Tim Hortons mobile ordering app's use of data to be investigated by Canada's privacy commissioner

Tim Hortons is being investigated by Canadian privacy authorities after media reports raised concerns about how its smartphone app may be collecting and using data on people's movements as they go about their daily activities.

The Office of the Privacy Commissioner of Canada, alongside similar authorities in Quebec, B.C. and Alberta, said Monday it will launch an investigation into whether or not the company's mobile ordering and payment app obeys laws that govern the security of consumers' personal information.

The federal law governing privacy issues is known as the Personal Information Protection and Electronic Documents Act, or PIPEDA.

Earlier this month, the Financial Post newspaper reported on the app's use of geolocation technology, which enables the app to silently monitor a user's whereabouts and digital activities, even when they are not actively using the app.

The Post reporter requested his user data from the company under PIPEDA, and discovered the app was keeping a log of everywhere he went, even when the app was not in use, and transmitting the data back to Tim Hortons.

'Great importance'

In a statement, the privacy commissioner's office said it will look at whether Tim Hortons "is obtaining meaningful consent from app users to collect and use their geolocation data for purposes which could include the amassing and use of detailed user profiles, and whether that collection and use of the data is appropriate in the circumstances."

"The federal privacy commissioner's office considers this to be an issue of great importance to Canadians, given the privacy issues it raises. Geolocation data can be very sensitive as it can reveal information about the habits and activities of individuals, for example, medical visits or places that they regularly frequent."

In a statement to CBC News, Tim Hortons says it will cooperate with any investigation, but strongly disputes the allegations that the app is doing something that users aren't aware of.

"Since Tim Hortons launched our mobile app, our guests always had the choice of whether they share location data with us, including 'always' sharing location data — an option offered by many companies on their own apps," a spokesperson for the chain said.

"We recently updated the Tim Hortons app to limit the collection of location data to only while guests have our app open, even if a guest has selected 'always' in their device settings."