privacy Reform in Canada

Article by Tsaaro

7 min read

As concerns about surveillance rise in an expanding digital era, Canadian restaurant giant Tim Hortons is one of the most recent firms to face scrutiny for privacy violations. The fast-food restaurant chain is owned by Restaurant Brands International, which owns Burger King, Popeyes, and Firehouse Subs. 

According to a joint investigation launched by the Office of the Privacy Commissioner of Canada, Commission d’accès à l’information du Québec, Office of the Information and Privacy Commissioner for British Columbia, and the Office of the Information and Privacy Commissioner of Alberta in July 2020, consumers who downloaded the Tim Hortons app had their movements tracked and documented every few minutes of the day, even while the app was not active, in breach of Canadian privacy regulations.

The findings of the joint investigation conducted by the Canadian federal and provincial privacy authorities claim that the continuous and extensive collection of location data by the Tim Horton’s app was not proportionate to the benefits that the company sought to achieve from better-targeted advertising of its coffee and other items.

The app was downloaded about 10 million times between 2017 and 2020, with 8.6 million Canadian downloads and over 1 million worldwide. It currently has more than 1.6 million active users. 

According to the investigation, the app requested permission to use the mobile device’s geolocation features; however, many users were deceived into believing the information would be accessible only while the app was in use. The software monitored users for as long as the device was turned on, gathering location data continuously. 

It also used location data to determine where users lived, worked, and whether or not they were travelling. Every time a user entered or exited a Tim Horton’s competitor, their home or business, an “event” was logged. 

The inquiry revealed that Tim Hortons continued to gather heaps of location data for a year after abandoning plans to utilise it for targeted advertising, despite having no valid reason. According to the company, it only used aggregated location data in a limited way to assess user trends, such as whether consumers shifted to other coffee shops and how users’ movements changed as the pandemic spread.

While Tim Hortons ceased monitoring users’ movements in 2020, that action did not eliminate the potential of spying after the inquiry was initiated. According to the report, Tim Hortons’ contract with an American third-party location services supplier included wording so ambiguous and permissive that it would have permitted the firm to sell “de-identified” location data for its purposes.

There is a substantial danger of re-identification of de-identified geolocation data. A study conducted by the Office of the Privacy Commissioner of Canada revealed how readily persons might be recognised based on their movements. Location data is susceptible since it may identify where individuals live and work and journeys to medical facilities. It may deduce religious views, sexual preferences, social-political affiliations, and other information.

The investigation also revealed that Tim Hortons did not have a comprehensive privacy management policy for the app, which would have allowed the company to identify and resolve many of the privacy violations discovered.

Tim Hortons has agreed to implement the four privacy authorities’ recommendations which include:

  • Deleting any residual location data and instructing third-party service providers to follow suit;
  • Establish and maintain a privacy management programme that includes:
    • privacy impact assessments for the app and any other apps that it launches;
    • develop a process to ensure information collection is necessary and proportionate to the privacy impacts identified; 
    • ensure private communications are consistent with;
    • adequately explain app-related practices.
  • Provide details on the steps it has made to comply with the suggestions. 

The Tim Hortons investigation began as a result of a June 2020 National Post news article detailing the author’s discovery that the app tracked his location more than 2,700 times in less than 5 months, both in Canada and while on vacation in Europe and Northern Africa, and not just when the app was in use.

The course of the investigation conducted by Canada’s federal and provincial privacy authorities showcases a dire need for privacy reform in the country. While Tim Hortons has agreed to comply with various suggestions from authorities, there is no monetary penalty associated with the probe, which the regulators described as a restriction of their jurisdiction. Neither Alberta nor British Columbia has the authority to levy fines. While Quebec has the authority to impose penalties, the maximum amount Tim Hortons could have faced was $10,000.

Like many other jurisdictions, Canada needs to restructure its privacy regime to authorise inquiries not just when there is a breach but also as a preventative measure. Consumers will eventually have confidence that when they partake in this digital economy, they may do so with confidence because regulators will be equipped with the necessary means, including the power to investigate effectively and verify compliance.

At an organisational level, businesses must put in place solid contractual controls to limit service providers’ use and disclosure of app users’ information, including de-identified information. Failure to do so puts those consumers in danger of having their data utilised in ways they never expected, such as extensive profiling, by data aggregators.

Other Resources:

Report of Findings

Statement: Remarks by Privacy Commissioner of Canada

News release: Privacy Commissioners launch a joint investigation into Tim Hortons mobile app

623 thoughts on “The Tim Hortons App Investigation: A Call for Privacy Reform in Canada”

  196. seo experts us

    Nice post. I learn something more challenging on different blogs everyday. It will always be stimulating to read content from other writers and practice a little something from their store. I’d prefer to use some with the content on my blog whether you don’t mind. Natually I’ll give you a link on your web blog. Thanks for sharing.

  424. $MGMEL Mega Melania

    Write more, thats all I have to say. Literally, it seems as though you relied on the video to make your point. You obviously know what youre talking about, why throw away your intelligence on just posting videos to your blog when you could be giving us something enlightening to read?

Leave a Reply

Your email address will not be published. Required fields are marked *

Personal Data Protection Act
A Comprehensive Guide to Singapore’s Personal Data Protection Act  
Tsaaro Consulting

A Comprehensive Guide to Singapore’s Personal Data Protection Act  

Introduction  Singapore’s Personal Data Protection Act (PDPA) is the cornerstone of the country’s data protection framework, ensuring that organizations manage …

•
February 5, 2025
Let’s Decode DeepSeek AI and Associated Privacy Concerns  
Tsaaro Consulting

Let’s Decode DeepSeek AI and Associated Privacy Concerns  

“It was invigorating to have a new competitor… DeepSeek’s model is impressive, particularly around what they’re able to deliver for …

•
January 31, 2025
certain legitimate uses
What are ‘Certain Legitimate Uses’ under the DPDP Act, 2023 and the Draft DPDP Rules, 2025? 
Tsaaro Consulting

What are ‘Certain Legitimate Uses’ under the DPDP Act, 2023 and the Draft DPDP Rules, 2025? 

Introduction The Digital Personal Data Protection Act 2023 (DPDP Act) provides that consent is a prerequisite to process the personal …

•
January 30, 2025
Data Fiduciaries Under the DPDP Act,
Understanding the Obligations of Significant Data Fiduciaries Under the DPDP Act, 2023 and the Draft DPDP Rules, 2025
Tsaaro Consulting

Understanding the Obligations of Significant Data Fiduciaries Under the DPDP Act, 2023 and the Draft DPDP Rules, 2025

The Digital Personal Data Protection (DPDP) Act, 2023, introduces an overall approach to the protection of the digital personal data …

•
January 23, 2025
Draft DPDP Rules
Fortifying Data: A Guide to Security Safeguards under the DPDPA and Draft DPDP Rules
Tsaaro Consulting

Fortifying Data: A Guide to Security Safeguards under the DPDPA and Draft DPDP Rules

Today, personal data has become one of the most valuable resources, powering industries and shaping digital economies. However, the misuse …

•
January 20, 2025
Recent Comments

SHARE THIS POST

Would you like to read regular updates from Tsaaro.
Subscribe to our newsletter

Our Latest Blogs

Read what the latest hapennings in the cyber world are and learn what the
experts have to say about them

© 2024 Tsaaro Consulting. All rights reserved.
Linkedin Instagram Youtube

About Tsaaro

Resources

Other Links

Tsaaro Netherlands Office

Regus Schiphol Rijk Beech Avenue 54-62, Het Poortgebouw, Amsterdam, 1119 PW, Netherlands

Tsaaro Pune Office

Tech Centre, Rajiv Gandhi Infotech Park, Hinjewadi, Pune, Maharashtra

Tsaaro Noida Office

302, Tower C, ATS Bouquet, Noida Sector – 132, Uttar Pradesh, India

Tsaaro Bengaluru Office I

Manyata, Embassy Business Park, Outer Ring Road, Bengaluru, Karnataka

Tsaaro Bengaluru Office II

Second State, CMH Road, Indiranagar, Bengaluru, Karnataka

Call Our Experts:

+91 95577 22103

small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png

We’d love to help your organization achieve your Data Protection goals!

Schedule a complimentary consultation with our Team of Experts.