Ticketmaster Canada Found to Violate Alberta Privacy Law

This posting was written by William Zale, Editor of CCH Privacy Law in Marketing.

Ticketmaster Canada violated the Alberta Personal Information Protection Act (PIPA) by requiring online customers to consent to the use of personal information for event providers’ marketing purposes, as a condition of a ticket sales transaction, according to the Office of the Information and Privacy Commissioner (OIPC).

The PIPA regulates the collection, use, and disclosure of personal information by private sector organizations in the Canadian Province of Alberta.

The OIPC’s investigation determined that Ticketmaster’s online opt-out process neither allowed customers to make an informed decision about consent nor offered customers a reasonable opportunity to decline or object to the use of their personal information for event providers’ marketing purposes. In addition, Ticketmaster’s online privacy policy was found to be complex and ambiguous.

Consent to Use of Personal Information

A customer went on Ticketmaster’s website (www.ticketmaster.ca) to purchase tickets to an event. The customer was unable to proceed with his online purchase unless he consented to Ticketmaster’s “Use of Personal Information” privacy statement, according to the OIPC.

The customer was particularly concerned with the contents of this privacy statement, which authorized Ticketmaster to share his e-mail address with event providers for their marketing purposes.

Investigators’ Recommendations

Ticketmaster agreed to implement the OIPC Investigator’s recommendations, which included (1) ceasing to require customers to consent to the use of their personal information for marketing purposes; (2) providing online customers with a reasonable opportunity to opt-out of the use of their personal information by event providers; (3) amending agreements with event providers to ensure that they reflect the appropriate use of customers’ personal information, and (4) revising the website privacy policy to allow easy navigation and comprehension of Ticketmaster’s role in the ticketing process and its collection, use, and disclosure of customers’ personal information.

On October 8, 2007, Ticketmaster launched—across Canada—a new online and telephone opt-in mechanism for event providers’ marketing communications. This mechanism offers online and telephone customers the opportunity to opt-in to receiving marketing materials from event providers by checking a box during the online ticket purchasing process.

In conjunction with the new online opt-in mechanism, Ticketmaster posted a revised online privacy policy, with an easily navigable table of contents linking to appropriate sections of the policy. The complaining customer was satisfied with the outcome, according to the OIPC.

The December 17 report on this matter (Investigation Report #P2007-IR-007) appears at CCH Privacy Law in Marketing ¶60,150.